CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- linux, linux kernel +1 morebtrfs: fix re-dirty process of tree-log nodes5.5 Medium
- linux, linux kernel +1 moreALSA: pcm: oss: Limit the period size to 16MB5.5 Medium
- No product listedAn issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in plaintext via a passback attack. NOTE: This vulnerability only affects products tha…4.9 Medium
- linux, linux kernel +1 morebtrfs: free exchange changeset on failures5.5 Medium
- linux, linux kernel +1 morenfsd: Fix nsfd startup race (again)4.7 Medium
- linux, linux kernel +1 morenfsd: fix use-after-free due to delegation race9.8 Critical
- linux, linux kernel +1 moreaio: fix use-after-free due to missing POLLFREE handling7.8 High
- linux, linux kernel +1 morescsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()6.2 Medium
- linux, linux kernel +1 moreASoC: codecs: wcd934x: handle channel mappping list correctly7.8 High
- linux, linux kernel +1 morei40e: Fix NULL pointer dereference in i40e_dbg_dump_desc5.5 Medium
- linux, linux kernel +1 moreiio: mma8452: Fix trigger reference couting7.8 High
- linux, linux kernel +1 moreiio: accel: kxcjk-1013: Fix possible memory leak in probe and remove5.5 Medium
- ptrd kwikKwik does not discard unused encryption keys6.5 Medium
- pingcap tidbPingCAP TiDB v7.5.1 was discovered to contain a buffer overflow vulnerability, which could lead to database crashes and denial of service attacks.6.5 Medium
- tenda fh1206 firmwareTenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeCommand.8.6 High
- pingcap tidbPingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer.7.5 High
- tenda fh1206 firmwareTenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac.9.8 Critical
- open quantum safe liboqsAn issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /pqcrystals-dilithium-standard_ml-dsa-44-ipd_avx2/sign.c comp…9.8 Critical
- bluexsx box-imAn arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafted PDF file.9.6 Critical
- zoneland o2oaAn arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.5.4 Medium
- jenkins report info, jenkins project report info plugin +1 moreJenkins Report Info Plugin Path Traversal vulnerability4.3 Medium
- No product listedAn arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uploading a crafted PDF file.5.5 Medium
- xtdoa xintongda oaAn arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary code via uploading a crafted PDF file.6.1 Medium
- gitlabMissing Authorization in GitLab4.0 Medium
- flexense disk pulse enterprise, sync breeze enterprise server, vx search enterprise +1 more +3 moreXSS vulnerability in VX Search Enterprise7.1 High
- flexense vx search enterprise, vx search +1 moreXSS vulnerability in VX Search Enterprise7.1 High
- flexense vx search enterprise, vx search +1 moreXSS vulnerability in VX Search Enterprise7.1 High
- flexense disk pulse enterprise, vx search enterprise, vx search +2 moreXSS vulnerability in VX Search Enterprise7.1 High
- ibm security guardiumIBM Security Guardium cross-site scripting5.4 Medium
- canonical snapdCVE-2024-5138: snapd snapctl auth bypass8.1 High
- unknown yith woocommerce ajax searchYITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting7.2 High
- php server monitor server monitorCross-Site Scripting vulnerability in PHP Server Monitor6.3 Medium
- dolibarr, dolibarr erp cms, erp\/crm +2 moreMultiple vulnerabilities in DOLIBARR's ERP CMS9.1 Critical
- dolibarr erp cms, erp\/crm +1 moreMultiple vulnerabilities in DOLIBARR's ERP CMS9.1 Critical
- heyewei jfinalcmsJFinalCMS content cross site scripting5.1 Medium
- opajaap wp photo album plusWP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- brainstormforce spectra, spectra gutenberg blocks – website builder for the block editor +1 moreSpectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- lenospzzdevelop lenosp Adduser Page cross site scripting5.1 Medium
- posimyth the plus addons for elementor, posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerce +1 moreThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- avecnous event postEvent post <= 5.9.4 - Missing Authorization4.3 Medium
- brainstormforce custom fonts – host your fonts locally, custom fonts +1 moreCustom Fonts – Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- kapasias lottiefiles, lottiefiles – json based animation lottie & bodymovin for elementor +1 moreLottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor <= 1.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- posimyth the plus addons for elementor, posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerce +1 moreThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hunch manifest schema app structured dataSchema App Structured Data <= 2.2.0 - Missing Authorization4.3 Medium
- xjd2020 fastcmsFastCMS New Article Tab cross site scripting5.1 Medium
- pugjs pugPug allows JavaScript code execution if an application accepts untrusted input6.8 Medium
- xuliangzhan vxe-tablexuliangzhan vxe-table vxe-textarea textarea.js export cross site scripting5.3 Medium
- m-files hubshareXSS in Hubshare's social module7.0 High
- seopress, rainbowgeek seopress – on-site seo & analytics +1 moreSEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sudar email logEmail Log <= 2.4.8 - Unauthenticated Hook Injection8.1 High
- Show moreLoading…