The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2024-34366 | Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in AltText.Ai Download Alt Text AI allows Stored XSS.This issue affects Download Alt Text AI: from n/a through 1.3.4. | -- | May 6, 2024 | n/a |
| CVE-2024-34252 | wasm3 v0.5.0 was discovered to contain a global buffer overflow which leads to segmentation fault via the function PreserveRegisterIfOccupied in wasm3/source/m3_compile.c. | -- | May 6, 2024 | n/a |
| CVE-2024-34251 | An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of service via the block_type_get_arity function in core/iwasm/interpreter/wasm.h. | -- | May 6, 2024 | n/a |
| CVE-2024-34250 | A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of service via the wasm_loader_check_br function in core/iwasm/interpreter/wasm_loader.c. | -- | May 6, 2024 | n/a |
| CVE-2024-34249 | wasm3 v0.5.0 was discovered to contain a heap buffer overflow which leads to segmentation fault via the function DeallocateSlot in wasm3/source/m3_compile.c. | -- | May 6, 2024 | n/a |
| CVE-2024-34246 | wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function main in wasm3/platforms/app/main.c. | -- | May 6, 2024 | n/a |
| CVE-2024-34093 | An issue was discovered in Archer Platform 6 before 2024.03. There is an X-Forwarded-For Header Bypass vulnerability. An unauthenticated attacker could potentially bypass intended whitelisting when X-Forwarded-For header is enabled. | -- | May 6, 2024 | n/a |
| CVE-2024-34092 | An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing session. 6.14 P3 (6.14.0.3) is also a fixed release. | -- | May 6, 2024 | n/a |
| CVE-2024-34091 | An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed in the background of the application and renders content inaccessible. 6.14 P3 (6.14.0.3) is also a fixed release. | -- | May 6, 2024 | n/a |
| CVE-2024-34090 | An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. The login banner in the Archer Control Panel (ACP) did not previously escape content appropriately. 6.14 P3 (6.14.0.3) is also a fixed release. | -- | May 6, 2024 | n/a |
| CVE-2024-34089 | An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 P3 (6.14.0.3) is also a fixed release. | -- | May 6, 2024 | n/a |
| CVE-2024-34078 | html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has been fixed in 2.4.2. | -- | May 6, 2024 | n/a |
| CVE-2024-34069 | Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer\'s machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer\'s application that will trigger the debugger. This vulnerability is fixed in 3.0.3. | -- | May 6, 2024 | n/a |
| CVE-2024-34064 | Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4. | -- | May 6, 2024 | n/a |
| CVE-2024-33912 | Missing Authorization vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 1.9.16. | -- | May 6, 2024 | n/a |
| CVE-2024-33910 | Missing Authorization vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7. | -- | May 6, 2024 | n/a |
| CVE-2024-33830 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=clearWebCache. | -- | May 6, 2024 | n/a |
| CVE-2024-33829 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=updateWebCache. | -- | May 6, 2024 | n/a |
| CVE-2024-33788 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint. | -- | May 6, 2024 | n/a |
| CVE-2024-33753 | Section Camera V2.5.5.3116-S50-SMA-B20160811 and earlier versions allow the accounts and passwords of administrators and users to be changed without authorization. | -- | May 6, 2024 | n/a |
| CVE-2024-33752 | An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit a special request to upload a malicious file to execute arbitrary code. | -- | May 6, 2024 | n/a |
| CVE-2024-33749 | DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php. | -- | May 6, 2024 | n/a |
| CVE-2024-33411 | A SQL injection vulnerability in /model/get_admin_profile.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the my_index parameter. | -- | May 6, 2024 | n/a |
| CVE-2024-33410 | SQL injection vulnerability in /model/delete_range_grade.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter. | -- | May 6, 2024 | n/a |
| CVE-2024-33409 | SQL injection vulnerability in index.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the name parameter. | -- | May 6, 2024 | n/a |
| CVE-2024-33408 | A SQL injection vulnerability in /model/get_classroom.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter. | -- | May 6, 2024 | n/a |
| CVE-2024-33407 | SQL injection vulnerability in /model/delete_record.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter. | -- | May 6, 2024 | n/a |
| CVE-2024-33406 | SQL injection vulnerability in /model/delete_student_grade_subject.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the index parameter. | -- | May 6, 2024 | n/a |
| CVE-2024-33405 | SQL injection vulnerability in add_friends.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the friend_index parameter. | -- | May 6, 2024 | n/a |
| CVE-2024-33404 | A SQL injection vulnerability in /model/add_student_first_payment.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the index parameter. | -- | May 6, 2024 | n/a |
| CVE-2024-33403 | A SQL injection vulnerability in /model/get_events.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the event_id parameter. | -- | May 6, 2024 | n/a |
| CVE-2024-33294 | An issue in Library System using PHP/MySQli with Source Code V1.0 allows a remote attacker to execute arbitrary code via the _FAILE variable in the student_edit_photo.php component. | -- | May 6, 2024 | n/a |
| CVE-2024-33113 | D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php. | -- | May 6, 2024 | n/a |
| CVE-2024-33112 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func. | -- | May 6, 2024 | n/a |
| CVE-2024-33111 | D-Link DIR-845L router <=v1.01KRb03 is vulnerable to Cross Site Scripting (XSS) via /htdocs/webinc/js/bsc_sms_inbox.php. | -- | May 6, 2024 | n/a |
| CVE-2024-33110 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Permission Bypass via the getcfg.php component. | -- | May 6, 2024 | n/a |
| CVE-2024-32982 | Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive information or potentially compromise the server. The vulnerability is located in the file path handling mechanism within the static content serving function, specifically at `litestar/static_files/base.py`. This vulnerability is fixed in versions 2.8.3, 2.7.2, and 2.6.4. | -- | May 6, 2024 | n/a |
| CVE-2024-32972 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix has been included in geth version `1.13.15` and onwards. | -- | May 6, 2024 | n/a |
| CVE-2024-32807 | Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\') vulnerability in Brevo for WooCommerce Sendinblue for WooCommerce.This issue affects Sendinblue for WooCommerce: from n/a through 4.0.17. | -- | May 6, 2024 | n/a |
| CVE-2024-26312 | Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. | -- | May 6, 2024 | n/a |
| CVE-2024-23354 | Memory corruption when the IOCTL call is interrupted by a signal. | -- | May 6, 2024 | n/a |
| CVE-2024-23351 | Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions. | -- | May 6, 2024 | n/a |
| CVE-2024-21480 | Memory corruption while playing audio file having large-sized input buffer. | -- | May 6, 2024 | n/a |
| CVE-2024-21477 | Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame. | -- | May 6, 2024 | n/a |
| CVE-2024-21476 | Memory corruption when the channel ID passed by user is not validated and further used. | -- | May 6, 2024 | n/a |
| CVE-2024-21475 | Memory corruption when the payload received from firmware is not as per the expected protocol size. | -- | May 6, 2024 | n/a |
| CVE-2024-21474 | Memory corruption when size of buffer from previous call is used without validation or re-initialization. | -- | May 6, 2024 | n/a |
| CVE-2024-21471 | Memory corruption when IOMMU unmap of a GPU buffer fails in Linux. | -- | May 6, 2024 | n/a |
| CVE-2024-4549 | A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an \'ICS Restart!\' message, CEBC.exe restarts the system. | -- | May 6, 2024 | n/a |
| CVE-2024-4548 | An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a \'RecalculateHDMWYC\' message, which is split into 4 fields using the \'~\' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field. | -- | May 6, 2024 | n/a |
