# CVEs published 2024-04-02

172 CVEs were published on April 2, 2024: 8 critical, 59 high. Days are UTC.

- [CVE-2024-3218](https://cve.now/CVE-2024-3218.md): Shibang Communications IP Network Intercom Broadcasting System busyscreenshotpush.php path traversal (CVSS 5.4, Shibang Communications IP Network Intercom Broadcasting Sys…)
- [CVE-2024-3248](https://cve.now/CVE-2024-3248.md): Stack overflow in Xpdf 4.05 due to object loop in attachments (CVSS 2.9, Xpdf)
- [CVE-2024-3209](https://cve.now/CVE-2024-3209.md): UPX bele.h get\_ne64 heap-based overflow (CVSS 5.5, UPX)
- [CVE-2024-3247](https://cve.now/CVE-2024-3247.md): Stack overflow in Xpdf 4.05 due to object loop in PDF object stream (CVSS 2.9, Xpdf)
- [CVE-2024-3207](https://cve.now/CVE-2024-3207.md): ermig1979 Simd SimdMemoryStream.h ReadUnsigned heap-based overflow (CVSS 5.5, ermig1979 Simd)
- [CVE-2024-3204](https://cve.now/CVE-2024-3204.md): c-blosc2 ndlz4x4.c ndlz4\_decompress heap-based overflow (CVSS 7.3, c-blosc2)
- [CVE-2024-3203](https://cve.now/CVE-2024-3203.md): c-blosc2 ndlz8x8.c ndlz8\_decompress heap-based overflow (CVSS 7.3, c-blosc2)
- [CVE-2024-3202](https://cve.now/CVE-2024-3202.md): codelyfe Stupid Simple CMS Login Page excessive authentication (CVSS 3.7, codelyfe Stupid Simple CMS)
- [CVE-2024-30371](https://cve.now/CVE-2024-30371.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30370](https://cve.now/CVE-2024-30370.md): RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability (CVSS 4.3, RARLAB WinRAR)
- [CVE-2024-30367](https://cve.now/CVE-2024-30367.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30365](https://cve.now/CVE-2024-30365.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30364](https://cve.now/CVE-2024-30364.md): Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2024-30363](https://cve.now/CVE-2024-30363.md): Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2024-30362](https://cve.now/CVE-2024-30362.md): Foxit PDF Reader PDF File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30361](https://cve.now/CVE-2024-30361.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30360](https://cve.now/CVE-2024-30360.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30359](https://cve.now/CVE-2024-30359.md): Foxit PDF Reader AcroForm 3D Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30358](https://cve.now/CVE-2024-30358.md): Foxit PDF Reader AcroForm User-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30357](https://cve.now/CVE-2024-30357.md): Foxit PDF Reader AcroForm Annotation Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30356](https://cve.now/CVE-2024-30356.md): Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2024-30355](https://cve.now/CVE-2024-30355.md): Foxit PDF Reader AcroForm Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30354](https://cve.now/CVE-2024-30354.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30353](https://cve.now/CVE-2024-30353.md): Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30352](https://cve.now/CVE-2024-30352.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30351](https://cve.now/CVE-2024-30351.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30350](https://cve.now/CVE-2024-30350.md): Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2024-30349](https://cve.now/CVE-2024-30349.md): Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30348](https://cve.now/CVE-2024-30348.md): Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30347](https://cve.now/CVE-2024-30347.md): Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2024-30346](https://cve.now/CVE-2024-30346.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30345](https://cve.now/CVE-2024-30345.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30344](https://cve.now/CVE-2024-30344.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30343](https://cve.now/CVE-2024-30343.md): Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30342](https://cve.now/CVE-2024-30342.md): Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30341](https://cve.now/CVE-2024-30341.md): Foxit PDF Reader Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30340](https://cve.now/CVE-2024-30340.md): Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2024-30339](https://cve.now/CVE-2024-30339.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30338](https://cve.now/CVE-2024-30338.md): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30337](https://cve.now/CVE-2024-30337.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30336](https://cve.now/CVE-2024-30336.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-29834](https://cve.now/CVE-2024-29834.md): Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints (CVSS 6.4, Apache Software Foundation Apache Pulsar · org.apache.pulsa…)
- [CVE-2024-30531](https://cve.now/CVE-2024-30531.md): WordPress Nelio Content plugin \<= 3.2.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Nelio Software Nelio Content)
- [CVE-2024-30532](https://cve.now/CVE-2024-30532.md): WordPress Builderall Builder for WordPress plugin \<= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Builderall Team Builderall Builder for WordPress)
- [CVE-2024-24888](https://cve.now/CVE-2024-24888.md): WordPress Gutenberg Blocks by Kadence Blocks plugin \<= 3.2.25 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, StellarWP Gutenberg Blocks by Kadence Blocks)
- [CVE-2024-30335](https://cve.now/CVE-2024-30335.md): Foxit PDF Reader AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2024-31105](https://cve.now/CVE-2024-31105.md): WordPress Tax Rate Upload plugin \<= 2.4.5 - CSRF leading to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Adam Bowen Tax Rate Upload)
- [CVE-2024-31109](https://cve.now/CVE-2024-31109.md): WordPress Woocommerce Social Media Share Buttons plugin \<= 1.3.0 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Toastie Studio Woocommerce Social Media Share Buttons)
- [CVE-2024-3151](https://cve.now/CVE-2024-3151.md): Bdtask Multi-Store Inventory Management System Stock Movement Page cross-site request forgery (CVSS 4.3, Bdtask Multi-Store Inventory Management System)
- [CVE-2024-2435](https://cve.now/CVE-2024-2435.md): Stored XSS in Timeline View (CVSS 4.3, Temporal OSS ui-server · github.com/temporalio/ui-server +1)
- [CVE-2024-22248](https://cve.now/CVE-2024-22248.md): VMware SD-WAN Orchestrator contains an open redirect vulnerability. (CVSS 7.1, VMware SD-WAN Orchestrator)
- [CVE-2024-22247](https://cve.now/CVE-2024-22247.md): VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. (CVSS 4.8, VMware SD-WAN Edge)
- [CVE-2024-22246](https://cve.now/CVE-2024-22246.md): VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. (CVSS 7.4, VMware SD-WAN Edge)
- [CVE-2024-30248](https://cve.now/CVE-2024-30248.md): Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page (CVSS 7.7, piccolo-orm piccolo\_admin · piccolo-admin)
- [CVE-2023-50313](https://cve.now/CVE-2023-50313.md): IBM WebSphere Application Server information disclosure (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2024-2389](https://cve.now/CVE-2024-2389.md): Flowmon Unauthenticated Command Injection Vulnerability (CVSS 10.0, Progress Software Flowmon)
- [CVE-2024-29949](https://cve.now/CVE-2024-29949.md): There is a command injection vulnerability in some Hikvision NVRs. (CVSS 7.2, Hikvision DS-7604NI-K1 / · Hikvision DS-76xxNI-Mx +10)
- [CVE-2024-29948](https://cve.now/CVE-2024-29948.md): There is an out-of-bounds read vulnerability in some Hikvision NVRs. (CVSS 3.8, Hikvision DS-7604NXI-K1/4P)
- [CVE-2024-29947](https://cve.now/CVE-2024-29947.md): There is a NULL dereference pointer vulnerability in some Hikvision NVRs. (CVSS 2.7, Hikvision DS-7604NI-K1 /)
- [CVE-2023-51456](https://cve.now/CVE-2023-51456.md): A Improper Input Validation issue affecting the v2\_sdk\_service running on a set of DJI drone devices on the port 10000 could allow an attack (CVSS 6.8, DJI Mavic 3 Pro · DJI Mavic +2)
- [CVE-2023-51455](https://cve.now/CVE-2023-51455.md): A Improper Validation of Array Index issue affecting the v2\_sdk\_service running on a set of DJI drone devices on the port 10000 could allow (CVSS 6.8, DJI Mavic 3 Pro · DJI Mavic +2)
- [CVE-2023-51454](https://cve.now/CVE-2023-51454.md): A Out-of-bounds Write issue affecting the v2\_sdk\_service running on a set of DJI drone devices on the port 10000 could allow an attacker to (CVSS 6.8, DJI Mavic 3 Pro · DJI Mavic +2)
- [CVE-2023-51453](https://cve.now/CVE-2023-51453.md): A Improper Input Validation issue affecting the v2\_sdk\_service running on a set of DJI drone devices on the port 10000 could allow an attack (CVSS 3.0, DJI Mavic 3 Pro · DJI Mavic +2)
- [CVE-2023-51452](https://cve.now/CVE-2023-51452.md): A Improper Input Validation issue affecting the v2\_sdk\_service running on a set of DJI drone devices on the port 10000 could allow an attack (CVSS 3.0, DJI Mavic 3 Pro · DJI Mavic +2)
- [CVE-2023-6951](https://cve.now/CVE-2023-6951.md): A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive (CVSS 6.6, DJI Mavic 3 Pro · DJI Mavic +2)
- [CVE-2023-6950](https://cve.now/CVE-2023-6950.md): An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a (CVSS 3.0, DJI Mini 3 Pro)
- [CVE-2023-6949](https://cve.now/CVE-2023-6949.md): A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 (CVSS 5.2, DJI Mini 3 Pro)
- [CVE-2023-6948](https://cve.now/CVE-2023-6948.md): A Buffer Copy without Checking Size of Input issue affecting the v2\_sdk\_service running on a set of DJI drone devices on the port 10000 coul (CVSS 3.0, DJI Mavic 3 Pro · DJI Mavic +2)
- [CVE-2024-2745](https://cve.now/CVE-2024-2745.md): Rapid7 InsightVM Sensitive Information Exposure via URL (CVSS 3.3, Rapid7 InsightVM)
- [CVE-2024-1946](https://cve.now/CVE-2024-1946.md): Genesis Blocks \<= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Content (CVSS 6.4, studiopress Genesis Blocks)
- [CVE-2024-1807](https://cve.now/CVE-2024-1807.md): Product Sort and Display for WooCommerce \<= 2.4.1 - Missing Authorization (CVSS 6.5, a3rev Product Sort and Display for WooCommerce)
- [CVE-2024-1732](https://cve.now/CVE-2024-1732.md): Sharkdropship for AliExpress Dropshipping and Affiliate \<= 2.2.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 5.3, djamio1988 Sharkdropship & affiliate for AliExpress)
- [CVE-2024-2931](https://cve.now/CVE-2024-2931.md): WPFront User Role Editor \<= 3.2.1.11184 - Limited Information Exposure (CVSS 4.3, syammohanm WPFront User Role Editor)
- [CVE-2024-20799](https://cve.now/CVE-2024-20799.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-1300](https://cve.now/CVE-2024-1300.md): Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support (CVSS 5.4, io.vertx:vertx-core · Red Hat CEQ +22)
- [CVE-2024-26684](https://cve.now/CVE-2024-26684.md): net: stmmac: xgmac: fix handling of DPP safety error for DMA channels (no CVSS, Linux)
- [CVE-2024-26683](https://cve.now/CVE-2024-26683.md): wifi: cfg80211: detect stuck ECSA element in probe resp (no CVSS, Linux)
- [CVE-2024-26682](https://cve.now/CVE-2024-26682.md): wifi: mac80211: improve CSA/ECSA connection refusal (no CVSS, Linux)
- [CVE-2024-26681](https://cve.now/CVE-2024-26681.md): netdevsim: avoid potential loop in nsim\_dev\_trap\_report\_work() (no CVSS, Linux)
- [CVE-2024-26680](https://cve.now/CVE-2024-26680.md): net: atlantic: Fix DMA mapping for PTP hwts ring (no CVSS, Linux)
- [CVE-2024-26679](https://cve.now/CVE-2024-26679.md): inet: read sk-\>sk\_family once in inet\_recv\_error() (no CVSS, Linux)
- [CVE-2024-26678](https://cve.now/CVE-2024-26678.md): x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section (no CVSS, Linux)
- [CVE-2024-26677](https://cve.now/CVE-2024-26677.md): rxrpc: Fix delayed ACKs to not set the reference serial number (no CVSS, Linux)
- [CVE-2024-26676](https://cve.now/CVE-2024-26676.md): af\_unix: Call kfree\_skb() for dead unix\_(sk)-\>oob\_skb in GC. (CVSS 5.5, Linux)
- [CVE-2024-26675](https://cve.now/CVE-2024-26675.md): ppp\_async: limit MRU to 64K (no CVSS, Linux)
- [CVE-2024-26674](https://cve.now/CVE-2024-26674.md): x86/lib: Revert to \_ASM\_EXTABLE\_UA() for {get,put}\_user() fixups (no CVSS, Linux)
- [CVE-2023-52636](https://cve.now/CVE-2023-52636.md): libceph: just wait for more data to be available on the socket (CVSS 8.2, Linux)
- [CVE-2024-26673](https://cve.now/CVE-2024-26673.md): netfilter: nft\_ct: sanitize layer 3 and 4 protocol number in custom expectations (no CVSS, Linux)
- [CVE-2024-26672](https://cve.now/CVE-2024-26672.md): drm/amdgpu: Fix variable 'mca\_funcs' dereferenced before NULL check in 'amdgpu\_mca\_smu\_get\_mca\_entry()' (CVSS 7.1, Linux)
- [CVE-2024-26671](https://cve.now/CVE-2024-26671.md): blk-mq: fix IO hang from sbitmap wakeup race (no CVSS, Linux)
- [CVE-2023-52635](https://cve.now/CVE-2023-52635.md): PM / devfreq: Synchronize devfreq\_monitor\_\[start/stop\] (no CVSS, Linux)
- [CVE-2023-52634](https://cve.now/CVE-2023-52634.md): drm/amd/display: Fix disable\_otg\_wa logic (no CVSS, Linux)
- [CVE-2023-52633](https://cve.now/CVE-2023-52633.md): um: time-travel: fix time corruption (no CVSS, Linux)
- [CVE-2023-52632](https://cve.now/CVE-2023-52632.md): drm/amdkfd: Fix lock dependency warning with srcu (no CVSS, Linux)
- [CVE-2024-2925](https://cve.now/CVE-2024-2925.md): Beaver Builder – WordPress Page Builder \<= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-2839](https://cve.now/CVE-2024-2839.md): Colibri Page Builder \<= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, extendthemes Colibri Page Builder)
- [CVE-2024-26670](https://cve.now/CVE-2024-26670.md): arm64: entry: fix ARM64\_WORKAROUND\_SPECULATIVE\_UNPRIV\_LOAD (CVSS 5.5, Linux)
- [CVE-2024-26669](https://cve.now/CVE-2024-26669.md): net/sched: flower: Fix chain template offload (no CVSS, Linux)
- [CVE-2024-26668](https://cve.now/CVE-2024-26668.md): netfilter: nft\_limit: reject configurations that cause integer overflow (no CVSS, Linux)
- [CVE-2024-29086](https://cve.now/CVE-2024-29086.md): Arkcompiler runtime has a stack overflow svulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-28951](https://cve.now/CVE-2024-28951.md): Arkcompiler runtime has a use after free vulnerability (CVSS 5.5, OpenHarmony)
- [CVE-2024-28226](https://cve.now/CVE-2024-28226.md): Fs has an improper input validation vulnerability (CVSS 8.1, OpenHarmony)
- [CVE-2024-24581](https://cve.now/CVE-2024-24581.md): Arkcompiler runtime has an out-of-bounds write vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2024-22092](https://cve.now/CVE-2024-22092.md): Bundlemanager has an authentication bypass vulnerability (CVSS 7.7, OpenHarmony)
- [CVE-2024-29074](https://cve.now/CVE-2024-29074.md): Telephony has an improper input validation vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2024-22180](https://cve.now/CVE-2024-22180.md): Camera has a use after free vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-22098](https://cve.now/CVE-2024-22098.md): AVSession has a use after free vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2024-22177](https://cve.now/CVE-2024-22177.md): Audio has an improper preservation of permissions vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-21834](https://cve.now/CVE-2024-21834.md): Arkui has a type confusion vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-26667](https://cve.now/CVE-2024-26667.md): drm/msm/dpu: check for valid hw\_pp in dpu\_encoder\_helper\_phys\_cleanup (no CVSS, Linux)
- [CVE-2024-26666](https://cve.now/CVE-2024-26666.md): wifi: mac80211: fix RCU use in TDLS fast-xmit (CVSS 7.1, Linux)
- [CVE-2024-26665](https://cve.now/CVE-2024-26665.md): tunnels: fix out of bounds access when building IPv6 PMTU error (CVSS 9.1, Linux)
- [CVE-2024-26664](https://cve.now/CVE-2024-26664.md): hwmon: (coretemp) Fix out-of-bounds memory access (CVSS 7.8, Linux)
- [CVE-2024-26663](https://cve.now/CVE-2024-26663.md): tipc: Check the bearer type before calling tipc\_udp\_nl\_bearer\_add() (CVSS 7.8, Linux)
- [CVE-2024-26662](https://cve.now/CVE-2024-26662.md): drm/amd/display: Fix 'panel\_cntl' could be null in 'dcn21\_set\_backlight\_level()' (CVSS 5.5, Linux)
- [CVE-2024-26661](https://cve.now/CVE-2024-26661.md): drm/amd/display: Add NULL test for 'timing generator' in 'dcn21\_set\_pipe()' (CVSS 5.5, Linux)
- [CVE-2024-26660](https://cve.now/CVE-2024-26660.md): drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (CVSS 7.0, Linux)
- [CVE-2024-26659](https://cve.now/CVE-2024-26659.md): xhci: handle isoc Babble and Buffer Overrun events properly (CVSS 7.8, Linux)
- [CVE-2024-26658](https://cve.now/CVE-2024-26658.md): bcachefs: grab s\_umount only if snapshotting (no CVSS, Linux)
- [CVE-2023-52631](https://cve.now/CVE-2023-52631.md): fs/ntfs3: Fix an NULL dereference bug (CVSS 5.5, Linux)
- [CVE-2024-26657](https://cve.now/CVE-2024-26657.md): drm/sched: fix null-ptr-deref in init entity (no CVSS, Linux)
- [CVE-2024-26656](https://cve.now/CVE-2024-26656.md): drm/amdgpu: fix use-after-free bug (CVSS 7.8, Linux)
- [CVE-2024-1504](https://cve.now/CVE-2024-1504.md): SecuPress Free — WordPress Security \<= 2.2.5.1 - Cross-Site Request Forgery to Banned IP Address (CVSS 4.3, SecuPress with Simple SSL – Simple and Performant Security)
- [CVE-2024-2924](https://cve.now/CVE-2024-2924.md): Creative Addons for Elementor \<= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, echoplugins Creative Addons for Elementor)
- [CVE-2024-2791](https://cve.now/CVE-2024-2791.md): Metform Elementor Contact Form Builder \<= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets (CVSS 6.4, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2024-1274](https://cve.now/CVE-2024-1274.md): My Calendar \< 3.4.24 - Authenticated Stored XSS (CVSS 5.4, My Calendar)
- [CVE-2024-2369](https://cve.now/CVE-2024-2369.md): Page Builder Gutenberg Blocks \< 3.1.7 - Contributor+ Stored XSS (CVSS 5.4, Page Builder Gutenberg Blocks)
- [CVE-2024-20854](https://cve.now/CVE-2024-20854.md): Improper handling of insufficient privileges vulnerability in Samsung Camera prior to versions 12.1.0.31 in Android 12, 13.1.02.07 in Androi (CVSS 5.9, Samsung Mobile Samsung Camera)
- [CVE-2024-20853](https://cve.now/CVE-2024-20853.md): Improper verification of intent by broadcast receiver vulnerability in ThemeStore prior to 5.3.05.2 allows local attackers to write arbitrar (CVSS 5.1, Samsung Mobile ThemeStore)
- [CVE-2024-20852](https://cve.now/CVE-2024-20852.md): Improper verification of intent by broadcast receiver vulnerability in SmartThings prior to version 1.8.13.22 allows local attackers to acce (CVSS 5.9, Samsung Mobile SmartThings)
- [CVE-2024-20851](https://cve.now/CVE-2024-20851.md): Improper access control vulnerability in Samsung Data Store prior to version 5.3.00.4 allows local attackers to launch arbitrary activity wi (CVSS 4.4, Samsung Mobile Samsung Data Store)
- [CVE-2024-20850](https://cve.now/CVE-2024-20850.md): Use of Implicit Intent for Sensitive Communication in Samsung Pay prior to version 5.4.99 allows local attackers to access information of Sa (CVSS 6.2, Samsung Mobile Samsung Pay)
- [CVE-2024-20849](https://cve.now/CVE-2024-20849.md): Out-of-bound Write vulnerability in chunk parsing implementation of libsdffextractor prior to SMR Apr-2023 Release 1 allows local attackers (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2024-20848](https://cve.now/CVE-2024-20848.md): Improper Input Validation vulnerability in text parsing implementation of libsdffextractor prior to SMR Apr-2024 Release 1 allows local atta (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2024-20847](https://cve.now/CVE-2024-20847.md): Improper Access Control vulnerability in StorageManagerService prior to SMR Apr-2024 Release 1 allows local attackers to read sdcard informa (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20846](https://cve.now/CVE-2024-20846.md): Out-of-bounds write vulnerability while decoding hcr of libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to execute arbitr (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2024-20845](https://cve.now/CVE-2024-20845.md): Out-of-bounds write vulnerability while releasing memory in libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to execute ar (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2024-20844](https://cve.now/CVE-2024-20844.md): Out-of-bounds write vulnerability while parsing remaining codewords in libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2024-20843](https://cve.now/CVE-2024-20843.md): Out-of-bound write vulnerability in command parsing implementation of libIfaaCa prior to SMR Apr-2024 Release 1 allows local privileged atta (CVSS 5.6, Samsung Mobile Devices)
- [CVE-2024-20842](https://cve.now/CVE-2024-20842.md): Improper Input Validation vulnerability in handling apdu of libsec-ril prior to SMR Apr-2024 Release 1 allows local privileged attackers to (CVSS 4.2, Samsung Mobile Devices)
- [CVE-2024-3160](https://cve.now/CVE-2024-3160.md): Intelbras HDCVI 1016 HTTP GET Request cap.js information disclosure (CVSS 5.3, Intelbras MHDX · Intelbras HDCVI)
- [CVE-2024-3148](https://cve.now/CVE-2024-3148.md): DedeCMS makehtml\_archives\_action.php sql injection (CVSS 6.3, DedeCMS)
- [CVE-2024-3147](https://cve.now/CVE-2024-3147.md): DedeCMS makehtml\_map.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-3146](https://cve.now/CVE-2024-3146.md): DedeCMS makehtml\_rss\_action.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-3145](https://cve.now/CVE-2024-3145.md): DedeCMS makehtml\_js\_action.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-3144](https://cve.now/CVE-2024-3144.md): DedeCMS makehtml\_spec.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-3137](https://cve.now/CVE-2024-3137.md): Improper Privilege Management in uvdesk/community-skeleton (CVSS 7.1, uvdesk/community-skeleton · uvdesk/core-framework)
- [CVE-2024-3143](https://cve.now/CVE-2024-3143.md): DedeCMS member\_rank.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-3142](https://cve.now/CVE-2024-3142.md): Clavister E10/E80 Setting cross-site request forgery (CVSS 4.3, Clavister E10 · Clavister E80)
- [CVE-2024-22780](https://cve.now/CVE-2024-22780.md): Cross Site Scripting vulnerability in CA17 TeamsACS v.1.0.1 allows a remote attacker to execute arbitrary code via a crafted script to the e (CVSS 6.1, github.com/ca17/teamsacs)
- [CVE-2024-25075](https://cve.now/CVE-2024-25075.md): An issue was discovered in Softing uaToolkit Embedded before 1.41.1. (CVSS 5.1)
- [CVE-2024-25187](https://cve.now/CVE-2024-25187.md): Server Side Request Forgery (SSRF) vulnerability in 71cms v1.0.0, allows remote unauthenticated attackers to obtain sensitive information vi (CVSS 8.6)
- [CVE-2024-27602](https://cve.now/CVE-2024-27602.md): Alldata V0.4.6 is vulnerable to Incorrect Access Control. (CVSS 9.1)
- [CVE-2024-27604](https://cve.now/CVE-2024-27604.md): Alldata V0.4.6 is vulnerable to Command execution vulnerability. (CVSS 9.8)
- [CVE-2024-27605](https://cve.now/CVE-2024-27605.md): Alldata V0.4.6 is vulnerable to Insecure Permissions. (CVSS 7.5)
- [CVE-2024-28287](https://cve.now/CVE-2024-28287.md): A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious site (CVSS 7.3)
- [CVE-2024-29276](https://cve.now/CVE-2024-29276.md): An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDes (CVSS 9.8)
- [CVE-2024-29432](https://cve.now/CVE-2024-29432.md): Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas. (CVSS 9.8)
- [CVE-2024-29434](https://cve.now/CVE-2024-29434.md): An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file. (CVSS 8.3)
- [CVE-2024-29514](https://cve.now/CVE-2024-29514.md): File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP fi (CVSS 8.8)
- [CVE-2024-30620](https://cve.now/CVE-2024-30620.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the serviceName parameter in the function fromAdvSetMacMtuWan. (CVSS 9.8)
- [CVE-2024-30621](https://cve.now/CVE-2024-30621.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the serverName parameter in the function fromAdvSetMacMtuWan. (CVSS 6.5)
- [CVE-2024-30806](https://cve.now/CVE-2024-30806.md): An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. (CVSS 6.5)
- [CVE-2024-30807](https://cve.now/CVE-2024-30807.md): An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. (CVSS 7.5)
- [CVE-2024-30808](https://cve.now/CVE-2024-30808.md): An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. (CVSS 2.7)
- [CVE-2024-30809](https://cve.now/CVE-2024-30809.md): An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. (CVSS 7.5)
- [CVE-2024-30946](https://cve.now/CVE-2024-30946.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/co\_do.php. (CVSS 5.5)
- [CVE-2024-30965](https://cve.now/CVE-2024-30965.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member\_scores.php. (CVSS 8.8)
- [CVE-2024-31002](https://cve.now/CVE-2024-31002.md): Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4 BitReader::ReadCach (CVSS 9.8)
- [CVE-2024-31003](https://cve.now/CVE-2024-31003.md): Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4\_MemoryByteStream::W (CVSS 8.8)
- [CVE-2024-31004](https://cve.now/CVE-2024-31004.md): An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4\_StsdAtom::AP4\_StsdAtom,m (CVSS 8.8)
- [CVE-2024-31005](https://cve.now/CVE-2024-31005.md): An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cpp,AP4\_MdhdAtom::AP4\_MdhdAtom,m (CVSS 8.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.