CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- wavlink quantum d2gAn issue discovered in Wavlink QUANTUM D2G routers allows attackers to hijack TCP sessions which could lead to a denial of service.7.5 High
- apiris kafeoAn issue was discovered in Apiris Kafeo 6.4.4. It permits DLL hijacking, allowing a user to trigger the execution of arbitrary code every time the product is executed.7.3 High
- No product listedAn issue discovered in Mercury x30g, Mercury YR1800XG routers allows attackers to hijack TCP sessions which could lead to a denial of service.4.3 Medium
- comfast cf-616acAn issue discovered in Comfast Comfast CF-616AC routers allows attackers to hijack TCP sessions which could lead to a denial of service.7.5 High
- sourcecodester laboratory management system, oretnom23 computer laboratory management system +1 moreA cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Remarks…6.1 Medium
- sourcecodester laboratory management system, oretnom23 computer laboratory management system +1 moreA cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Borrowe…6.1 Medium
- dlink di-7003g firmwareAn issue discovered in D-Link DI-7003GV2 routers allows attackers to hijack TCP sessions which could lead to a denial of service.5.7 Medium
- sourcecodester laboratory management system, oretnom23 computer laboratory management system +1 moreA cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Departm…6.1 Medium
- ruijie rg-eg105g firmware, rg-eg105g v2 firmware, rg-eg210g-p firmware +4 more +6 moreAn issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hijack TCP sessions which could lead to a denial of service.6.5 Medium
- No product listedAn issue was discovered in Apiris Kafeo 6.4.4. It permits a bypass, of the protection in place, to access to the data stored in the embedded database file.6.3 Medium
- dedecmsAn arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uploading a crafted file.9.8 Critical
- No product listedAn issue discovered in TP-LINK TL-R473GP-AC, TP-LINK XDR6020, TP-LINK TL-R479GP-AC, TP-LINK TL-R4239G, TP-LINK TL-WAR1200L, and TP-LINK TL-R476G routers allows attackers to hijack TCP sessions which c…5.3 Medium
- liveboxcloud vdeskAn issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous Type can occur under the vShare web site section. A remote user, authenticated to…8.8 High
- vtenextVtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw exists due to the application's failure to enforce proper auth…8.1 High
- linksys e5600 firmwareAn issue discovered in Linksys E5600 routers allows attackers to hijack TCP sessions which could lead to a denial of service.7.5 High
- h3c magicAn issue discovered in H3C Magic R365 and H3C Magic R100 routers allows attackers to hijack TCP sessions which could lead to a denial of service.7.5 High
- No product listedSQL Injection in Finereport v.8.0 allows a remote attacker to obtain sensitive information7.5 High
- minioInformation disclosure in minio5.3 Medium
- campbell scientific csi web server and rtmc, campbellsci csi web server, rtmc +2 moreWeak Encoding for Password vulnerability in Campbell Scientific CSI Web Server and RTMC6.9 Medium
- sagemath cocalcCross-site Scripting with Markdown rendering in CoCalc7.6 High
- campbell scientific csi web server and rtmcPath Traversal in Campbell Scientific CSI Web Server and RTMC5.3 Medium
- ansibleguy webuiCross-site scripting in ansibleguy-webui8.2 High
simplesamlphp/simplesamlphpPackagistSimpleSAMLphp exposes credentials in session storage5.3 Mediumsimplesamlphp/simplesamlphpPackagistSimpleSAMLphp Link Injection vulnerability5.4 Mediumsilverstripe/subsitesPackagistsilverstripe/subsites Unsafe SQL Query Construction (Safe Data Source)8.8 High- check point quantum security gateways, checkpoint check point quantum gateway, spark gateway and cloudguard network, cloudguard network +4 more +6 moreInformation disclosure8.6 High
- aten pe6208 firmwareImproper input validation in the user management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to cause a partial DoS of web interface via HTTP POST re…6.5 Medium
- aten pe6208, pe6208 firmware +1 moreIncorrect access control in firmware upgrade function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to submit a firmware image via HTTP POST requests. This may…6.5 Medium
- aten pe6208 firmwareIncorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter local firewall settings of the device as if…8.0 High
- aten pe6208 firmwareIncorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to control all the outlets as if they were the administrat…5.3 Medium
- aten pe6208 firmwareIncorrect access control in logs management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote attackers to get the device logs via HTTP GET request. The logs contain such info…5.3 Medium
- aten pe6208, pe6208 firmware +1 moreAten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged telnet account. The user is not asked to change the credentials after first login. If not changed, attackers can log in to t…9.8 Critical
- aten pe6208 firmwareAten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account. The user is not asked to change the credentials after first login. If not changed, attackers can log…8.0 High
- aten pe6208 firmwareIncorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to read user and administrator accounts passwords via…7.3 High
- aten pe6208 firmwareIncorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter user and administrator accounts credentials v…7.3 High
- campcodes complete web-based school management systemA SQL injection vulnerability in /model/approve_petty_cash.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter.8.1 High
silverstripe/taxonomyPackagistsilverstripe/taxonomy SQL Injection vulnerability7.5 Highsilverstripe/userformsPackagistsilverstripe/userforms file upload exposure on UserForms module4.3 Medium- anpviz ymf50b firmwareCertain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D…9.9 Critical
- No product listedCertain Anpviz products allow unauthenticated users to download the running configuration of the device via a HTTP GET request to /ConfigFile.ini or /config.xml URIs. This configuration file contains…7.5 High
- No product listedCertain Anpviz products allow unauthenticated users to modify or disable camera related settings such as microphone volume, speaker volume, LED lighting, NTP, motion detection, etc. This affects IPC-D…4.6 Medium
- anpviz ipc-b850 firmware, ipc-d250 firmware, ipc-d260 firmware +14 more +16 moreCertain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IP…9.8 Critical
- amazon aws client vpnAmazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions, a different vulnerability than CVE…7.1 High
- apple macos, codesys linux, microsoft windows +2 moreAmazon AWS Client VPN has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions. This is resolved in 3.11.1 on Windows, 3.9.1 on macOS, a…6.7 Medium
- cdg serverCDG-Server-V5.6.2.126.139 and earlier was discovered to contain a SQL injection vulnerability via the permissionId parameter in CDGTempPermissions.9.8 Critical
- subnet substation serverSUBNET Substation Server Reliance on Insufficiently Trustworthy Component8.6 High
- f-logic datacube3, datacube3 firmware +1 moreF-logic DataCube3 v1.0 is vulnerable to File Upload via /admin/transceiver_schedule.php.9.8 Critical
- f-logic datacube3, datacube3 firmware +1 moreF-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiver_schedule.php file. An unauthenticated remote attacker…6.3 Medium
- totolink cp900l firmwareTOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.5.9 Medium
- totolink cp900 l, cp900l firmware +1 moreTOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setIpPortFilterRules2.7 Low
- Show moreLoading…