# CVEs published 2024-04-12

128 CVEs were published on April 12, 2024: 6 critical, 32 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-32028](https://cve.now/CVE-2024-32028.md): Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore (CVSS 4.1, open-telemetry opentelemetry-dotnet · OpenTelemetry.Inst… +1)
- [CVE-2024-31462](https://cve.now/CVE-2024-31462.md): Limited file write in Stable-diffusion-webui - GHSL-2024-010 (CVSS 6.3, AUTOMATIC1111 stable-diffusion-webui)
- [CVE-2024-28869](https://cve.now/CVE-2024-28869.md): Possible denial of service vulnerability with Content-length header in Traefik (CVSS 7.5, traefik · github.com/traefik/traefik +2)
- [CVE-2024-29022](https://cve.now/CVE-2024-29022.md): Session Hijacking via XSS attack in header and session grid in Xibo CMS (CVSS 8.8, xibosignage xibo-cms)
- [CVE-2024-29023](https://cve.now/CVE-2024-29023.md): Session Hijacking via token exposure on the session page in Xibo CMS (CVSS 7.2, xibosignage xibo-cms)
- [CVE-2024-32005](https://cve.now/CVE-2024-32005.md): Local File Inclusion in NiceGUI leaflet component (CVSS 8.2, zauberzeug nicegui · nicegui)
- [CVE-2024-32019](https://cve.now/CVE-2024-32019.md): ndsudo: local privilege escalation via untrusted search path (CVSS 8.8, netdata)
- [CVE-2024-32003](https://cve.now/CVE-2024-32003.md): Dusk plugin may allow unfettered user authentication in misconfigured installs (CVSS 8.8, wintercms wn-dusk-plugin · winter/wn-dusk-plugin)
- [CVE-2024-32000](https://cve.now/CVE-2024-32000.md): Truncated content of messages can be leaked from matrix-appservice-irc (CVSS 4.3, matrix-org matrix-appservice-irc · matrix-appservice-irc)
- [CVE-2024-3698](https://cve.now/CVE-2024-3698.md): Campcodes House Rental Management System manage\_payment.php sql injection (CVSS 6.3, Campcodes House Rental Management System)
- [CVE-2024-0157](https://cve.now/CVE-2024-0157.md): Dell Storage Resource Manager, 4.9.0.0 and below, contain(s) a Session Fixation Vulnerability in SRM Windows Host Agent. (CVSS 5.9, Dell Storage Resource Manager)
- [CVE-2024-22358](https://cve.now/CVE-2024-22358.md): IBM UrbanCode Deploy session fixation (CVSS 6.3, IBM UrbanCode Deploy · IBM DevOps Deploy)
- [CVE-2024-22339](https://cve.now/CVE-2024-22339.md): IBM UrbanCode Deploy information disclosure (CVSS 4.3, IBM UrbanCode Deploy · IBM DevOps Deploy)
- [CVE-2024-22334](https://cve.now/CVE-2024-22334.md): IBM UrbanCode Deploy improper privilege control (CVSS 4.4, IBM UrbanCode Deploy · IBM DevOps Deploy)
- [CVE-2024-3697](https://cve.now/CVE-2024-3697.md): Campcodes House Rental Management System manage\_tenant.php sql injection (CVSS 6.3, Campcodes House Rental Management System)
- [CVE-2024-22359](https://cve.now/CVE-2024-22359.md): IBM UrbanCode Deploy cross-site scripting (CVSS 6.1, IBM UrbanCode Deploy · IBM DevOps Deploy)
- [CVE-2024-3696](https://cve.now/CVE-2024-3696.md): Campcodes House Rental Management System view\_payment.php sql injection (CVSS 6.3, Campcodes House Rental Management System)
- [CVE-2024-3695](https://cve.now/CVE-2024-3695.md): SourceCodester Computer Laboratory Management System Users.php cross site scripting (CVSS 3.5, SourceCodester Computer Laboratory Management System)
- [CVE-2024-3691](https://cve.now/CVE-2024-3691.md): PHPGurukul Small CRM Registration Page sql injection (CVSS 7.3, PHPGurukul Small CRM)
- [CVE-2024-30403](https://cve.now/CVE-2024-30403.md): Junos OS Evolved: When MAC learning happens, and an interface gets flapped, the PFE crashes (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-30402](https://cve.now/CVE-2024-30402.md): Junos OS and Junos OS Evolved: The l2ald crashes on receiving telemetry messages from a specific subscription (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2024-30401](https://cve.now/CVE-2024-30401.md): Junos OS: MX Series and EX9200-15C: Stack-based buffer overflow in aftman (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2024-30398](https://cve.now/CVE-2024-30398.md): Junos OS: SRX4600 Series - A high amount of specific traffic causes packet drops and an eventual PFE crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-30397](https://cve.now/CVE-2024-30397.md): Junos OS: An invalid certificate causes a Denial of Service in the Internet Key Exchange (IKE) process (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-30391](https://cve.now/CVE-2024-30391.md): Junos OS: MX Series with SPC3, and SRX Series: When IPsec authentication is configured with "hmac-sha-384" and "hmac-sha-512" no authentication of traffic is performed (CVSS 4.8, Juniper Networks Junos OS)
- [CVE-2024-30390](https://cve.now/CVE-2024-30390.md): Junos OS Evolved: Connection limits is not being enforced while the resp. rate limit is being enforced (CVSS 5.3, Juniper Networks Junos OS Evolved)
- [CVE-2024-30389](https://cve.now/CVE-2024-30389.md): Junos OS: EX4300 Series: Firewall filter not blocking egress traffic (CVSS 5.8, Juniper Networks Junos OS)
- [CVE-2024-30386](https://cve.now/CVE-2024-30386.md): Junos OS and Junos OS Evolved: In a EVPN-VXLAN scenario state changes on adjacent systems can cause an l2ald process crash (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2024-30384](https://cve.now/CVE-2024-30384.md): Junos OS: EX4300 Series: If a specific CLI command is issued PFE crashes will occur (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2024-30382](https://cve.now/CVE-2024-30382.md): Junos OS and Junos OS Evolved: RPD crash when CoS-based forwarding (CBF) policy is configured (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-28878](https://cve.now/CVE-2024-28878.md): IOSIX IO-1020 Micro ELD Download of Code Without Integrity Check (CVSS 9.6, IOSiX IO-1020 Micro ELD)
- [CVE-2024-30387](https://cve.now/CVE-2024-30387.md): Junos OS: ACX5448 & ACX710: Due to interface flaps the PFE process can crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-31069](https://cve.now/CVE-2024-31069.md): IOSIX IO-1020 Micro ELD Use of Default Credentials (CVSS 7.4, IOSiX IO-1020 Micro ELD)
- [CVE-2024-30210](https://cve.now/CVE-2024-30210.md): IOSIX IO-1020 Micro ELD Use of Default Credentials (CVSS 7.4, IOSiX IO-1020 Micro ELD)
- [CVE-2024-30388](https://cve.now/CVE-2024-30388.md): Junos OS: QFX5000 Series and EX Series: Specific malformed LACP packets will cause flaps (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-30392](https://cve.now/CVE-2024-30392.md): Junos OS: MX Series with SPC3 and MS-MPC/-MIC: When URL filtering is enabled and a specific URL request is received a flowd crash occurs (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-30394](https://cve.now/CVE-2024-30394.md): Junos OS and Junos OS Evolved: A specific EVPN type-5 route causes rpd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-30395](https://cve.now/CVE-2024-30395.md): Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-30405](https://cve.now/CVE-2024-30405.md): Junos OS: SRX 5000 Series with SPC2: Processing of specific crafted packets when ALG is enabled causes a transit traffic Denial of Service (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-30406](https://cve.now/CVE-2024-30406.md): Junos OS Evolved: ACX Series with Paragon Active Assurance Test Agent: A local high privileged attacker can recover other administrators credentials (CVSS 5.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-30407](https://cve.now/CVE-2024-30407.md): \[Child CVE\] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacks (CVSS 8.1, Juniper Networks cRPD · Juniper Networks Juniper Cloud Nati…)
- [CVE-2024-30409](https://cve.now/CVE-2024-30409.md): Junos OS and Junos OS Evolved: Higher CPU consumption on routing engine leads to Denial of Service (DoS). (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2024-30410](https://cve.now/CVE-2024-30410.md): Junos OS: EX4300 Series: Loopback filter not blocking traffic despite having discard term. (CVSS 5.8, Juniper Networks Junos)
- [CVE-2024-31391](https://cve.now/CVE-2024-31391.md): Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentials (CVSS 6.5, Apache Software Foundation Apache Solr Operator · github.co…)
- [CVE-2024-3690](https://cve.now/CVE-2024-3690.md): PHPGurukul Small CRM Change Password sql injection (CVSS 6.3, PHPGurukul Small CRM)
- [CVE-2024-30381](https://cve.now/CVE-2024-30381.md): Paragon Active Assurance: probe\_serviced exposes internal objects to local users (CVSS 8.4, Juniper Networks Paragon Active Assurance)
- [CVE-2024-21618](https://cve.now/CVE-2024-21618.md): Junos OS and Junos OS Evolved: When LLDP is enabled and a malformed LLDP packet is received, l2cpd crashes (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-21615](https://cve.now/CVE-2024-21615.md): Junos OS and Junos OS Evolved: A low-privileged user can access confidential information (CVSS 5.0, Juniper Networks Junos OS)
- [CVE-2024-21610](https://cve.now/CVE-2024-21610.md): Junos OS: If in a scaled CoS scenario information on CoS state is gathered mgd processes get stuck (CVSS 4.3, Juniper Networks Junos OS)
- [CVE-2024-21609](https://cve.now/CVE-2024-21609.md): Junos OS: MX Series with SPC3, and SRX Series: If specific IPsec parameters are negotiated iked will crash due to a memory leak (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-21605](https://cve.now/CVE-2024-21605.md): Junos OS: SRX 300 Series: Specific link local traffic causes a control plane overload (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-21598](https://cve.now/CVE-2024-21598.md): Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-21593](https://cve.now/CVE-2024-21593.md): Junos OS: MX Series with MPC10, MPC11, LC9600, and MX304: A specific MPLS packet will cause a PFE crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-21590](https://cve.now/CVE-2024-21590.md): Junos OS Evolved: Packets which are not destined to the device can reach the RE (CVSS 5.3, Juniper Networks Junos OS Evolved)
- [CVE-2023-51515](https://cve.now/CVE-2023-51515.md): WordPress Uncode Core plugin \<= 2.8.8 - Privilege Escalation vulnerability (CVSS 8.8, Undsgn Uncode Core)
- [CVE-2023-51499](https://cve.now/CVE-2023-51499.md): WordPress WooCommerce Shipping Per Product plugin \<= 2.5.4 - Broken Access Control vulnerability (CVSS 4.3, WooCommerce Shipping Per Product)
- [CVE-2023-52211](https://cve.now/CVE-2023-52211.md): WordPress WP Job Manager plugin \<= 2.0.0 - Broken Access Control vulnerability (CVSS 5.3, Automattic WP Job Manager)
- [CVE-2024-3689](https://cve.now/CVE-2024-3689.md): Zhejiang Land Zongheng Network Technology O2OA information disclosure (CVSS 3.7, Zhejiang Land Zongheng Network Technology O2OA)
- [CVE-2024-3688](https://cve.now/CVE-2024-3688.md): Xiamen Four-Faith RMP Router Management Platform sql injection (CVSS 6.3, Xiamen Four-Faith RMP Router Management Platform)
- [CVE-2024-3687](https://cve.now/CVE-2024-3687.md): bihell Dice Comment cross site scripting (CVSS 3.5, bihell Dice)
- [CVE-2024-3707](https://cve.now/CVE-2024-3707.md): Exposure of Information Through Directory Listing vulnerability in OpenGnsys (CVSS 5.3, OpenGnsys)
- [CVE-2024-3706](https://cve.now/CVE-2024-3706.md): Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenGnsys (CVSS 5.9, OpenGnsys)
- [CVE-2024-3705](https://cve.now/CVE-2024-3705.md): Unrestricted Upload of File with Dangerous Type vulnerability in OpenGnsys (CVSS 8.8, OpenGnsys)
- [CVE-2024-3704](https://cve.now/CVE-2024-3704.md): SQL Injection vulnerability in OpenGnsys (CVSS 9.8, OpenGnsys)
- [CVE-2024-3686](https://cve.now/CVE-2024-3686.md): DedeCMS update\_guide.php path traversal (CVSS 4.3, DedeCMS)
- [CVE-2024-2397](https://cve.now/CVE-2024-2397.md): infinite loop in the PPP printer of tcpdump (CVSS 6.2, The Tcpdump Group tcpdump)
- [CVE-2023-51409](https://cve.now/CVE-2023-51409.md): WordPress AI Engine plugin \<= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 10.0, Jordy Meow AI Engine: ChatGPT Chatbot)
- [CVE-2022-40211](https://cve.now/CVE-2022-40211.md): WordPress GiveWP plugin \<= 2.25.1 - Cross Site Scripting (XSS) via render\_dropdown vulnerability (CVSS 5.9, GiveWP)
- [CVE-2024-31235](https://cve.now/CVE-2024-31235.md): WordPress Comments Import & Export plugin \<= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WebToffee WordPress Comments Import & Export)
- [CVE-2024-31238](https://cve.now/CVE-2024-31238.md): WordPress Smart Online Order for Clover plugin \<= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Zaytech Smart Online Order for Clover)
- [CVE-2024-3685](https://cve.now/CVE-2024-3685.md): DedeCMS stepselect\_main.php sql injection (CVSS 6.3, DedeCMS)
- [CVE-2024-31239](https://cve.now/CVE-2024-31239.md): WordPress Nudgify Social Proof, Sales Popup & FOMO plugin \<= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Nudgify Social Proof, Sales Popup & FOMO)
- [CVE-2024-31250](https://cve.now/CVE-2024-31250.md): WordPress WP Server Health Stats plugin \<= 1.7.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Saumya Majumder WP Server Health Stats)
- [CVE-2024-31251](https://cve.now/CVE-2024-31251.md): WordPress Community by PeepSo plugin \<= 6.3.1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Community by PeepSo)
- [CVE-2024-31262](https://cve.now/CVE-2024-31262.md): WordPress WooCommerce Checkout Field Editor (Checkout Manager) plugin \<= 2.1.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Jcodex WooCommerce Checkout Field Editor)
- [CVE-2024-31263](https://cve.now/CVE-2024-31263.md): WordPress Loan Repayment Calculator and Application Form plugin \<= 2.9.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, aerin Loan Repayment Calculator and Application Form)
- [CVE-2024-31264](https://cve.now/CVE-2024-31264.md): WordPress Post Views Counter plugin \<= 1.4.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, dFactory Post Views Counter)
- [CVE-2024-31265](https://cve.now/CVE-2024-31265.md): WordPress Sumo plugin \<= 1.34 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 3.7, SumoMe Sumo)
- [CVE-2024-31268](https://cve.now/CVE-2024-31268.md): WordPress AppPresser plugin \<= 4.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, AppPresser Team AppPresser)
- [CVE-2024-31269](https://cve.now/CVE-2024-31269.md): WordPress Easy Google Maps plugin \<= 1.11.11 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Supsystic Easy Google Maps)
- [CVE-2024-31271](https://cve.now/CVE-2024-31271.md): WordPress Ultimate Maps plugin \<= 1.2.16 - Cross Site Request Forgery vulnerability (CVSS 4.3, Ultimate Maps by Supsystic)
- [CVE-2024-31272](https://cve.now/CVE-2024-31272.md): WordPress ARForms Form Builder plugin \<= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.3, Repute InfoSystems ARForms Form Builder)
- [CVE-2024-31279](https://cve.now/CVE-2024-31279.md): WordPress Generate Child Theme plugin \<= 2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Catch Plugins Generate Child Theme)
- [CVE-2024-31289](https://cve.now/CVE-2024-31289.md): WordPress Hello Elementor theme \<= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Hello Elementor)
- [CVE-2024-31293](https://cve.now/CVE-2024-31293.md): WordPress Easy Digital Downloads plugin \<= 3.2.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Easy Digital Downloads)
- [CVE-2024-31301](https://cve.now/CVE-2024-31301.md): WordPress Multiple Page Generator Plugin – MPG plugin \<= 3.4.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Themeisle Multiple Page Generator Plugin – MPG)
- [CVE-2024-31303](https://cve.now/CVE-2024-31303.md): WordPress Sign-up Sheets plugin \<= 2.2.11.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Fetch Designs Sign-up Sheets)
- [CVE-2024-31305](https://cve.now/CVE-2024-31305.md): WordPress Transcoder plugin \<= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, rtCamp Transcoder)
- [CVE-2024-31354](https://cve.now/CVE-2024-31354.md): WordPress Slideshow Gallery LITE plugin \<= 1.7.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tribulant Slideshow Gallery)
- [CVE-2024-31360](https://cve.now/CVE-2024-31360.md): WordPress Benchmark Email Lite plugin \<= 4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Coded Commerce Benchmark Email Lite)
- [CVE-2024-31362](https://cve.now/CVE-2024-31362.md): WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin \<= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Metagauss ProfileGrid)
- [CVE-2024-31363](https://cve.now/CVE-2024-31363.md): WordPress LifterLMS plugin \<= 7.5.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, LifterLMS)
- [CVE-2024-31364](https://cve.now/CVE-2024-31364.md): WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin \<= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts)
- [CVE-2023-47714](https://cve.now/CVE-2023-47714.md): IBM Sterling File Gateway cross-site scripting (CVSS 4.8, IBM Sterling File Gateway)
- [CVE-2024-27261](https://cve.now/CVE-2024-27261.md): IBM Storage Defender - Resiliency Service privilege escalation (CVSS 6.4, IBM Storage Defender)
- [CVE-2024-3054](https://cve.now/CVE-2024-3054.md): WPvivid Backup & Migration Plugin \<= 0.9.99 - Authenticated (Admin+) PHAR Deserialization (CVSS 7.2, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2024-3211](https://cve.now/CVE-2024-3211.md): Shopping Cart & eCommerce Store \<= 5.6.3 - Authenticated (Contributor+) SQL Injection (CVSS 8.8, levelfourstorefront Shopping Cart & eCommerce Store)
- [CVE-2024-31371](https://cve.now/CVE-2024-31371.md): WordPress WP Event Aggregator plugin \<= 1.7.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Xylus Themes WP Event Aggregator)
- [CVE-2024-31372](https://cve.now/CVE-2024-31372.md): WordPress No-Bot Registration plugin \<= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Arnan de Gans No-Bot Registration)
- [CVE-2024-3400](https://cve.now/CVE-2024-3400.md): PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect (CVSS 10.0, KEV, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2024-27309](https://cve.now/CVE-2024-27309.md): Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode (CVSS 7.4, Apache Software Foundation Apache Kafka · org.apache.kafka:…)
- [CVE-2023-45186](https://cve.now/CVE-2023-45186.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 4.8, IBM Sterling B2B Integrator)
- [CVE-2024-2801](https://cve.now/CVE-2024-2801.md): Shopkeeper Extender \<= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, getbowtied Shopkeeper Extender)
- [CVE-2024-2137](https://cve.now/CVE-2024-2137.md): All-in-One Addons for Elementor – WidgetKit \<= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Widgets (CVSS 6.4, shamsbd71 All-in-One Addons for Elementor – WidgetKit)
- [CVE-2023-50307](https://cve.now/CVE-2023-50307.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2024-22357](https://cve.now/CVE-2024-22357.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2023-6489](https://cve.now/CVE-2023-6489.md): Inefficient Regular Expression Complexity in GitLab (CVSS 4.3, GitLab)
- [CVE-2023-6678](https://cve.now/CVE-2023-6678.md): Inefficient Regular Expression Complexity in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-2279](https://cve.now/CVE-2024-2279.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2024-3092](https://cve.now/CVE-2024-3092.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2020-8006](https://cve.now/CVE-2020-8006.md): The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time (CVSS 8.8)
- [CVE-2023-44852](https://cve.now/CVE-2023-44852.md): Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafte (CVSS 8.2)
- [CVE-2023-44853](https://cve.now/CVE-2023-44853.md): \\An issue was discovered in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the (CVSS 4.8)
- [CVE-2023-44854](https://cve.now/CVE-2023-44854.md): Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafte (CVSS 6.1)
- [CVE-2023-44855](https://cve.now/CVE-2023-44855.md): Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019 allows a remote attacker to execute arbitrary code via a crafted (CVSS 6.5)
- [CVE-2023-44856](https://cve.now/CVE-2023-44856.md): Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafte (CVSS 6.1)
- [CVE-2023-44857](https://cve.now/CVE-2023-44857.md): An issue in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub\_21D24 functi (CVSS 8.1)
- [CVE-2023-49528](https://cve.now/CVE-2023-49528.md): Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of (CVSS 8.0)
- [CVE-2024-22526](https://cve.now/CVE-2024-22526.md): Buffer Overflow vulnerability in bandisoft bandiview v7.0, allows local attackers to cause a denial of service (DoS) via exr image file. (CVSS 5.5)
- [CVE-2024-22734](https://cve.now/CVE-2024-22734.md): An issue was discovered in AMCS Group Trux Waste Management Software before version 7.19.0018.26912, allows local attackers to obtain sensit (CVSS 6.2)
- [CVE-2024-25545](https://cve.now/CVE-2024-25545.md): An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework compo (CVSS 7.8)
- [CVE-2024-28718](https://cve.now/CVE-2024-28718.md): An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert\_manager.py. (CVSS 9.8, magnum)
- [CVE-2024-29400](https://cve.now/CVE-2024-29400.md): An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter. (CVSS 7.5)
- [CVE-2024-29461](https://cve.now/CVE-2024-29461.md): An issue in Floodlight SDN OpenFlow Controller v.1.2 allows a remote attacker to cause a denial of service via the datapath id component. (CVSS 6.3)
- [CVE-2024-30614](https://cve.now/CVE-2024-30614.md): An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope. (CVSS 5.3)
- [CVE-2024-30845](https://cve.now/CVE-2024-30845.md): Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the va (CVSS 6.1)
- [CVE-2024-31818](https://cve.now/CVE-2024-31818.md): Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.p (CVSS 9.8)
- [CVE-2024-31839](https://cve.now/CVE-2024-31839.md): Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler (CVSS 4.8, github.com/tiagorlampert/CHAOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.