# CVEs published 2024-04-01

103 CVEs were published on April 1, 2024: 10 critical, 34 high. Days are UTC.

- [CVE-2024-27334](https://cve.now/CVE-2024-27334.md): Kofax Power PDF JPG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Kofax Power PDF)
- [CVE-2024-27333](https://cve.now/CVE-2024-27333.md): Kofax Power PDF GIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Kofax Power PDF)
- [CVE-2024-3141](https://cve.now/CVE-2024-3141.md): Clavister E10/E80 Misc Settings Page MiscSettings cross site scripting (CVSS 2.4, Clavister E10 · Clavister E80)
- [CVE-2024-3140](https://cve.now/CVE-2024-3140.md): SourceCodester Computer Laboratory Management System cross site scripting (CVSS 3.5, SourceCodester Computer Laboratory Management System)
- [CVE-2024-3139](https://cve.now/CVE-2024-3139.md): SourceCodester Computer Laboratory Management System save\_users improper authorization (CVSS 5.4, SourceCodester Computer Laboratory Management System)
- [CVE-2024-3138](https://cve.now/CVE-2024-3138.md): francoisjacquet RosarioSIS Add Portal Note cross site scripting (CVSS 3.5, francoisjacquet RosarioSIS · francoisjacquet/rosariosis)
- [CVE-2024-27332](https://cve.now/CVE-2024-27332.md): PDF-XChange Editor JPG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2024-27331](https://cve.now/CVE-2024-27331.md): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2024-27330](https://cve.now/CVE-2024-27330.md): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2024-27329](https://cve.now/CVE-2024-27329.md): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2024-27328](https://cve.now/CVE-2024-27328.md): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2024-27327](https://cve.now/CVE-2024-27327.md): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, PDF-XChange Editor)
- [CVE-2024-27326](https://cve.now/CVE-2024-27326.md): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2024-27325](https://cve.now/CVE-2024-27325.md): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2024-27324](https://cve.now/CVE-2024-27324.md): PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2024-27323](https://cve.now/CVE-2024-27323.md): PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability (CVSS 7.5, PDF-XChange Editor)
- [CVE-2024-23119](https://cve.now/CVE-2024-23119.md): Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Centreon · centreon/centreon)
- [CVE-2024-23118](https://cve.now/CVE-2024-23118.md): Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability (CVSS 7.2, Centreon · centreon/centreon)
- [CVE-2024-23117](https://cve.now/CVE-2024-23117.md): Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability (CVSS 7.2, Centreon · centreon/centreon)
- [CVE-2024-23116](https://cve.now/CVE-2024-23116.md): Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability (CVSS 7.2, Centreon · centreon/centreon)
- [CVE-2024-23115](https://cve.now/CVE-2024-23115.md): Centreon updateGroups SQL Injection Remote Code Execution Vulnerability (CVSS 7.2, Centreon · centreon/centreon)
- [CVE-2024-1863](https://cve.now/CVE-2024-1863.md): Sante PACS Server Token Endpoint SQL Injection Remote Code Execution Vulnerability (CVSS 9.8, Sante PACS Server)
- [CVE-2024-1179](https://cve.now/CVE-2024-1179.md): TP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.5, TP-Link Omada ER605)
- [CVE-2024-0637](https://cve.now/CVE-2024-0637.md): Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Centreon · centreon/centreon)
- [CVE-2024-3165](https://cve.now/CVE-2024-3165.md): Database Credential Exposure in the Logs (CVSS 4.5, dotCMS core)
- [CVE-2024-3164](https://cve.now/CVE-2024-3164.md): In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is acce (CVSS 4.5, dotCMS core)
- [CVE-2023-51573](https://cve.now/CVE-2023-51573.md): Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability (CVSS 9.8, Voltronic Power ViewPower Pro)
- [CVE-2023-51572](https://cve.now/CVE-2023-51572.md): Voltronic Power ViewPower Pro getMacAddressByIp Command Injection Remote Code Execution Vulnerability (CVSS 9.8, Voltronic Power ViewPower Pro)
- [CVE-2023-51571](https://cve.now/CVE-2023-51571.md): Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability (CVSS 7.5, Voltronic Power ViewPower Pro)
- [CVE-2023-51570](https://cve.now/CVE-2023-51570.md): Voltronic Power ViewPower Pro Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 9.8, Voltronic Power ViewPower Pro)
- [CVE-2024-3135](https://cve.now/CVE-2024-3135.md): Cross-Site Request Forgery (CSRF) Vulnerability in mudler/localai (CVSS 6.5, mudler/localai · github.com/go-skynet/LocalAI)
- [CVE-2024-28232](https://cve.now/CVE-2024-28232.md): Username Enumeration in CasaOS via bypass of CVE-2024-24766 (CVSS 6.2, IceWhaleTech CasaOS-UserService · github.com/IceWhaleTech/C…)
- [CVE-2024-3131](https://cve.now/CVE-2024-3131.md): SourceCodester Computer Laboratory Management System sql injection (CVSS 6.3, SourceCodester Computer Laboratory Management System)
- [CVE-2024-25574](https://cve.now/CVE-2024-25574.md): Delta Electronics DIAEnergie SQL Injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2024-3129](https://cve.now/CVE-2024-3129.md): SourceCodester Image Accordion Gallery App add-image.php unrestricted upload (CVSS 6.3, SourceCodester Image Accordion Gallery App)
- [CVE-2024-21473](https://cve.now/CVE-2024-21473.md): Improper Input Validation in WIN SON (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2024-21472](https://cve.now/CVE-2024-21472.md): Use After Free in Kernel (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-21470](https://cve.now/CVE-2024-21470.md): Integer Overflow to Buffer Overflow in Graphics Windows (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-21468](https://cve.now/CVE-2024-21468.md): Use After Free in Kernel (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-21463](https://cve.now/CVE-2024-21463.md): Buffer Copy Without Checking Size of Input in Audio (CVSS 7.3, Qualcomm Snapdragon)
- [CVE-2024-21454](https://cve.now/CVE-2024-21454.md): Integer Overflow to Buffer Overflow in Automotive Telematics (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-21453](https://cve.now/CVE-2024-21453.md): Improper Input Validation in Automotive Telematics (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-21452](https://cve.now/CVE-2024-21452.md): Improper Input Validation in Automotive Telematics (CVSS 7.3, Qualcomm Snapdragon)
- [CVE-2023-43515](https://cve.now/CVE-2023-43515.md): Buffer copy without checking size of input (Classic buffer overflow) in HLOS (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2023-33115](https://cve.now/CVE-2023-33115.md): Buffer Over-read in Trusted Execution Environment (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-33111](https://cve.now/CVE-2023-33111.md): Improper Validation of Array Index in Audio (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2023-33101](https://cve.now/CVE-2023-33101.md): Incorrect Type Conversion or Cast in Multi-Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33100](https://cve.now/CVE-2023-33100.md): Improper input validation in Multi-Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33099](https://cve.now/CVE-2023-33099.md): Improper Input Validation in Multi-Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33023](https://cve.now/CVE-2023-33023.md): Buffer Copy without Checking Size of Input (\`Classic Buffer Overflow\`) in SPS-Applications (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-28547](https://cve.now/CVE-2023-28547.md): Buffer Copy Without Checking Size of Input in SPS Applications (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-26655](https://cve.now/CVE-2024-26655.md): Fix memory leak in posix\_clock\_open() (no CVSS, Linux)
- [CVE-2024-3128](https://cve.now/CVE-2024-3128.md): Replify-Messenger Backup File androidmanifest.xml backup (CVSS 2.4, Replify-Messenger)
- [CVE-2024-31099](https://cve.now/CVE-2024-31099.md): WordPress Phlox Core Elements plugin \<= 2.15.7 - Broken Access Control vulnerability (CVSS 6.4, Averta Shortcodes and extra features for Phlox theme)
- [CVE-2024-3125](https://cve.now/CVE-2024-3125.md): Zebra ZTC GK420d Alert Setup Page settings cross site scripting (CVSS 2.4, Zebra ZTC GK420d)
- [CVE-2024-3124](https://cve.now/CVE-2024-3124.md): fridgecow smartalarm Backup File androidmanifest.xml backup (CVSS 2.4, fridgecow smartalarm)
- [CVE-2022-4966](https://cve.now/CVE-2022-4966.md): sequentech admin-console Election Description cross site scripting (CVSS 3.5, sequentech admin-console)
- [CVE-2023-6154](https://cve.now/CVE-2023-6154.md): Local privilege escalation in Bitdefender Total Security (VA-11168) (CVSS 7.8, Bitdefender Total Security · Bitdefender Internet Securi… +2)
- [CVE-2024-3130](https://cve.now/CVE-2024-3130.md): Insecure Data Storage leading to sensitive Information disclosure. (CVSS 5.7, CoolKIt eWeLink APP)
- [CVE-2024-26654](https://cve.now/CVE-2024-26654.md): ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs (CVSS 7.8, Linux)
- [CVE-2024-26653](https://cve.now/CVE-2024-26653.md): usb: misc: ljca: Fix double free in error handling path (no CVSS, Linux)
- [CVE-2016-15038](https://cve.now/CVE-2016-15038.md): NUUO NVRmini 2 deletefile.php path traversal (CVSS 6.5, NUUO NVRmini)
- [CVE-2024-2278](https://cve.now/CVE-2024-2278.md): WooCommerce Product Filter \< 1.4.4 - Admin+ Stored XSS (CVSS 6.1, Themify)
- [CVE-2024-2263](https://cve.now/CVE-2024-2263.md): WooCommerce Product Filter \< 1.4.4 - Reflected XSS (CVSS 4.8, Themify)
- [CVE-2024-2262](https://cve.now/CVE-2024-2262.md): WooCommerce Product Filter \< 1.4.4 - Filter Deletion via CSRF (CVSS 4.7, Themify)
- [CVE-2024-1526](https://cve.now/CVE-2024-1526.md): Hubbub Lite \< 1.33.1 - Unauthenticated Password Protected Posts Access (CVSS 5.3, Hubbub Lite)
- [CVE-2024-20055](https://cve.now/CVE-2024-20055.md): In imgsys, there is a possible information disclosure due to a missing bounds check. (CVSS 6.3, MediaTek MT2713, MT8168, MT8173, MT8175, MT8188, MT8195, MT…)
- [CVE-2024-20054](https://cve.now/CVE-2024-20054.md): In gnss, there is a possible escalation of privilege due to a missing bounds check. (CVSS 6.6, MediaTek MT2735, MT2737, MT6762, MT6765, MT6769, MT6833, MT…)
- [CVE-2024-20053](https://cve.now/CVE-2024-20053.md): In flashc, there is a possible out of bounds write due to an uncaught exception. (CVSS 8.4, MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…)
- [CVE-2024-20052](https://cve.now/CVE-2024-20052.md): In flashc, there is a possible information disclosure due to an uncaught exception. (CVSS 4.4, MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…)
- [CVE-2024-20051](https://cve.now/CVE-2024-20051.md): In flashc, there is a possible system crash due to an uncaught exception. (CVSS 2.3, MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…)
- [CVE-2024-20050](https://cve.now/CVE-2024-20050.md): In flashc, there is a possible information disclosure due to an uncaught exception. (CVSS 4.4, MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…)
- [CVE-2024-20049](https://cve.now/CVE-2024-20049.md): In flashc, there is a possible information disclosure due to an uncaught exception. (CVSS 4.4, MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…)
- [CVE-2024-20048](https://cve.now/CVE-2024-20048.md): In flashc, there is a possible information disclosure due to an uncaught exception. (CVSS 6.2, MediaTek MT2713, MT6781, MT6789, MT6835, MT6855, MT6879, MT…)
- [CVE-2024-20047](https://cve.now/CVE-2024-20047.md): In battery, there is a possible out of bounds read due to an integer overflow. (CVSS 5.4, MediaTek MT6739, MT6768, MT6781, MT6833, MT6853, MT6877, MT…)
- [CVE-2024-20046](https://cve.now/CVE-2024-20046.md): In battery, there is a possible escalation of privilege due to an integer overflow. (CVSS 6.6, MediaTek MT6761, MT6765, MT6768, MT6789, MT6833, MT6855, MT…)
- [CVE-2024-20045](https://cve.now/CVE-2024-20045.md): In audio, there is a possible out of bounds read due to an incorrect calculation of buffer size. (CVSS 2.3, MediaTek MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, M…)
- [CVE-2024-20044](https://cve.now/CVE-2024-20044.md): In da, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.6, MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…)
- [CVE-2024-20043](https://cve.now/CVE-2024-20043.md): In da, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.6, MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…)
- [CVE-2024-20042](https://cve.now/CVE-2024-20042.md): In da, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.6, MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…)
- [CVE-2024-20041](https://cve.now/CVE-2024-20041.md): In da, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT2713, MT6781, MT6789, MT6835, MT6855, MT6879, MT…)
- [CVE-2024-20040](https://cve.now/CVE-2024-20040.md): In wlan firmware, there is a possible out of bounds write due to improper input validation. (CVSS 8.8, MediaTek MT2713, MT6580, MT6761, MT6762, MT6768, MT6781, MT…)
- [CVE-2024-20039](https://cve.now/CVE-2024-20039.md): In modem protocol, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, MediaTek MT2731, MT2735, MT2737, MT3967, MT6297, MT6298, MT…)
- [CVE-2024-28895](https://cve.now/CVE-2024-28895.md): 'Yahoo! JAPAN' App for Android v2.3.1 to v3.161.1 and 'Yahoo! JAPAN' App for iOS v3.2.2 to v4.109.0 contain a cross-site scripting vulnerabi (CVSS 6.1, LY 'Yahoo! JAPAN' App for Android · LY 'Yahoo! JAPAN' App f…)
- [CVE-2023-48906](https://cve.now/CVE-2023-48906.md): Stack Overflow vulnerability in Btstack 1.6 and earlier allows attackers to cause a denial of service via crafted input to the char\_for\_nibb (CVSS 4.3)
- [CVE-2024-25080](https://cve.now/CVE-2024-25080.md): WebMail in Axigen 10.x before 10.3.3.62 allows XSS via the image attachment viewer. (CVSS 4.7)
- [CVE-2024-29433](https://cve.now/CVE-2024-29433.md): A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying cra (CVSS 9.8)
- [CVE-2024-29435](https://cve.now/CVE-2024-29435.md): An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter. (CVSS 4.1)
- [CVE-2024-30858](https://cve.now/CVE-2024-30858.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit\_fire\_wall.php. (CVSS 9.8)
- [CVE-2024-30859](https://cve.now/CVE-2024-30859.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config\_ISCGroupSSLCert.php. (CVSS 8.8)
- [CVE-2024-30860](https://cve.now/CVE-2024-30860.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/export\_excel\_user.php. (CVSS 8.8)
- [CVE-2024-30861](https://cve.now/CVE-2024-30861.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/configguide/ipsec\_guide\_1.php. (CVSS 5.3)
- [CVE-2024-30862](https://cve.now/CVE-2024-30862.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/index.php. (CVSS 8.8)
- [CVE-2024-30863](https://cve.now/CVE-2024-30863.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/history.php. (CVSS 6.3)
- [CVE-2024-30864](https://cve.now/CVE-2024-30864.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config\_ISCGroupTimePolicy.php. (CVSS 6.3)
- [CVE-2024-30865](https://cve.now/CVE-2024-30865.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit\_user\_login.php. (CVSS 9.8)
- [CVE-2024-30866](https://cve.now/CVE-2024-30866.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/menu.php. (CVSS 5.4)
- [CVE-2024-30867](https://cve.now/CVE-2024-30867.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit\_virtual\_site\_info.php. (CVSS 9.8)
- [CVE-2024-30868](https://cve.now/CVE-2024-30868.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/add\_getlogin.php. (CVSS 9.8)
- [CVE-2024-30870](https://cve.now/CVE-2024-30870.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/address\_interpret.php. (CVSS 8.8)
- [CVE-2024-30871](https://cve.now/CVE-2024-30871.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/applyhardware.php. (CVSS 8.8)
- [CVE-2024-30872](https://cve.now/CVE-2024-30872.md): netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /include/authrp.php. (CVSS 5.1)
- [CVE-2024-31033](https://cve.now/CVE-2024-31033.md): JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. (CVSS 6.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.