CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- wpxpo post grid gutenberg blocks for news, magazines, blog websites – postxPost Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- vinod-dalvi login logout register menuLogin Logout Register Menu <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'llrmloginlogout' Shortcode6.4 Medium
- minmax, minmax digital technology cms +1 moreMinMax CMS - Hidden Functionality9.8 Critical
symfony/symfonyPackagistSymfony may allow a user to switch to using another user's identity6.5 Mediumsymfony/serializerPackagistSymfony XML decoding attack vector through external entities9.8 Criticalsymfony/routingPackagistSymfony XXE security vulnerability7.5 Highsymfony/symfonyPackagist,symfony/http-kernelPackagist +1 moreSymfony allows direct access of ESI URLs behind a trusted proxy7.5 Highsymfony/symfonyPackagist,symfony/http-foundationPackagist +1 moreSymfony has a security issue when parsing the Authorization header5.3 Mediumsymfony/symfonyPackagist,symfony/http-foundationPackagist +1 moreSymfony vulnerable to denial of service via a malicious HTTP Host header7.5 Highsymfony/symfonyPackagist,symfony/http-foundationPackagist +1 moreSymfony2 security issue when the trust proxy mode is enabledNo scoresymfony/symfonyPackagist,symfony/framework-bundlePackagist +1 moreCode injection in the way Symfony implements translation caching in FrameworkBundle7.5 HighjavaparserOSS-FuzzSecurity exception in com.github.javaparser.CommentsInserter.insertCommentsNo scorelibaomOSS-FuzzSegv on unknown address in od_ec_dec_initNo score- airlift aircompressorDecompressors can crash the JVM and leak memory content in Aircompressor8.6 High
- rubygems rubygems.orgDenial of service when publishing a package on rubygems.org4.3 Medium
symfony/dependency-injectionPackagistSymfony XML Entity Expansion security vulnerability7.5 High- cesanta mongooseCesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a cr…7.5 High
- irontec sngrepsngrep-1.8.1-2.1 on GA media7.5 High
symbiote/silverstripe-multivaluefieldPackagistsymbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension6.1 Mediumsylius/admin-bundlePackagistSylius Admin Bundle Cross-Site Request Forgery vulnerability6.5 Mediumsylius/resource-bundlePackagistSylius Resource Bundle Cross-Site Request Forgery vulnerability6.5 Medium- linux, linux kernel +1 moretty: n_gsm: fix possible out-of-bounds in gsm0_receive()7.8 High
- drupal migrate queue importer, migrate queue importer project queue importer +1 moreMigrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-0248.8 High
- fhmq hmqhmq v1.5.5 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception. A remote attacker can trigger a broker crash by sending a specially crafted MQTT UNSUBSCRIBE packet with an illegal…5.3 Medium
- drupal image sizes, image sizes project sizes +1 moreImage Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-0237.5 High
- drupal rest & json api authentication, rest \& json api authentication project \& json api authentication +1 moreDrupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-0229.8 Critical
- f5 nginx, nginx plus, nginx open source +1 more +3 moreNGINX HTTP/3 QUIC vulnerability5.3 Medium
- f5 nginx, nginx plus, nginx open source +1 more +3 moreNGINX HTTP/3 QUIC vulnerability5.3 Medium
- f5 nginx, nginx plus, nginx open source +1 more +3 moreNGINX HTTP/3 QUIC vulnerability6.5 Medium
- f5 nginx, nginx plus, nginx open source +1 more +3 moreNGINX HTTP/3 QUIC vulnerability4.8 Medium
- No product listedYubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access Control.3.3 Low
- mitel micontact center businessA vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to…5.4 Medium
- mitel micontact center businessA vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting (XSS) attack due to insuffi…6.1 Medium
- mercusys mw325r eu v3An issue was discovered on Mercusys MW325R EU V3 MW325R(EU)_V3_1.11.0 221019 devices. A WAN attacker can make the admin interface unreachable/invisible via an unauthenticated HTTP request. Verificatio…5.1 Medium
- ethyca fidesPartial Password Exposure Vulnerability in Fides Webserver Logs2.3 Low
- dell data protection advisor, dp4400 firmware, dp5900 firmware +3 more +5 moreDell Data Protection Advisor, version(s) 19.9, contain(s) an Inadequate Encryption Strength vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, le…7.6 High
- html2xhtml project html2xhtmlA stack-buffer-overflow vulnerability exists in the read_charset_decl function of html2xhtml 1.3. This vulnerability occurs due to improper bounds checking when copying data into a fixed-size stack bu…8.4 High
- progress telerik report server, telerik report server 2024 +1 moreRegistration Authentication Bypass Vulnerability9.8 Critical
- aimeos aimeos-coreAimeos denial of service vulnerability in SaaS and marketplace setups5.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases8.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens5.9 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions6.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions6.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed5.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible4.6 Medium
- Show moreLoading…