CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations5.4 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent6.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible6.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible6.5 Medium
swiftmailer/swiftmailerPackagistSwiftmailer Sendmail transport arbitrary shell executionNo score- hawkiArbitrary File Overwrite6.5 Medium
stormpath/sdkPackagiststormpath/sdk uses Insecure Random Number Generator5.3 Mediumsocalnick/scn-social-authPackagistScnSocialAuth Cross-site Scripting vulnerability in login redirect param6.1 Medium- embedaiData Poisoning in EmbedAI8.3 High
- ibm db2, db2 on cloud pak for data, db2 warehouse +2 moreIBM Db2 on Cloud Pak for Data privilege escalation7.4 High
- realmag777 husky – products filter professional for woocommerce, pluginus husky - products filter professional for woocommerce +1 moreHUSKY – Products Filter Professional for WooCommerce <= 1.3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- interaction design team at the university of applied sciences and arts in hildesheim/germany hawkiSession Fixation7.3 High
- interaction design team at the university of applied sciences and arts in hildesheim/germany hawkiReflected Cross-Site-Scripting (XSS)6.1 Medium
kernel-azureSUSE,kernel-source-azureSUSE,kernel-syms-azureSUSE +2 moreSecurity update for the Linux KernelNo score- manageengine pam360, zohocorp manageengine pam360 +1 moreXSS Vulnerability6.3 Medium
- linux, linux kernel +1 moretcp: do not accept ACK of bytes we never sent9.8 Critical
- checkmkUnrestricted upload and download paths in check_sftp8.8 High
- renehermi wp staging – wordpress backup, restore & migrationWP STAGING WordPress Backup Plugin – Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload9.1 Critical
kernel-livepatch-SLE15-SP5-RT_Update_15SUSE,kernel-rtopenSUSE,kernel-rt_debugopenSUSE +2 more +4 moreSecurity update for the Linux KernelNo score- linux, linux kernel +1 moreppdev: Add an error check in register_device7.8 High
- essential addons for elementor pro, wpdeveloper essential addons for elementor +1 moreEssential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget6.4 Medium
- linux, linux kernel +1 moredrm/arm/malidp: fix a possible null pointer dereference5.5 Medium
- info-d-74 playlist for youtubePlaylist for Youtube <= 1.32 - Editor+ Stored XSS4.8 Medium
- fumiki takahashi gianismGianism <= 5.1.0 - Admin+ Stored XSS4.8 Medium
- geminilabs site reviewsSite Reviews < 7.0.0 - IP Spoofing9.1 Critical
- pjaudiomv fetch jftFetch JFT <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- mysql2mysql2 vulnerable to Prototype Pollution8.2 High
- apppresser, scottopolis apppresser – mobile app framework +1 moreAppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass8.1 High
- unitecms unlimited elements for elementorUnlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import8.8 High
firefoxUbuntufirefox regressionsNo score- magepeopleteam travelly – tour & travel booking manager for woocommerce | tour & hotel booking solutionWordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_save5.3 Medium
- glboy otp login with phone number, otp verificationLogin with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value Check9.8 Critical
- boomdevs swiss toolkit, wp messiah swiss toolkit for wp +1 moreSwiss Toolkit For WP <= 1.0.7 - Authenticated (Contributor+) Authentication Bypass8.8 High
- targit decision suiteThe file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to read or write to server files via a crafted file request. Th…8.1 High
- oretnom23 simple online bidding systemSourceCodester Simple Online Bidding System save_category cross site scripting5.3 Medium
- nautobotNautobot dynamic-group-members doesn't enforce permission restrictions on member objects6.3 Medium
- No product listedAn issue discovered in 360 V6G, 360 T5G, 360 T6M, and 360 P1 routers allows attackers to hijack TCP sessions which could lead to a denial of service.6.5 Medium
- hcl software dryice optibot reset stationHCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs)6.5 Medium
simplesamlphp/simplesamlphpPackagistSimpleSAMLphp Information Disclosure vulnerability5.9 Medium- hcl software dryice optibot reset stationHCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions6.5 Medium
simplesamlphp/simplesamlphpPackagistSimpleSAMLphp Reflected Cross-site Scripting vulnerability6.1 Medium- smarty-php smartyPHP Code Injection by malicious attribute in extends-tag in Smarty7.3 High
- phpgurukul men salon management systemphpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php.4.7 Medium
- No product listedA SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can on…5.4 Medium
- tcpdf project tcpdftcpdf - security update7.5 High
- umbraco umbraco.commerce.issuesStored Cross-site Scripting on Print Functionality in Umbraco Commerce5.4 Medium
- umbraco forms, umbraco.forms.issues +1 moreStored Cross-site Scripting on Components of Umbraco Forms2.7 Low
- Show moreLoading…