CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- libiglMultiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide…8.8 High
- libigl, ligibl +1 moreMultiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide…7.8 High
- libiglMultiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide…7.8 High
- libiglMultiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds read. An attacker can provide a malicious fi…4.3 Medium
- libiglMultiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds read. An attacker can provide a malicious fi…4.3 Medium
- libiglMultiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide…7.8 High
- libiglAn out-of-bounds write vulnerability exists in the readNODE functionality of libigl v2.5.0. A specially crafted .node file can lead to an out-of-bounds write. An attacker can provide a malicious file…7.8 High
- foxit reader, foxitsoftware foxit reader, foxit pdf editor +1 more +3 moreA privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability occurs due to improper certification validation of the updater executable before executing it. A low p…8.2 High
- oretnom23 simple online bidding systemSourceCodester Simple Online Bidding System HTTP POST Request save_product cross-site request forgery6.9 Medium
silverstripe/graphqlPackagistsilverstripe/graphql Cross-Site Request Forgery vulnerability7.3 Highsilverstripe/frameworkPackagistsilverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector8.8 Highsilverstripe/frameworkPackagistsilverstripe/framework has possible denial of service attack vector when flushing7.5 Highsilverstripe/frameworkPackagistsilverstripe/framework may disclose database credentials during connection failure6.5 Medium- red hat directory server 11.5 e4s for rhel 8, directory server 11.7 for rhel 8, directory server 11.8 for rhel 8 +10 more +12 more389-ds-base: potential denial of service via specially crafted kerberos as-req request7.5 High
- phpmybackupproCross-Site Scripting (XSS) vulnerability on PhpMyBackupPro7.1 High
- phpmybackupproCross-Site Scripting (XSS) vulnerability on PhpMyBackupPro7.1 High
- phpmybackupproCross-Site Scripting (XSS) vulnerability on PhpMyBackupPro7.1 High
- ibm aspera faspexIBM Aspera Faspex cross-site scripting4.8 Medium
- red hat directory server 11.5 e4s for rhel 8, directory server 11.8 for rhel 8, directory server 11.9 for rhel 8 +7 more +9 more389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c5.7 Medium
- ibm engineering workflow managementIBM Engineering Workflow Management cross-site scripting4.9 Medium
- oring iap-420, oringnet iap-420 firmware +1 moreCommand Injection8.7 High
- oring iap-420, oringnet iap-420 firmware +1 moreStored Cross-Site Scripting8.3 High
- huawei curiem-wfg9b, curiem-wfg9b firmware +1 moreVarious Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previous UEFI phases to prevent direct access to…7.8 High
- huawei curiem-wfg9b, curiem-wfg9b firmware +1 moreVarious Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previous UEFI phases to prevent direct access to…7.8 High
- huawei curiem-wfg9b, curiem-wfg9b firmware, curiem wfg98 bios +2 moreHuawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26), As the communication buffer size hasn’t been properly validated to be of the expected size, it can partially overlap with the beginning SMRAM.This c…7.8 High
- huawei curiem-wfg9b, curiem-wfg9b firmware +1 moreHuawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26) Arbitrary Memory Corruption in SMI Handler of ThisiServicesSmm SMM module. This can be leveraged by a malicious OS attacker to corrupt arbitrary SMRA…7.8 High
- huawei curiem-wfg9b, curiem-wfg9b firmware +1 moreHuawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26. Memory Corruption in SMI Handler of HddPassword SMM Module. This can be leveraged by a malicious OS attacker to corrupt data structures stored at the…7.8 High
- huawei egrt-00, egrt-00 firmware +1 moreSome Huawei smart speakers have a memory overflow vulnerability. Successful exploitation of this vulnerability may cause certain functions to fail.7.2 High
- ameya/ayame utauOS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.ust file), an arbitrary OS command may be executed.8.4 High
- ameya/ayame utauPath traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer (.uar file, .zip file) to UTAU, an arbitrary file may be pla…3.3 Low
- openssl, debian linux, netapp 500f firmware +32 more +34 moreUse After Free with SSL_free_buffers9.8 Critical
- No product listedAn issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to a denial of service, impersonating the client to the server…7.3 High
- esmind, llc mosp kintai kanriIncorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unauthenticated attacker with access to the product to alter the pr…7.5 High
- esmind mosp kintai kanriPath traversal vulnerability in MosP kintai kanri V4.6.6 and earlier allows a remote attacker who can log in to the product to obtain sensitive information of the product.6.5 Medium
silverstripe/frameworkPackagistsilverstripe/framework allows upload of dangerous file types8.8 Highsilverstripe/frameworkPackagistsilverstripe/framework vulnerable to member disclosure in login form5.3 Mediumsilverstripe/frameworkPackagistsilverstripe/framework sends passwords back to browsers under some circumstances3.5 Lowsilverstripe/frameworkPackagistsilverstripe/framework uploaded PHP script execution in assetsNo scoresilverstripe/frameworkPackagistsilverstripe/framework code execution vulnerability7.5 Highsilverstripe/frameworkPackagistsilverstripe/framework BackURL validation bypass with malformed URLs7.5 Highsilverstripe/frameworkPackagistsilverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms6.5 Medium- orangehrmOrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.8.1 High
silverstripe/frameworkPackagistsilverstripe/framework Privilege Escalation Risk in Member Edit form6.5 Mediumsilverstripe/frameworkPackagistsilverstripe/framework's URL parameters `isDev` and `isTest` unguarded6.5 Mediumsilverstripe/frameworkPackagistsilverstripe/framework SQL injection in full text search8.8 Highsilverstripe/frameworkPackagistsilverstripe/framework users inadvertently passing sensitive data to LoginAttempt6.5 Mediumsilverstripe/frameworkPackagistsilverstripe/framework CSV Excel Macro Injection8.0 Highsilverstripe/frameworkPackagistsilverstripe/framework vulnerable to user enumeration via timing attack on login and password reset formsNo scoresilverstripe/frameworkPackagistsilverstripe/framework's User-Agent header not correctly invalidating user session7.5 Highsilverstripe/frameworkPackagistsilverstripe/framework has Cross-site Scripting vulnerability in page history comparisonNo score- Show moreLoading…