# CVEs published 2024-04-05

94 CVEs were published on April 5, 2024: 8 critical, 38 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-3357](https://cve.now/CVE-2024-3357.md): SourceCodester Aplaya Beach Resort Online Reservation System index.php cross site scripting (CVSS 3.5, SourceCodester Aplaya Beach Resort Online Reservation System)
- [CVE-2024-3356](https://cve.now/CVE-2024-3356.md): SourceCodester Aplaya Beach Resort Online Reservation System sql injection (CVSS 7.3, SourceCodester Aplaya Beach Resort Online Reservation System)
- [CVE-2024-27912](https://cve.now/CVE-2024-27912.md): A denial of service vulnerability was reported in some Lenovo Printers that could allow an attacker to cause the device to crash by sending (CVSS 7.5, Lenovo Printers)
- [CVE-2024-27911](https://cve.now/CVE-2024-27911.md): A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to obtain the administrator password. (CVSS 7.5, Lenovo Printers)
- [CVE-2024-27910](https://cve.now/CVE-2024-27910.md): A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer without authenticati (CVSS 5.3, Lenovo Printers)
- [CVE-2024-27909](https://cve.now/CVE-2024-27909.md): A denial of service vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in a system reboot. (CVSS 4.9, Lenovo Printers)
- [CVE-2024-27908](https://cve.now/CVE-2024-27908.md): A buffer overflow vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in denial of service. (CVSS 4.9, Lenovo Printers)
- [CVE-2024-23592](https://cve.now/CVE-2024-23592.md): An authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with p (CVSS 6.3, Lenovo Synaptics Fingerprint Readers)
- [CVE-2023-25494](https://cve.now/CVE-2023-25494.md): A potential vulnerability were reported in the BIOS of some Desktop, Smart Edge, and ThinkStation products that could allow a local attacke (CVSS 6.7, Lenovo Desktop BIOS, Smart Edge BIOS, ThinkStation BIOS)
- [CVE-2023-25493](https://cve.now/CVE-2023-25493.md): A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products (CVSS 6.7, Lenovo BIOS)
- [CVE-2023-5912](https://cve.now/CVE-2023-5912.md): A potential memory leakage vulnerability was reported in some Lenovo Notebook products that may allow a local attacker with elevated privil (CVSS 6.7, Lenovo Notebook BIOS)
- [CVE-2023-4605](https://cve.now/CVE-2023-4605.md): A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system (CVSS 6.5, Lenovo XClarity Administrator)
- [CVE-2024-3355](https://cve.now/CVE-2024-3355.md): SourceCodester Aplaya Beach Resort Online Reservation System sql injection (CVSS 7.3, SourceCodester Aplaya Beach Resort Online Reservation System)
- [CVE-2024-29783](https://cve.now/CVE-2024-29783.md): In tmu\_get\_tr\_thresholds, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.7, Google Android)
- [CVE-2024-29782](https://cve.now/CVE-2024-29782.md): In tmu\_get\_tr\_num\_thresholds of tmu.c, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2024-29757](https://cve.now/CVE-2024-29757.md): there is a possible permission bypass due to Debug certs being allowlisted. (CVSS 7.3, Google Android)
- [CVE-2024-29756](https://cve.now/CVE-2024-29756.md): In afe\_callback of q6afe.c, there is a possible out of bounds write due to a buffer overflow. (CVSS 9.8, Google Android)
- [CVE-2024-29755](https://cve.now/CVE-2024-29755.md): In tmu\_get\_pi of tmu.c, there is a possible out of bounds read due to improper input validation. (CVSS 4.4, Google Android)
- [CVE-2024-29754](https://cve.now/CVE-2024-29754.md): In TMU\_IPC\_GET\_TABLE, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.2, Google Android)
- [CVE-2024-29753](https://cve.now/CVE-2024-29753.md): In tmu\_set\_control\_temp\_step of tmu.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.7, Google Android)
- [CVE-2024-29752](https://cve.now/CVE-2024-29752.md): In tmu\_set\_tr\_num\_thresholds of tmu.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2024-29751](https://cve.now/CVE-2024-29751.md): In asn1\_ec\_pkey\_parse\_p384 of asn1\_common.c, there is a possible OOB Read due to a missing null check. (CVSS 5.5, Google Android)
- [CVE-2024-29750](https://cve.now/CVE-2024-29750.md): In km\_exp\_did\_inner of kmv.c, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2024-29749](https://cve.now/CVE-2024-29749.md): In tmu\_set\_tr\_thresholds of tmu.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.4, Google Android)
- [CVE-2024-29748](https://cve.now/CVE-2024-29748.md): there is a possible way to bypass due to a logic error in the code. (CVSS 7.8, KEV, Google Android)
- [CVE-2024-29747](https://cve.now/CVE-2024-29747.md): In \_dvfs\_get\_lv of dvfs.c, there is a possible out of bounds read due to a missing null check. (CVSS 5.9, Google Android)
- [CVE-2024-29746](https://cve.now/CVE-2024-29746.md): In lpm\_req\_handler of lpm.c, there is a possible out of bounds write due to improper input validation. (CVSS 8.4, Google Android)
- [CVE-2024-29745](https://cve.now/CVE-2024-29745.md): there is a possible Information Disclosure due to uninitialized data. (CVSS 5.5, KEV, Google Android)
- [CVE-2024-29744](https://cve.now/CVE-2024-29744.md): In tmu\_get\_gov\_time\_windows, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2024-29743](https://cve.now/CVE-2024-29743.md): In tmu\_set\_temp\_lut of tmu.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.7, Google Android)
- [CVE-2024-29742](https://cve.now/CVE-2024-29742.md): In apply\_minlock\_constraint of dvfs.c, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2024-29741](https://cve.now/CVE-2024-29741.md): In pblS2mpuResume of s2mpu.c, there is a possible mitigation bypass due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2024-29740](https://cve.now/CVE-2024-29740.md): In tmu\_set\_table of tmu.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.4, Google Android)
- [CVE-2024-29739](https://cve.now/CVE-2024-29739.md): In tmu\_get\_temp\_lut of tmu.c, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2024-29738](https://cve.now/CVE-2024-29738.md): In gov\_init, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2024-27232](https://cve.now/CVE-2024-27232.md): In asn1\_ec\_pkey\_parse of asn1\_common.c, there is a possible OOB read due to a missing null check. (CVSS 5.5, Google Android)
- [CVE-2024-27231](https://cve.now/CVE-2024-27231.md): In tmu\_get\_tr\_stats of tmu.c, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.9, Google Android)
- [CVE-2024-3354](https://cve.now/CVE-2024-3354.md): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (CVSS 7.3, SourceCodester Aplaya Beach Resort Online Reservation System)
- [CVE-2024-2312](https://cve.now/CVE-2024-2312.md): GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after (CVSS 6.7, Debian based GNU GRUB)
- [CVE-2024-3353](https://cve.now/CVE-2024-3353.md): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (CVSS 7.3, SourceCodester Aplaya Beach Resort Online Reservation System)
- [CVE-2024-3352](https://cve.now/CVE-2024-3352.md): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (CVSS 7.3, SourceCodester Aplaya Beach Resort Online Reservation System)
- [CVE-2024-0081](https://cve.now/CVE-2024-0081.md): NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr\_webapp where an attacker may cause an allocation of resources withou (CVSS 8.6, NVIDIA NeMo · nemo-asr)
- [CVE-2024-22004](https://cve.now/CVE-2024-22004.md): Unchecked length in Trusted Application on Google Nest Wifi Pro, leading to out of bounds read (CVSS 10.0, Google Nest Wifi Pro)
- [CVE-2024-3351](https://cve.now/CVE-2024-3351.md): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (CVSS 7.3, SourceCodester Aplaya Beach Resort Online Reservation System)
- [CVE-2024-0080](https://cve.now/CVE-2024-0080.md): NVIDIA nvTIFF Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a spec (CVSS 2.8, NVIDIA nvTIFF Library)
- [CVE-2024-0076](https://cve.now/CVE-2024-0076.md): NVIDIA CUDA toolkit for all platforms contains a vulnerability in cuobjdump and nvdisasm where an attacker may cause a crash by tricking a (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2024-0072](https://cve.now/CVE-2024-0072.md): NVIDIA CUDA toolkit for all platforms contains a vulnerability in cuobjdump and nvdisasm where an attacker may cause a crash by tricking a (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2023-31028](https://cve.now/CVE-2023-31028.md): NVIDIA nvJPEG2000 Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a (CVSS 2.8, NVIDIA nvJPEG2000 Library)
- [CVE-2024-31851](https://cve.now/CVE-2024-31851.md): A path traversal vulnerability exists in the Java version of CData Sync \< 23.4.8843 when running using the embedded Jetty server, which coul (CVSS 8.6, CData Sync)
- [CVE-2024-31850](https://cve.now/CVE-2024-31850.md): A path traversal vulnerability exists in the Java version of CData Arc \< 23.4.8839 when running using the embedded Jetty server, which could (CVSS 8.6, CData Arc)
- [CVE-2024-31849](https://cve.now/CVE-2024-31849.md): A path traversal vulnerability exists in the Java version of CData Connect \< 23.4.8846 when running using the embedded Jetty server, which c (CVSS 9.8, CData Connect)
- [CVE-2024-31848](https://cve.now/CVE-2024-31848.md): A path traversal vulnerability exists in the Java version of CData API Server \< 23.4.8844 when running using the embedded Jetty server, whic (CVSS 9.8, CData API Server)
- [CVE-2024-3350](https://cve.now/CVE-2024-3350.md): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (CVSS 7.3, SourceCodester Aplaya Beach Resort Online Reservation System)
- [CVE-2024-3349](https://cve.now/CVE-2024-3349.md): SourceCodester Aplaya Beach Resort Online Reservation System login.php sql injection (CVSS 7.3, SourceCodester Aplaya Beach Resort Online Reservation System)
- [CVE-2024-3348](https://cve.now/CVE-2024-3348.md): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (CVSS 7.3, SourceCodester Aplaya Beach Resort Online Reservation System)
- [CVE-2024-3347](https://cve.now/CVE-2024-3347.md): SourceCodester Airline Ticket Reservation System activate\_jet\_details\_form\_handler.php sql injection (CVSS 7.3, SourceCodester Airline Ticket Reservation System)
- [CVE-2024-3346](https://cve.now/CVE-2024-3346.md): Byzoro Smart S80 webmailattach.php os command injection (CVSS 6.3, Byzoro Smart S80)
- [CVE-2023-48426](https://cve.now/CVE-2023-48426.md): Chromecast Bootloader & Kernel-level code-execution including compromise of user-data (CVSS 10.0, Google Chromecast)
- [CVE-2024-31220](https://cve.now/CVE-2024-31220.md): Sunshine vulnerable to remote unauthenticated arbitrary file read (CVSS 7.3, LizardByte Sunshine)
- [CVE-2024-31218](https://cve.now/CVE-2024-31218.md): Missing Authentication for Critical Function in Webhood backend (CVSS 9.8, webhood-io webhood)
- [CVE-2024-31213](https://cve.now/CVE-2024-31213.md): InstantCMS Open Redirect vulnerability (CVSS 3.5, instantsoft icms2)
- [CVE-2024-2380](https://cve.now/CVE-2024-2380.md): XSS in graph rendering (CVSS 4.6, Checkmk)
- [CVE-2024-2499](https://cve.now/CVE-2024-2499.md): Squelch Tabs and Accordions Shortcodes \<= 0.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via accordions Shortcode (CVSS 6.4, Squelch Tabs and Accordions Shortcodes)
- [CVE-2023-5692](https://cve.now/CVE-2023-5692.md): WordPress Core \<= 6.4.3 - Sensitive Information Exposure via redirect\_guess\_404\_permalink (CVSS 5.3, WordPress Foundation WordPress)
- [CVE-2024-31083](https://cve.now/CVE-2024-31083.md): Xorg-x11-server: use-after-free in procrenderaddglyphs (CVSS 7.8, xorg-x11-server · Red Hat Enterprise Linux 6 Extended Li… +1)
- [CVE-2023-6523](https://cve.now/CVE-2023-6523.md): IDOR in ExtremePacs's Extreme XDS (CVSS 8.8, ExtremePacs Extreme XDS)
- [CVE-2023-6522](https://cve.now/CVE-2023-6522.md): Information Disclosure in ExtremePacs's Extreme XDS (CVSS 7.2, ExtremePacs Extreme XDS)
- [CVE-2024-2447](https://cve.now/CVE-2024-2447.md): Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of c (CVSS 6.5, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-27437](https://cve.now/CVE-2024-27437.md): vfio/pci: Disable auto-enable of exclusive INTx IRQ (no CVSS, Linux)
- [CVE-2024-26814](https://cve.now/CVE-2024-26814.md): vfio/fsl-mc: Block calling interrupt handler without trigger (no CVSS, Linux)
- [CVE-2024-26813](https://cve.now/CVE-2024-26813.md): vfio/platform: Create persistent IRQ handlers (no CVSS, Linux)
- [CVE-2024-26812](https://cve.now/CVE-2024-26812.md): vfio/pci: Create persistent INTx handler (CVSS 7.8, Linux)
- [CVE-2024-26810](https://cve.now/CVE-2024-26810.md): vfio/pci: Lock external INTx masking ops (CVSS 7.8, Linux)
- [CVE-2024-29221](https://cve.now/CVE-2024-29221.md): Invite ID available to team admins even without the "Add Members" permission (CVSS 4.7, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-28949](https://cve.now/CVE-2024-28949.md): DoS via a large number of User Preferences (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-21848](https://cve.now/CVE-2024-21848.md): Users maintain access to active call after being removed from a channel (CVSS 3.1, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-2115](https://cve.now/CVE-2024-2115.md): LearnPress – WordPress LMS Plugin \<= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation (CVSS 8.8, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-3217](https://cve.now/CVE-2024-3217.md): WP Directory Kit \<= 1.3.0 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8, wpdirectorykit WP Directory Kit)
- [CVE-2024-2509](https://cve.now/CVE-2024-2509.md): Gutenberg Blocks by Kadence Blocks \< 3.2.26 - Contributor+ Stored XSS (CVSS 6.5, Gutenberg Blocks by Kadence Blocks)
- [CVE-2023-5973](https://cve.now/CVE-2023-5973.md): Truncated port name (CVSS 4.3, Brocade Fabric OS)
- [CVE-2024-3321](https://cve.now/CVE-2024-3321.md): SourceCodester eLearning System Maintenance Module cross site scripting (CVSS 3.5, SourceCodester eLearning System)
- [CVE-2024-3320](https://cve.now/CVE-2024-3320.md): SourceCodester eLearning System cross site scripting (CVSS 3.5, SourceCodester eLearning System)
- [CVE-2023-49965](https://cve.now/CVE-2023-49965.md): SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page. (CVSS 6.8)
- [CVE-2023-52235](https://cve.now/CVE-2023-52235.md): SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a re (CVSS 8.8)
- [CVE-2024-22363](https://cve.now/CVE-2024-22363.md): SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS). (CVSS 7.5, xlsx)
- [CVE-2024-26329](https://cve.now/CVE-2024-26329.md): Chilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG in ChilkatRand::randomBytes function. (CVSS 6.2)
- [CVE-2024-27448](https://cve.now/CVE-2024-27448.md): MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js (CVSS 9.1, maildev)
- [CVE-2024-28065](https://cve.now/CVE-2024-28065.md): In Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information such as the root password hash. (CVSS 5.9)
- [CVE-2024-29672](https://cve.now/CVE-2024-29672.md): Directory Traversal vulnerability in zly2006 Reden before v.0.2.514 allows a remote attacker to execute arbitrary code via the DEBUG\_RTC\_REQ (CVSS 8.8)
- [CVE-2024-29863](https://cve.now/CVE-2024-29863.md): A race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 SR2 (12,80.20200) may (CVSS 7.8)
- [CVE-2024-30849](https://cve.now/CVE-2024-30849.md): Arbitrary file upload vulnerability in Sourcecodester Complete E-Commerce Site v1.0, allows remote attackers to execute arbitrary code via f (CVSS 9.8)
- [CVE-2024-30891](https://cve.now/CVE-2024-30891.md): A command injection vulnerability exists in /goform/exeCommand in Tenda AC18 v15.03.05.05, which allows attackers to construct cmdinput para (CVSS 8.8)
- [CVE-2024-30977](https://cve.now/CVE-2024-30977.md): An issue in Secnet Security Network Intelligent AC Management System v.1.02.040 allows a local attacker to escalate privileges via the passw (CVSS 7.8)
- [CVE-2024-31852](https://cve.now/CVE-2024-31852.md): LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can some (CVSS 5.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.