# CVEs published 2024-05-07

186 CVEs were published on May 7, 2024: 21 critical, 76 high. Days are UTC.

- [CVE-2023-40490](https://cve.now/CVE-2023-40490.md): Maxon Cinema 4D SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Maxon Cinema)
- [CVE-2023-37325](https://cve.now/CVE-2023-37325.md): D-Link DAP-2622 DDP Set SSID List Missing Authentication Vulnerability (CVSS 5.4, D-Link DAP-2622)
- [CVE-2023-35757](https://cve.now/CVE-2023-35757.md): D-Link DAP-2622 DDP Set Date-Time NTP Server Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, D-Link DAP-2622)
- [CVE-2023-35749](https://cve.now/CVE-2023-35749.md): D-Link DAP-2622 DDP Firmware Upgrade Filename Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, D-Link DAP-2622)
- [CVE-2023-35748](https://cve.now/CVE-2023-35748.md): D-Link DAP-2622 DDP Firmware Upgrade Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, D-Link DAP-2622)
- [CVE-2023-27321](https://cve.now/CVE-2023-27321.md): OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability (CVSS 7.5, OPC Foundation UA .NET Standard · OPCFoundation.NetStandard…)
- [CVE-2022-43656](https://cve.now/CVE-2022-43656.md): Bentley View FBX File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Bentley View)
- [CVE-2022-43655](https://cve.now/CVE-2022-43655.md): Bentley View FBX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Bentley View)
- [CVE-2022-43654](https://cve.now/CVE-2022-43654.md): NETGEAR CAX30S SSO Command Injection Remote Code Execution Vulnerability (CVSS 8.8, NETGEAR CAX30S)
- [CVE-2022-43653](https://cve.now/CVE-2022-43653.md): Bentley View SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Bentley View)
- [CVE-2022-43652](https://cve.now/CVE-2022-43652.md): Bentley View SKP File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Bentley View)
- [CVE-2022-43651](https://cve.now/CVE-2022-43651.md): Bentley View SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Bentley View)
- [CVE-2022-0369](https://cve.now/CVE-2022-0369.md): Triangle MicroWorks SCADA Data Gateway Restore Workspace Directory Traversal Remote Code Execution Vulnerability (CVSS 7.2, Triangle MicroWorks SCADA Data Gateway)
- [CVE-2021-35002](https://cve.now/CVE-2021-35002.md): BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability (CVSS 8.8, BMC Track-It!)
- [CVE-2021-35001](https://cve.now/CVE-2021-35001.md): BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability (CVSS 3.1, BMC Track-It!)
- [CVE-2021-35000](https://cve.now/CVE-2021-35000.md): OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability (CVSS 3.3, OpenBSD Kernel)
- [CVE-2021-34999](https://cve.now/CVE-2021-34999.md): OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability (CVSS 3.8, OpenBSD Kernel)
- [CVE-2021-34983](https://cve.now/CVE-2021-34983.md): NETGEAR Multiple Routers httpd Missing Authentication for Critical Function Information Disclosure Vulnerability (CVSS 6.5, NETGEAR Multiple Routers)
- [CVE-2021-34982](https://cve.now/CVE-2021-34982.md): NETGEAR Multiple Routers httpd Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, NETGEAR Multiple Routers)
- [CVE-2021-34981](https://cve.now/CVE-2021-34981.md): Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability (CVSS 7.5, Linux Kernel)
- [CVE-2021-34976](https://cve.now/CVE-2021-34976.md): Foxit PDF Reader PDF File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34975](https://cve.now/CVE-2021-34975.md): Foxit PDF Reader transitionToState Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34974](https://cve.now/CVE-2021-34974.md): Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34973](https://cve.now/CVE-2021-34973.md): Foxit PDF Reader PDF File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34972](https://cve.now/CVE-2021-34972.md): Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34971](https://cve.now/CVE-2021-34971.md): Foxit PDF Reader JPG2000 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34970](https://cve.now/CVE-2021-34970.md): Foxit PDF Reader print Method Use of Externally-Controlled Format String Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34969](https://cve.now/CVE-2021-34969.md): Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34968](https://cve.now/CVE-2021-34968.md): Foxit PDF Editor transitionToState Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34967](https://cve.now/CVE-2021-34967.md): Foxit PDF Editor Line Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34966](https://cve.now/CVE-2021-34966.md): Foxit PDF Editor FileAttachment Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34965](https://cve.now/CVE-2021-34965.md): Foxit PDF Editor Squiggly Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34964](https://cve.now/CVE-2021-34964.md): Foxit PDF Editor Polygon Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34963](https://cve.now/CVE-2021-34963.md): Foxit PDF Editor PolyLine Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34962](https://cve.now/CVE-2021-34962.md): Foxit PDF Editor Caret Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34961](https://cve.now/CVE-2021-34961.md): Foxit PDF Editor Ink Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34960](https://cve.now/CVE-2021-34960.md): Foxit PDF Editor Circle Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34959](https://cve.now/CVE-2021-34959.md): Foxit PDF Editor Square Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34958](https://cve.now/CVE-2021-34958.md): Foxit PDF Editor Text Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34957](https://cve.now/CVE-2021-34957.md): Foxit PDF Editor Highlight Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34956](https://cve.now/CVE-2021-34956.md): Foxit PDF Editor Underline Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34955](https://cve.now/CVE-2021-34955.md): Foxit PDF Editor Stamp Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34954](https://cve.now/CVE-2021-34954.md): Foxit PDF Editor StrikeOut Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34953](https://cve.now/CVE-2021-34953.md): Foxit PDF Reader Annotation Use of Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34952](https://cve.now/CVE-2021-34952.md): Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34951](https://cve.now/CVE-2021-34951.md): Foxit PDF Reader Annotation Use of Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34950](https://cve.now/CVE-2021-34950.md): Foxit PDF Reader Annotation Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34949](https://cve.now/CVE-2021-34949.md): Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34948](https://cve.now/CVE-2021-34948.md): Foxit PDF Reader Square Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34947](https://cve.now/CVE-2021-34947.md): NETGEAR R7800 net-cgi Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 8.8, NETGEAR R7800)
- [CVE-2024-23551](https://cve.now/CVE-2024-23551.md): HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint (CVSS 6.5, HCL Software BigFix Compliance)
- [CVE-2023-40694](https://cve.now/CVE-2023-40694.md): IBM Watson CP4D Data Stores information disclosure (CVSS 6.2, IBM Watson CP4D Data Stores)
- [CVE-2024-23709](https://cve.now/CVE-2024-23709.md): In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 6.5, Google Android)
- [CVE-2024-23708](https://cve.now/CVE-2024-23708.md): In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has… (CVSS 9.8, Google Android)
- [CVE-2024-23707](https://cve.now/CVE-2024-23707.md): In multiple locations, there is a possible permissions bypass due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2024-23706](https://cve.now/CVE-2024-23706.md): In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. (CVSS 7.4, Google Android)
- [CVE-2024-23705](https://cve.now/CVE-2024-23705.md): In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. (CVSS 9.8, Google Android)
- [CVE-2024-0043](https://cve.now/CVE-2024-0043.md): In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the… (CVSS 7.8, Google Android)
- [CVE-2024-0025](https://cve.now/CVE-2024-0025.md): In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. (CVSS 7.8, Google Android)
- [CVE-2024-0024](https://cve.now/CVE-2024-0024.md): In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due to improper input… (CVSS 7.8, Google Android)
- [CVE-2024-4030](https://cve.now/CVE-2024-4030.md): tempfile.mkdtemp() may be readable and writeable by all users on Windows (CVSS 7.1, Python Software Foundation CPython)
- [CVE-2024-34346](https://cve.now/CVE-2024-34346.md): Deno contains a permission escalation via open of privileged files with missing \`--deny\` flag (CVSS 8.5, denoland deno · deno)
- [CVE-2024-23713](https://cve.now/CVE-2024-23713.md): In migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications settings due to… (CVSS 7.8, Google Android)
- [CVE-2024-23712](https://cve.now/CVE-2024-23712.md): In multiple functions of AppOpsService.java, there is a possible way to saturate the content of /data/system/appops\_accesses.xml due to… (CVSS 5.5, Google Android)
- [CVE-2024-23710](https://cve.now/CVE-2024-23710.md): In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a… (CVSS 7.8, Google Android)
- [CVE-2024-23704](https://cve.now/CVE-2024-23704.md): In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW\_ADD\_WIFI\_CONFIG restriction due to a missing… (CVSS 7.0, Google Android)
- [CVE-2024-0042](https://cve.now/CVE-2024-0042.md): In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. (CVSS 5.6, Google Android)
- [CVE-2024-0027](https://cve.now/CVE-2024-0027.md): In multiple functions of SnoozeHelper.java, there is a possible way to cause a boot loop due to resource exhaustion. (CVSS 5.9, Google Android)
- [CVE-2024-0026](https://cve.now/CVE-2024-0026.md): In multiple functions of SnoozeHelper.java, there is a possible persistent denial of service due to resource exhaustion. (CVSS 4.7, Google Android)
- [CVE-2024-0022](https://cve.now/CVE-2024-0022.md): In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another… (CVSS 5.5, Google Android)
- [CVE-2024-27273](https://cve.now/CVE-2024-27273.md): IBM AIX privilege escalation (CVSS 8.1, IBM AIX)
- [CVE-2024-4559](https://cve.now/CVE-2024-4559.md): Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption… (CVSS 7.5, Google Chrome)
- [CVE-2024-4558](https://cve.now/CVE-2024-4558.md): Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 7.5, Google Chrome)
- [CVE-2024-29209](https://cve.now/CVE-2024-29209.md): A medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an… (CVSS 6.0, KnowBe4 Phish Alert Button (PAB) for Outlook · KnowBe4 S… +1)
- [CVE-2024-29210](https://cve.now/CVE-2024-29210.md): A local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifically within its… (CVSS 2.8, KnowBe4 Phish Alert Button (PAB) for Outlook · KnowBe4 P… +2)
- [CVE-2024-29206](https://cve.now/CVE-2024-29206.md): An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make… (CVSS 2.2, Ubiquiti UniFi Connect EV Station · Ubiquiti UniFi Acces… +3)
- [CVE-2024-27982](https://cve.now/CVE-2024-27982.md): The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead… (CVSS 6.5, NodeJS Node)
- [CVE-2024-29207](https://cve.now/CVE-2024-29207.md): An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. (CVSS 7.5, Ubiquiti UniFi Connect Application · Ubiquiti UniFi Conn… +1)
- [CVE-2024-29208](https://cve.now/CVE-2024-29208.md): An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing… (CVSS 2.2, Ubiquiti Update UniFi Connect EV Station · Ubiquiti Update…)
- [CVE-2024-4596](https://cve.now/CVE-2024-4596.md): Kimai Session information disclosure (CVSS 3.7, Kimai · kimai/kimai)
- [CVE-2024-34341](https://cve.now/CVE-2024-34341.md): The Trix Editor Contains an Arbitrary Code Execution Vulnerability (CVSS 5.4, basecamp trix · trix +1)
- [CVE-2024-32867](https://cve.now/CVE-2024-32867.md): Suricata's defrag contains various issues leading to policy bypass (CVSS 5.3, OISF suricata)
- [CVE-2024-4595](https://cve.now/CVE-2024-4595.md): SEMCMS function.php locate sql injection (CVSS 6.3, SEMCMS)
- [CVE-2024-32664](https://cve.now/CVE-2024-32664.md): Suricata's base64 contains an out of bounds write (CVSS 5.3, OISF suricata)
- [CVE-2024-32663](https://cve.now/CVE-2024-32663.md): Suricata 's http2 parser contains an improper compressed header handling can lead to resource starvation (CVSS 7.5, OISF suricata)
- [CVE-2024-4594](https://cve.now/CVE-2024-4594.md): DedeCMS sys\_safe.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-34342](https://cve.now/CVE-2024-34342.md): react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF (CVSS 7.1, wojtekmaj react-pdf · react-pdf)
- [CVE-2024-34084](https://cve.now/CVE-2024-34084.md): Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests (CVSS 7.5, stacklok minder · github.com/stacklok/minder)
- [CVE-2024-31456](https://cve.now/CVE-2024-31456.md): GLPI contains an authenticated SQL injection (CVSS 7.7, glpi-project glpi)
- [CVE-2024-29889](https://cve.now/CVE-2024-29889.md): GLPI contains an SQL injection through the saved searches (CVSS 7.1, glpi-project glpi)
- [CVE-2024-4593](https://cve.now/CVE-2024-4593.md): DedeCMS sys\_multiserv.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4592](https://cve.now/CVE-2024-4592.md): DedeCMS sys\_group\_edit.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-28148](https://cve.now/CVE-2024-28148.md): Apache Superset: Incorrect datasource authorization on explore REST API (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-4591](https://cve.now/CVE-2024-4591.md): DedeCMS sys\_group\_add.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4590](https://cve.now/CVE-2024-4590.md): DedeCMS sys\_info.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4536](https://cve.now/CVE-2024-4536.md): Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability (CVSS 6.8, Eclipse Foundation EDC · org.eclipse.edc:connector-core)
- [CVE-2023-7240](https://cve.now/CVE-2023-7240.md): Broken Access Control leading to SSRF in NetIQ Identity Console (CVSS 5.8, OpenText NetIQ Identity Console)
- [CVE-2023-31234](https://cve.now/CVE-2023-31234.md): WordPress Tilda Publishing plugin \<= 0.3.23 - Broken Access Control vulnerability (CVSS 6.3, Tilda Publishing)
- [CVE-2024-4589](https://cve.now/CVE-2024-4589.md): DedeCMS mytag\_edit.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4588](https://cve.now/CVE-2024-4588.md): DedeCMS mytag\_add.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4587](https://cve.now/CVE-2024-4587.md): DedeCMS tpl.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4586](https://cve.now/CVE-2024-4586.md): DedeCMS shops\_delivery.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4585](https://cve.now/CVE-2024-4585.md): DedeCMS member\_type.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4538](https://cve.now/CVE-2024-4538.md): IDOR vulnerability in Janto Ticketing Software (CVSS 7.5, Impronta Janto Ticketing Software)
- [CVE-2024-4537](https://cve.now/CVE-2024-4537.md): IDOR vulnerability in Janto Ticketing Software (CVSS 7.5, Impronta Janto Ticketing Software)
- [CVE-2024-4601](https://cve.now/CVE-2024-4601.md): Improper Authentication vulnerability in Socomec Net Vision (CVSS 6.7, Socomec Net vision)
- [CVE-2024-4584](https://cve.now/CVE-2024-4584.md): Faraday GM8181/GM828x command\_port.ini information disclosure (CVSS 5.3, Faraday GM8181 · Faraday GM828x)
- [CVE-2024-4600](https://cve.now/CVE-2024-4600.md): Cross-Site Request Forgery vulnerability in Socomec Net Vision (CVSS 7.1, Socomec Net vision)
- [CVE-2024-4583](https://cve.now/CVE-2024-4583.md): Faraday GM8181/GM828x Request information disclosure (CVSS 5.3, Faraday GM8181 · Faraday GM828x)
- [CVE-2024-4582](https://cve.now/CVE-2024-4582.md): Faraday GM8181/GM828x NTP Service os command injection (CVSS 7.3, Faraday GM8181 · Faraday GM828x)
- [CVE-2024-4599](https://cve.now/CVE-2024-4599.md): Denial of service vulnerability in LAN Messenger (CVSS 7.5, LAN Messenger)
- [CVE-2023-6810](https://cve.now/CVE-2023-6810.md): ClickCease Click Fraud Protection \<= 3.2.4 - Improper Authorization to sensitive information exposure via get\_settings (CVSS 4.3, eranfl ClickCease Click Fraud Protection)
- [CVE-2024-4346](https://cve.now/CVE-2024-4346.md): Startklar Elementor Addons \<= 1.7.13 - Unauthenticated Arbitrary File Deletion (CVSS 9.1, wshberlin Startklar Elementor Addons)
- [CVE-2024-4345](https://cve.now/CVE-2024-4345.md): Startklar Elementor Addons \<= 1.7.13 - Unauthenticated Arbitrary File Upload (CVSS 9.8, wshberlin Startklar Elementor Addons)
- [CVE-2024-3759](https://cve.now/CVE-2024-3759.md): Hmdfs has a use after free vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2024-3758](https://cve.now/CVE-2024-3758.md): Hmdfs has a heap buffer overflow vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2024-3757](https://cve.now/CVE-2024-3757.md): Arkcompiler runtime has an integer overflow vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-31078](https://cve.now/CVE-2024-31078.md): Bluetooth Service has a use after free vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-23808](https://cve.now/CVE-2024-23808.md): Arkcompiler ets frontend has an out-of-bounds read vulnerability (CVSS 5.2, OpenHarmony)
- [CVE-2024-27217](https://cve.now/CVE-2024-27217.md): MSDP has a use after free vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2024-3628](https://cve.now/CVE-2024-3628.md): EasyEvent \<= 1.0.0 - Admin+ Stored XSS (CVSS 3.8, EasyEvent)
- [CVE-2024-4186](https://cve.now/CVE-2024-4186.md): Edwiser Bridge \<= 3.0.5 - Authentication Bypass due to Missing Empty Value Check (CVSS 9.8, wisdmlabs Edwiser Bridge – WordPress Moodle Integration)
- [CVE-2024-22472](https://cve.now/CVE-2024-22472.md): Long S0 frames received by 500 series Z-Wave devices may cause buffer overflow (CVSS 8.1, Silicon Labs Z-Wave SDK)
- [CVE-2024-20855](https://cve.now/CVE-2024-20855.md): Improper access control vulnerability in multitasking framework prior to SMR May-2024 Release 1 allows physical attackers to access… (CVSS 2.4, Samsung Mobile Devices)
- [CVE-2024-20872](https://cve.now/CVE-2024-20872.md): Improper handling of insufficient privileges vulnerability in TalkbackSE prior to version Android 14 allows local attackers to modify… (CVSS 6.2, Samsung Mobile TalkbackSE)
- [CVE-2024-20871](https://cve.now/CVE-2024-20871.md): Improper authorization vulnerability in Samsung Keyboard prior to version One UI 5.1.1 allows physical attackers to partially bypass the… (CVSS 4.9, Samsung Mobile Samsung Keyboard)
- [CVE-2024-20870](https://cve.now/CVE-2024-20870.md): Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.71.8 allows local attackers to… (CVSS 5.1, Samsung Mobile Galaxy Store)
- [CVE-2024-20869](https://cve.now/CVE-2024-20869.md): Improper privilege management vulnerability in Samsung Internet prior to version 25.0.0.41 allows local attackers to bypass protection for… (CVSS 5.5, Samsung Mobile Samsung Internet)
- [CVE-2024-20868](https://cve.now/CVE-2024-20868.md): Improper input validation in Samsung Notes prior to version 4.4.15 allows local attackers to delete files with Samsung Notes privilege… (CVSS 4.4, Samsung Mobile Samsung Notes)
- [CVE-2024-20867](https://cve.now/CVE-2024-20867.md): Improper privilege management vulnerability in Samsung Email prior to version 6.1.91.14 allows local attackers to access sensitive… (CVSS 5.5, Samsung Mobile Samsung Email)
- [CVE-2024-20866](https://cve.now/CVE-2024-20866.md): Authentication bypass vulnerability in Setupwizard prior to SMR May-2024 Release 1 allows physical attackers to skip activation step. (CVSS 5.7, Samsung Mobile Devices)
- [CVE-2024-20865](https://cve.now/CVE-2024-20865.md): Authentication bypass in bootloader prior to SMR May-2024 Release 1 allows physical attackers to flash arbitrary images. (CVSS 6.6, Samsung Mobile Devices)
- [CVE-2024-20864](https://cve.now/CVE-2024-20864.md): Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows local attackers to monitor system… (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2024-20863](https://cve.now/CVE-2024-20863.md): Out of bounds write vulnerability in SNAP in HAL prior to SMR May-2024 Release 1 allows local privileged attackers to execute arbitrary… (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2024-20862](https://cve.now/CVE-2024-20862.md): Out-of-bounds write in SveService prior to SMR May-2024 Release 1 allows local privileged attackers to execute arbitrary code. (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2024-20861](https://cve.now/CVE-2024-20861.md): Use after free vulnerability in SveService prior to SMR May-2024 Release 1 allows local privileged attackers to cause memory corruption. (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2024-20860](https://cve.now/CVE-2024-20860.md): Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20859](https://cve.now/CVE-2024-20859.md): Improper access control vulnerability in FactoryCamera prior to SMR May-2024 Release 1 allows local attackers to take pictures without… (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2024-20858](https://cve.now/CVE-2024-20858.md): Improper access control vulnerability in setCocktailHostCallbacks of CocktailBarService prior to SMR May-2024 Release 1 allows local… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20857](https://cve.now/CVE-2024-20857.md): Improper access control vulnerability in startListening of CocktailBarService prior to SMR May-2024 Release 1 allows local attackers to… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20856](https://cve.now/CVE-2024-20856.md): Improper Authentication vulnerability in Secure Folder prior to SMR May-2024 Release 1 allows physical attackers to access Secure Folder… (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2024-20821](https://cve.now/CVE-2024-20821.md): A vulnerability possible to reconfigure OTP allows local attackers to transit RMA(Return Merchandise Authorization) mode, which disables… (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2023-42757](https://cve.now/CVE-2023-42757.md): Process Explorer before 17.04 allows attackers to make it functionally unavailable (a denial of service for analysis) by renaming an… (CVSS 4.2)
- [CVE-2023-46012](https://cve.now/CVE-2023-46012.md): Buffer Overflow vulnerability LINKSYS EA7500 3.0.1.207964 allows a remote attacker to execute arbitrary code via an HTTP request to the… (CVSS 9.8)
- [CVE-2024-25507](https://cve.now/CVE-2024-25507.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email\_attach\_id parameter at… (CVSS 9.4)
- [CVE-2024-25508](https://cve.now/CVE-2024-25508.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at… (CVSS 9.8)
- [CVE-2024-25509](https://cve.now/CVE-2024-25509.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys\_file\_storage\_id parameter at… (CVSS 9.4)
- [CVE-2024-25510](https://cve.now/CVE-2024-25510.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at… (CVSS 9.8)
- [CVE-2024-25511](https://cve.now/CVE-2024-25511.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at… (CVSS 9.4)
- [CVE-2024-25512](https://cve.now/CVE-2024-25512.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attach\_id parameter at… (CVSS 8.1)
- [CVE-2024-25513](https://cve.now/CVE-2024-25513.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file\_id parameter at… (CVSS 7.8)
- [CVE-2024-25514](https://cve.now/CVE-2024-25514.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template\_id parameter at… (CVSS 9.4)
- [CVE-2024-29149](https://cve.now/CVE-2024-29149.md): An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8\_NOE-R300.1.40.12.4180 and SIP deskphones through… (CVSS 7.4)
- [CVE-2024-29150](https://cve.now/CVE-2024-29150.md): An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8\_NOE-R300.1.40.12.4180 and SIP deskphones through… (CVSS 8.8)
- [CVE-2024-32369](https://cve.now/CVE-2024-32369.md): SQL Injection vulnerability in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive… (CVSS 4.3)
- [CVE-2024-32370](https://cve.now/CVE-2024-32370.md): An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a… (CVSS 9.8)
- [CVE-2024-32371](https://cve.now/CVE-2024-32371.md): An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a regular user account to escalate their privileges and gain… (CVSS 7.5)
- [CVE-2024-33120](https://cve.now/CVE-2024-33120.md): Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function. (CVSS 9.8)
- [CVE-2024-33122](https://cve.now/CVE-2024-33122.md): Roothub v2.6 was discovered to contain a SQL injection vulnerability via the topic parameter in the list() function. (CVSS 6.3)
- [CVE-2024-33124](https://cve.now/CVE-2024-33124.md): Roothub v2.6 was discovered to contain a SQL injection vulnerability via the nodeTitle parameter in the parentNode() function.. (CVSS 9.8)
- [CVE-2024-33139](https://cve.now/CVE-2024-33139.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the findpage function. (CVSS 7.5)
- [CVE-2024-33144](https://cve.now/CVE-2024-33144.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the findApplyedTasksPage function… (CVSS 8.8)
- [CVE-2024-33146](https://cve.now/CVE-2024-33146.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the export function. (CVSS 9.1)
- [CVE-2024-33147](https://cve.now/CVE-2024-33147.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the authRoleList function. (CVSS 8.8)
- [CVE-2024-33148](https://cve.now/CVE-2024-33148.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the list function. (CVSS 7.3)
- [CVE-2024-33149](https://cve.now/CVE-2024-33149.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the myProcessList function. (CVSS 8.1)
- [CVE-2024-33153](https://cve.now/CVE-2024-33153.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the commentList() function. (CVSS 9.8)
- [CVE-2024-33155](https://cve.now/CVE-2024-33155.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the getDeptList() function. (CVSS 9.8)
- [CVE-2024-33161](https://cve.now/CVE-2024-33161.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the unallocatedList() function. (CVSS 5.3)
- [CVE-2024-33164](https://cve.now/CVE-2024-33164.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the authUserList() function. (CVSS 9.8)
- [CVE-2024-33434](https://cve.now/CVE-2024-33434.md): An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows… (CVSS 9.8, github.com/tiagorlampert/CHAOS)
- [CVE-2024-33748](https://cve.now/CVE-2024-33748.md): Cross-site scripting (XSS) vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier. (CVSS 4.1, net.mingsoft:ms-basic)
- [CVE-2024-33780](https://cve.now/CVE-2024-33780.md): MP-SPDZ v0.3.8 was discovered to contain a segmentation violation via the function osuCrypto::copyOut at /Tools/SilentPprf.cpp. (CVSS 6.5)
- [CVE-2024-33781](https://cve.now/CVE-2024-33781.md): MP-SPDZ v0.3.8 was discovered to contain a stack overflow via the function octetStream::get\_bytes in /Tools/octetStream.cpp. (CVSS 7.5)
- [CVE-2024-33782](https://cve.now/CVE-2024-33782.md): MP-SPDZ v0.3.8 was discovered to contain a stack overflow via the function OTExtensionWithMatrix::extend in /OT/OTExtensionWithMatrix.cpp. (CVSS 7.5)
- [CVE-2024-33783](https://cve.now/CVE-2024-33783.md): MP-SPDZ v0.3.8 was discovered to contain a segmentation violation via the function osuCrypto::SilentMultiPprfReceiver::expand in… (CVSS 6.5)
- [CVE-2024-33856](https://cve.now/CVE-2024-33856.md): An issue was discovered in Logpoint before 7.4.0. (CVSS 5.3)
- [CVE-2024-33857](https://cve.now/CVE-2024-33857.md): An issue was discovered in Logpoint before 7.4.0. (CVSS 9.6)
- [CVE-2024-33858](https://cve.now/CVE-2024-33858.md): An issue was discovered in Logpoint before 7.4.0. (CVSS 5.3)
- [CVE-2024-33859](https://cve.now/CVE-2024-33859.md): An issue was discovered in Logpoint before 7.4.0. (CVSS 6.1)
- [CVE-2024-33860](https://cve.now/CVE-2024-33860.md): An issue was discovered in Logpoint before 7.4.0. (CVSS 6.5)
- [CVE-2024-34314](https://cve.now/CVE-2024-34314.md): CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file\_get\_contents function in the fetch\_action… (CVSS 7.5)
- [CVE-2024-34315](https://cve.now/CVE-2024-34315.md): CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file\_get\_contents function in the fckedit\_action… (CVSS 7.5)
- [CVE-2024-34397](https://cve.now/CVE-2024-34397.md): An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. (CVSS 5.2)
- [CVE-2024-34517](https://cve.now/CVE-2024-34517.md): The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin… (CVSS 6.5, Neo4j · org.neo4j:neo4j-cypher)
- [CVE-2024-34523](https://cve.now/CVE-2024-34523.md): AChecker 1.5 allows remote attackers to read the contents of arbitrary files via the download.php path parameter by using Unauthenticated… (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2024-05-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.