CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
silverstripe/frameworkPackagistsilverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage6.1 Medium- fedorindutny ipip SSRF improper categorization in isPublic8.1 High
- No product listedIn Avocent DSR2030 Appliance firmware 03.04.00.07 before 03.07.01.23, and SVIP1020 Appliance firmware 01.06.00.03 before 01.07.00.00, there is reflected cross-site scripting (XSS).6.1 Medium
silverstripe/frameworkPackagistsilverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL6.1 Mediumsilverstripe/frameworkPackagistsilverstripe/framework has Cross-site Scripting vulnerability in page name6.1 Mediumsilverstripe/frameworkPackagistsilverstripe/framework member disclosure in login form5.3 Mediumsilverstripe/frameworkPackagistsilverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField`6.1 Mediumsilverstripe/frameworkPackagistsilverstripe/framework's `Member.Name` is not escaped5.4 Mediumsilverstripe/frameworkPackagistsilverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled3.1 Lowsilverstripe/frameworkPackagistsilverstripe/framework missing ACL on reports4.3 Mediumsilverstripe/frameworkPackagistsilverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`4.3 Mediumsilverstripe/frameworkPackagistsilverstripe/framework password encryption salt not updatedNo scoresilverstripe/commentsPackagistSilverStripe comments module includes version of jQuery vulnerable to Cross-site Scripting4.4 Medium- layer5 mesheryGHSL-2024-014 Meshery SQL Injection vulnerability5.9 Medium
- layer5 mesheryGHSL-2024-013 Meshery SQL Injection vulnerability5.9 Medium
- manageengine adaudit plus, zohocorp manageengine adaudit plus +1 moreInsufficient Access Control Vulnerability5.5 Medium
- manageengine adaudit plus, zohocorp manageengine adaudit plus +1 moreInsufficient Access Control Vulnerability4.2 Medium
- manageengine adselfservice plus, zohocorp manageengine adselfservice plus +1 moreDOS Vulnerability5.3 Medium
- dbt-labs dbt-coredbt allows Binding to an Unrestricted IP Address via socketsocket5.3 Medium
- mindersec minderDenial of service of Minder Server from maliciously crafted GitHub attestations5.3 Medium
- zelnickb mit identibot, mit-identibot +1 moreMIT IdentiBot User-Kerberos Mapping Publicly Available7.5 High
- advplyr audiobookshelfAudiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks4.8 Medium
- rack rack-contribrack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter8.6 High
- bwoodsend rockhopperbwoodsend rockhopper Binary Parser ragged_array.c count_rows buffer overflow4.8 Medium
- matter-labs era-compiler-solidityZKsync Era evaluation order of Yul function arguments5.3 Medium
- openapitools openapi-generatorOpenAPI Generator Online - Arbitrary File Read/Delete8.3 High
- kaminariKaminari Insecure File Permissions Vulnerability6.6 Medium
- grup arge energy and control systems smartpowerSQLi in Grup Arge Energy and Control Systems's Smartpower10.0 Critical
- fogprojectconfigureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash and insecure). In order to exploit the vu…7.8 High
dtb-aarch64openSUSE,kernel-64kbopenSUSE,kernel-debugopenSUSE +10 more +12 moreSecurity update for the Linux KernelNo score- saltos rhinosCross-site Scripting vulnerability in RhinOS from SaltOS7.1 High
- saltos rhinosCross-site Scripting vulnerability in RhinOS from SaltOS7.1 High
- saltos rhinosCode Injection vulnerability in RhinOS from SaltOS10.0 Critical
- wtriple winnmpMultiple vulnerabilities in WinNMP from Wtriple6.3 Medium
- wtriple winnmpMultiple vulnerabilities in WinNMP from Wtriple6.3 Medium
- chromium libvpxHeap overflow in libvpx5.7 Medium
- logpoint saml authenticationAn issue was discovered in Logpoint SAML Authentication before 6.0.3. An attacker can place a crafted filename in the state field of a SAML SSO-URL response, and the file corresponding to this filenam…5.3 Medium
- tp-link archer c4500x, archer c4500 firmware +1 moreTP-Link Archer C5400X - RFTest Unauthenticated Command Injection8.8 High
- manageengine servicedesk plus, supportcenter plus, servicedesk plus, servicedesk plus msp, supportcenter plus +4 more +6 moreStored XSS Vulnerability2.4 Low
- pmb services pmbRemote Code Inclusion Vulnerability in Multiple PMB Versions9.8 Critical
- askey 5g nr small cellASKEY 5G NR Small Cell - Command Injection7.2 High
- eclipse openj9, eclipse foundation open j9 +1 moreEclipse Open J9 With -Xgc:concurrentScavenge on IBM Z, could write/read outside of a buffer5.3 Medium
- krzysztof-furtak kkprogressbar2, unknown kkprogressbar2 free +1 moreKKProgressbar2 Free <= 1.1.4.2 - Progress Bar Deletion via CSRF8.8 High
- krzysztof-furtak kkprogressbar2, krzysztof furtak kkprogressbar2 free +1 moreKKProgressbar2 Free <= 1.1.4.2 - Stored XSS via CSRF6.1 Medium
- krzysztof-furtak kkprogressbar2, unknown kkprogressbar2 free +1 moreKKProgressbar2 Free <= 1.1.4.2 - Admin+ SQL Injection6.5 Medium
- esterox business cardBusiness Card <= 1.0.0 - Arbitrary Card Deletion via CSRF6.4 Medium
- esterox business cardBusiness Card <= 1.0.0 - Card Edit via CSRF7.1 High
- esterox business cardBusiness Card <= 1.0.0 - Category Edit via CSRF6.3 Medium
- esterox business cardBusiness Card <= 1.0.0 - Category Deletion via CSRF5.0 Medium
- metaphorcreations dittyDitty < 3.1.36 - Author+ Stored XSS5.4 Medium
- Show moreLoading…