Security Vulnerabilities - CVEs Published In May 2024
Memory corruption when multiple listeners are being registered with the same file descriptor.
CVSS Score
6.7
EPSS Score
0.001
Published
2024-05-06
An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit a special request to upload a malicious file to execute arbitrary code.
CVSS Score
6.3
EPSS Score
0.046
Published
2024-05-06
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field
CVSS Score
9.8
EPSS Score
0.019
Published
2024-05-06
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field.
CVSS Score
9.8
EPSS Score
0.294
Published
2024-05-06
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.
CVSS Score
7.5
EPSS Score
0.011
Published
2024-05-06
DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php.
CVSS Score
9.1
EPSS Score
0.006
Published
2024-05-06
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint.
CVSS Score
8.0
EPSS Score
0.019
Published
2024-05-06
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=updateWebCache.
CVSS Score
5.4
EPSS Score
0.002
Published
2024-05-06
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=clearWebCache.
CVSS Score
8.1
EPSS Score
0.003
Published
2024-05-06
E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters. Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions. No publicly available exploits are known.
CVSS Score
5.3
EPSS Score
0.005
Published
2024-05-06