# CVEs published 2024-04-08

119 CVEs were published on April 8, 2024: 11 critical, 42 high. Days are UTC.

- [CVE-2024-23584](https://cve.now/CVE-2024-23584.md): HCL BigFix Asset Discovery is affected by a security vulnerability (CVSS 6.6, HCL Software BigFix Enterprise Suite Asset Discovery)
- [CVE-2024-0083](https://cve.now/CVE-2024-0083.md): CVE (CVSS 6.5, nvidia ChatRTX)
- [CVE-2024-0082](https://cve.now/CVE-2024-0082.md): CVE (CVSS 8.2, nvidia ChatRTX)
- [CVE-2024-3466](https://cve.now/CVE-2024-3466.md): SourceCodester Laundry Management System Pengeluaran.php laporan\_filter sql injection (CVSS 5.5, SourceCodester Laundry Management System)
- [CVE-2024-3465](https://cve.now/CVE-2024-3465.md): SourceCodester Laundry Management System Transaki.php laporan\_filter sql injection (CVSS 6.3, SourceCodester Laundry Management System)
- [CVE-2024-3464](https://cve.now/CVE-2024-3464.md): SourceCodester Laundry Management System Pelanggan.php laporan\_filter sql injection (CVSS 6.3, SourceCodester Laundry Management System)
- [CVE-2024-3463](https://cve.now/CVE-2024-3463.md): SourceCodester Laundry Management System edit cross site scripting (CVSS 3.5, SourceCodester Laundry Management System)
- [CVE-2024-3458](https://cve.now/CVE-2024-3458.md): Netentsec NS-ASG Application Security Gateway add\_ikev2.php sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-3457](https://cve.now/CVE-2024-3457.md): Netentsec NS-ASG Application Security Gateway config\_ISCGroupNoCache.php sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2023-7164](https://cve.now/CVE-2023-7164.md): BackWPup \< 4.0.4 - Unauthenticated Backup Download (CVSS 7.5, BackWPup)
- [CVE-2024-3456](https://cve.now/CVE-2024-3456.md): Netentsec NS-ASG Application Security Gateway config\_Anticrack.php sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-31447](https://cve.now/CVE-2024-31447.md): Shopware has Improper Session Handling in store-api (CVSS 5.3, shopware · shopware/core +1)
- [CVE-2024-31442](https://cve.now/CVE-2024-31442.md): Redon-Hub has incorrect permissions on all admin related commands (CVSS 8.8, Redon-Tech Redon-Hub)
- [CVE-2024-3455](https://cve.now/CVE-2024-3455.md): Netentsec NS-ASG Application Security Gateway add\_postlogin.php sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-3445](https://cve.now/CVE-2024-3445.md): SourceCodester Laundry Management System laporan\_filter sql injection (CVSS 6.3, SourceCodester Laundry Management System)
- [CVE-2024-31224](https://cve.now/CVE-2024-31224.md): GPT Academic: Pickle deserializing cookies may pose RCE risk (CVSS 9.8, binary-husky gpt\_academic)
- [CVE-2024-31221](https://cve.now/CVE-2024-31221.md): Clients removed during unpairing process may regain access if Sunshine was not restarted (CVSS 5.9, LizardByte Sunshine)
- [CVE-2024-3444](https://cve.now/CVE-2024-3444.md): Wangshen SecGate 3600 ?g=net\_pro\_keyword\_import\_save unrestricted upload (CVSS 4.7, Wangshen SecGate)
- [CVE-2024-3443](https://cve.now/CVE-2024-3443.md): SourceCodester Prison Management System apply\_leave.php cross site scripting (CVSS 3.5, SourceCodester Prison Management System)
- [CVE-2024-3442](https://cve.now/CVE-2024-3442.md): SourceCodester Prison Management System delete\_leave.php sql injection (CVSS 6.3, SourceCodester Prison Management System)
- [CVE-2024-31205](https://cve.now/CVE-2024-31205.md): Saleor CSRF bypass in refreshToken mutation (CVSS 4.2, saleor)
- [CVE-2024-30269](https://cve.now/CVE-2024-30269.md): DataEase has database configuration information exposure vulnerability (CVSS 5.3, dataease)
- [CVE-2024-3441](https://cve.now/CVE-2024-3441.md): SourceCodester Prison Management System edit-profile.php sql injection (CVSS 6.3, SourceCodester Prison Management System)
- [CVE-2024-3440](https://cve.now/CVE-2024-3440.md): SourceCodester Prison Management System edit\_profile.php sql injection (CVSS 4.7, SourceCodester Prison Management System)
- [CVE-2024-2511](https://cve.now/CVE-2024-2511.md): Unbounded memory growth with session handling in TLSv1.3 (CVSS 5.9, OpenSSL)
- [CVE-2014-125111](https://cve.now/CVE-2014-125111.md): namithjawahar Wp-Insert cross site scripting (CVSS 3.5, namithjawahar Wp-Insert)
- [CVE-2011-10006](https://cve.now/CVE-2011-10006.md): GamerZ WP-PostRatings wp-postratings.php cross site scripting (CVSS 3.5, GamerZ WP-PostRatings)
- [CVE-2024-2834](https://cve.now/CVE-2024-2834.md): OpenText ArcSight Management Center and ArcSight Platform Stored XSS (CVSS 8.7, OpenText ArcSight Management Center · OpenText ArcSight Pla…)
- [CVE-2024-3439](https://cve.now/CVE-2024-3439.md): SourceCodester Prison Management System login.php sql injection (CVSS 7.3, SourceCodester Prison Management System)
- [CVE-2024-3438](https://cve.now/CVE-2024-3438.md): SourceCodester Prison Management System login.php sql injection (CVSS 7.3, SourceCodester Prison Management System)
- [CVE-2024-26811](https://cve.now/CVE-2024-26811.md): ksmbd: validate payload size in ipc response (CVSS 9.8, Linux)
- [CVE-2024-27897](https://cve.now/CVE-2024-27897.md): Input verification vulnerability in the call module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-27896](https://cve.now/CVE-2024-27896.md): Input verification vulnerability in the log module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-27895](https://cve.now/CVE-2024-27895.md): Vulnerability of permission control in the window module. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2023-52364](https://cve.now/CVE-2023-52364.md): Vulnerability of input parameters being not strictly verified in the RSMC module. (CVSS 6.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52386](https://cve.now/CVE-2023-52386.md): Out-of-bounds write vulnerability in the RSMC module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52385](https://cve.now/CVE-2023-52385.md): Out-of-bounds write vulnerability in the RSMC module. (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52554](https://cve.now/CVE-2023-52554.md): Permission control vulnerability in the Bluetooth module. (CVSS 6.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52553](https://cve.now/CVE-2023-52553.md): Race condition vulnerability in the Wi-Fi module. (CVSS 7.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-31375](https://cve.now/CVE-2024-31375.md): WordPress WP2LEADS plugin \<= 3.2.7 - Broken Access Control vulnerability (CVSS 5.4, Saleswonder Team: Tobias WP2LEADS)
- [CVE-2023-52552](https://cve.now/CVE-2023-52552.md): Input verification vulnerability in the power module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52551](https://cve.now/CVE-2023-52551.md): Vulnerability of data verification errors in the kernel module. (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52550](https://cve.now/CVE-2023-52550.md): Vulnerability of data verification errors in the kernel module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52549](https://cve.now/CVE-2023-52549.md): Vulnerability of data verification errors in the kernel module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52546](https://cve.now/CVE-2023-52546.md): Vulnerability of package name verification being bypassed in the Calendar app. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52545](https://cve.now/CVE-2023-52545.md): Vulnerability of undefined permissions in the Calendar app. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52544](https://cve.now/CVE-2023-52544.md): Vulnerability of file path verification being bypassed in the email module. (CVSS 4.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-31357](https://cve.now/CVE-2024-31357.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 1.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BdThemes Ultimate Store Kit Elementor Addons)
- [CVE-2023-52359](https://cve.now/CVE-2023-52359.md): Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52543](https://cve.now/CVE-2023-52543.md): Permission verification vulnerability in the system module. (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52542](https://cve.now/CVE-2023-52542.md): Permission verification vulnerability in the system module. (CVSS 6.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52541](https://cve.now/CVE-2023-52541.md): Authentication vulnerability in the API for app pre-loading. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52540](https://cve.now/CVE-2023-52540.md): Vulnerability of improper authentication in the Iaware module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52539](https://cve.now/CVE-2023-52539.md): Permission verification vulnerability in the Settings module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52538](https://cve.now/CVE-2023-52538.md): Vulnerability of package name verification being bypassed in the HwIms module. (CVSS 9.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52537](https://cve.now/CVE-2023-52537.md): Vulnerability of package name verification being bypassed in the HwIms module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52388](https://cve.now/CVE-2023-52388.md): Permission control vulnerability in the clock module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-23192](https://cve.now/CVE-2024-23192.md): RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised (CVSS 6.1, Open-Xchange OX App Suite)
- [CVE-2024-23191](https://cve.now/CVE-2024-23191.md): Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2024-23190](https://cve.now/CVE-2024-23190.md): Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2024-23189](https://cve.now/CVE-2024-23189.md): Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2024-1958](https://cve.now/CVE-2024-1958.md): WPB Show Core \< 2.7 - Reflected XSS (CVSS 4.8, wpb-show-core)
- [CVE-2024-1956](https://cve.now/CVE-2024-1956.md): WPB Show Core \< 2.7 - Reflected XSS (CVSS 6.1, wpb-show-core)
- [CVE-2024-1752](https://cve.now/CVE-2024-1752.md): Font Farsi \<= 1.6.6 - Admin+ Stored XSS in Settings (CVSS 6.1, Font Farsi)
- [CVE-2024-1589](https://cve.now/CVE-2024-1589.md): SendPress Newsletters \<= 1.23.11.6 - Admin+ Stored XSS via Form Settings (CVSS 6.1, SendPress Newsletters)
- [CVE-2024-1588](https://cve.now/CVE-2024-1588.md): SendPress Newsletters \<= 1.23.11.6 - Admin+ Stored XSS via Settings (CVSS 6.8, SendPress Newsletters)
- [CVE-2024-1292](https://cve.now/CVE-2024-1292.md): WPB Show Core \< 2.6 - Reflected XSS (CVSS 4.7, wpb-show-core)
- [CVE-2023-52536](https://cve.now/CVE-2023-52536.md): In faceid service, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-52535](https://cve.now/CVE-2023-52535.md): In vsp driver, there is a possible missing verification incorrect input. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-52534](https://cve.now/CVE-2023-52534.md): In ngmm, there is a possible undefined behavior due to incorrect error handling. (CVSS 5.9, Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000)
- [CVE-2023-52533](https://cve.now/CVE-2023-52533.md): In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. (CVSS 5.3, Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000)
- [CVE-2024-23658](https://cve.now/CVE-2024-23658.md): In camera driver, there is a possible use after free due to a logic error. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-52352](https://cve.now/CVE-2023-52352.md): In Network Adapter Service, there is a possible missing permission check. (CVSS 6.2, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-52351](https://cve.now/CVE-2023-52351.md): In ril service, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-52350](https://cve.now/CVE-2023-52350.md): In ril service, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-52349](https://cve.now/CVE-2023-52349.md): In ril service, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.6, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-52348](https://cve.now/CVE-2023-52348.md): In ril service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-52347](https://cve.now/CVE-2023-52347.md): In ril service, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-52346](https://cve.now/CVE-2023-52346.md): In modem driver, there is a possible system crash due to improper input validation. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-52345](https://cve.now/CVE-2023-52345.md): In modem driver, there is a possible system crash due to improper input validation. (CVSS 6.0, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-52344](https://cve.now/CVE-2023-52344.md): In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. (CVSS 5.3, Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000)
- [CVE-2023-52343](https://cve.now/CVE-2023-52343.md): In SecurityCommand message after as security has been actived., there is a possible improper input validation. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000)
- [CVE-2023-52342](https://cve.now/CVE-2023-52342.md): In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000)
- [CVE-2023-52341](https://cve.now/CVE-2023-52341.md): In Plaintext COUNTER CHECK message accepted before AS security activation, there is a possible missing permission check. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000)
- [CVE-2024-28744](https://cve.now/CVE-2024-28744.md): The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earli (CVSS 8.8, FURUNO SYSTEMS Co. ACERA 9010-08 · FURUNO SYSTEMS Co. ACERA…)
- [CVE-2024-3437](https://cve.now/CVE-2024-3437.md): SourceCodester Prison Management System Avatar add-admin.php unrestricted upload (CVSS 6.9, SourceCodester Prison Management System)
- [CVE-2022-43216](https://cve.now/CVE-2022-43216.md): AbrhilSoft Employee's Portal before v5.6.2 was discovered to contain a SQL injection vulnerability in the login page. (CVSS 9.1)
- [CVE-2024-22949](https://cve.now/CVE-2024-22949.md): JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /chart/annotations/CategoryLineAnnotation. (CVSS 9.1)
- [CVE-2024-23078](https://cve.now/CVE-2024-23078.md): JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compa (CVSS 9.1)
- [CVE-2024-23079](https://cve.now/CVE-2024-23079.md): JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compa (CVSS 6.2)
- [CVE-2024-23081](https://cve.now/CVE-2024-23081.md): ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocal (no CVSS)
- [CVE-2024-23082](https://cve.now/CVE-2024-23082.md): ThreeTen Backport v1.6.8 was discovered to contain an integer overflow via the component org.threeten.bp.format.DateTimeFormatter::parse(Cha (no CVSS)
- [CVE-2024-23084](https://cve.now/CVE-2024-23084.md): Apfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(double (CVSS 7.5)
- [CVE-2024-23085](https://cve.now/CVE-2024-23085.md): Apfloat v1.10.1 was discovered to contain a NullPointerException via the component org.apfloat.internal.DoubleScramble::scramble(double\[\], i (CVSS 7.5)
- [CVE-2024-23086](https://cve.now/CVE-2024-23086.md): Apfloat v1.10.1 was discovered to contain a stack overflow via the component org.apfloat.internal.DoubleModMath::modPow(double. (CVSS 9.8)
- [CVE-2024-24279](https://cve.now/CVE-2024-24279.md): An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated (CVSS 8.8)
- [CVE-2024-26574](https://cve.now/CVE-2024-26574.md): Insecure Permissions vulnerability in Wondershare Filmora v.13.0.51 allows a local attacker to execute arbitrary code via a crafted script t (CVSS 7.8)
- [CVE-2024-27488](https://cve.now/CVE-2024-27488.md): Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sen (CVSS 9.8)
- [CVE-2024-27630](https://cve.now/CVE-2024-27630.md): Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input (CVSS 7.5)
- [CVE-2024-27631](https://cve.now/CVE-2024-27631.md): Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/userg (CVSS 6.0)
- [CVE-2024-27632](https://cve.now/CVE-2024-27632.md): An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form\_id in the form\_header() function. (CVSS 8.8)
- [CVE-2024-28066](https://cve.now/CVE-2024-28066.md): In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password). (CVSS 8.8)
- [CVE-2024-28224](https://cve.now/CVE-2024-28224.md): Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauth (CVSS 6.6, github.com/ollama/ollama · github.com/jmorganca/ollama)
- [CVE-2024-28270](https://cve.now/CVE-2024-28270.md): An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/res (CVSS 8.1)
- [CVE-2024-28732](https://cve.now/CVE-2024-28732.md): An issue was discovered in OFPMatch in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (CVSS 7.5, ryu)
- [CVE-2024-31022](https://cve.now/CVE-2024-31022.md): An issue was discovered in CandyCMS version 1.0.0, allows remote attackers to execute arbitrary code via the install.php component. (CVSS 9.8)
- [CVE-2024-31047](https://cve.now/CVE-2024-31047.md): An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the conver (CVSS 3.3)
- [CVE-2024-31805](https://cve.now/CVE-2024-31805.md): TOTOLINK EX200 V4.0.3c.7646\_B20201211 allows attackers to start the Telnet service without authorization via the telnet\_enabled parameter in (CVSS 6.5)
- [CVE-2024-31806](https://cve.now/CVE-2024-31806.md): TOTOLINK EX200 V4.0.3c.7646\_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which c (CVSS 6.5)
- [CVE-2024-31807](https://cve.now/CVE-2024-31807.md): TOTOLINK EX200 V4.0.3c.7646\_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in th (CVSS 9.8)
- [CVE-2024-31808](https://cve.now/CVE-2024-31808.md): TOTOLINK EX200 V4.0.3c.7646\_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in (CVSS 8.8)
- [CVE-2024-31809](https://cve.now/CVE-2024-31809.md): TOTOLINK EX200 V4.0.3c.7646\_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in th (CVSS 8.8)
- [CVE-2024-31811](https://cve.now/CVE-2024-31811.md): TOTOLINK EX200 V4.0.3c.7646\_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the langType parameter in th (CVSS 8.0)
- [CVE-2024-31812](https://cve.now/CVE-2024-31812.md): In TOTOLINK EX200 V4.0.3c.7646\_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExt (CVSS 6.5)
- [CVE-2024-31813](https://cve.now/CVE-2024-31813.md): TOTOLINK EX200 V4.0.3c.7646\_B20201211 does not contain an authentication mechanism by default. (CVSS 8.4)
- [CVE-2024-31814](https://cve.now/CVE-2024-31814.md): TOTOLINK EX200 V4.0.3c.7646\_B20201211 allows attackers to bypass login through the Form\_Login function. (CVSS 8.8)
- [CVE-2024-31815](https://cve.now/CVE-2024-31815.md): In TOTOLINK EX200 V4.0.3c.7314\_B20191204, an attacker can obtain the configuration file without authorization through /cgi-bin/ExportSetting (CVSS 9.1)
- [CVE-2024-31816](https://cve.now/CVE-2024-31816.md): In TOTOLINK EX200 V4.0.3c.7646\_B20201211, an attacker can obtain sensitive information without authorization through the function getEasyWiz (CVSS 7.5)
- [CVE-2024-31817](https://cve.now/CVE-2024-31817.md): In TOTOLINK EX200 V4.0.3c.7646\_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStat (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.