# CVEs published 2024-04-19

114 CVEs were published on April 19, 2024: 7 critical, 54 high. Days are UTC.

- [CVE-2024-1480](https://cve.now/CVE-2024-1480.md): Unitronics Vision Standard Unauthenticated Password Retrieval (CVSS 7.5, Unitronics Vision230 · Unitronics Vision280 +3)
- [CVE-2024-31994](https://cve.now/CVE-2024-31994.md): Mealie vulnerable to a DoS in recipe image importer (GHSL-2023-228) (CVSS 6.5, mealie-recipes mealie)
- [CVE-2024-31993](https://cve.now/CVE-2024-31993.md): Mealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227) (CVSS 6.2, mealie-recipes mealie)
- [CVE-2024-31992](https://cve.now/CVE-2024-31992.md): Mealie contains a DoS vulnerability in recipe importer (CVSS 6.5, mealie-recipes mealie)
- [CVE-2024-31991](https://cve.now/CVE-2024-31991.md): Mealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225) (CVSS 4.1, mealie-recipes mealie)
- [CVE-2024-4017](https://cve.now/CVE-2024-4017.md): Privilege Escalation in U-Series Appliance (CVSS 8.8, BeyondTrust U-Series Appliance)
- [CVE-2024-4018](https://cve.now/CVE-2024-4018.md): Privilege Escalation in U-Series Appliance (CVSS 8.8, BeyondTrust U-Series Appliance)
- [CVE-2024-1681](https://cve.now/CVE-2024-1681.md): Log Injection Vulnerability in corydolphin/flask-cors (CVSS 5.3, corydolphin/flask-cors · flask-cors)
- [CVE-2024-31450](https://cve.now/CVE-2024-31450.md): Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277) (CVSS 2.7, owncast · github.com/owncast/owncast)
- [CVE-2024-32652](https://cve.now/CVE-2024-32652.md): @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed (CVSS 7.5, honojs node-server · @hono/node-server)
- [CVE-2024-3979](https://cve.now/CVE-2024-3979.md): COVESA vsomeip race condition (CVSS 4.4, COVESA vsomeip)
- [CVE-2024-2440](https://cve.now/CVE-2024-2440.md): Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions (CVSS 5.5, GitHub Enterprise Server)
- [CVE-2022-40745](https://cve.now/CVE-2022-40745.md): IBM Aspera Faspex information disclosure (CVSS 5.5, IBM Aspera Faspex)
- [CVE-2023-37397](https://cve.now/CVE-2023-37397.md): IBM Aspera Faspex data manipulation (CVSS 3.6, IBM Aspera Faspex)
- [CVE-2024-29991](https://cve.now/CVE-2024-29991.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 5.0, Microsoft Edge)
- [CVE-2023-27279](https://cve.now/CVE-2023-27279.md): IBM Aspera Faspex denial of service (CVSS 6.5, IBM Aspera Faspex)
- [CVE-2023-37396](https://cve.now/CVE-2023-37396.md): IBM Aspera Faspex information disclosure (CVSS 2.5, IBM Aspera Faspex)
- [CVE-2024-32650](https://cve.now/CVE-2024-32650.md): Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete\_io() with proper client input (CVSS 7.5, rustls)
- [CVE-2024-29183](https://cve.now/CVE-2024-29183.md): OpenRASP vulnerable to a reflected Cross-Site Scripting (XSS) attack in /login (CVSS 6.1, baidu openrasp)
- [CVE-2023-22869](https://cve.now/CVE-2023-22869.md): IBM Aspera Faspex information disclosure (CVSS 5.5, IBM Aspera Faspex)
- [CVE-2024-29029](https://cve.now/CVE-2024-29029.md): memos vulnerable to an SSRF in /o/get/image (CVSS 6.1, usememos memos · github.com/usememos/memos)
- [CVE-2024-29028](https://cve.now/CVE-2024-29028.md): memos vulnerable to an SSRF in /o/get/httpmeta (CVSS 5.8, usememos memos · github.com/usememos/memos)
- [CVE-2024-29030](https://cve.now/CVE-2024-29030.md): memos vulnerable to an SSRF in /api/resource (CVSS 5.8, usememos memos · github.com/usememos/memos)
- [CVE-2024-32644](https://cve.now/CVE-2024-32644.md): Evmos' transaction execution not accounting for all state transition after interaction with precompiles (CVSS 9.1, evmos · github.com/evmos/evmos/v16 +21)
- [CVE-2024-32478](https://cve.now/CVE-2024-32478.md): Git Credential Manager (GCM)'s Debian package does not set root ownership on installed files (CVSS 6.9, git-ecosystem git-credential-manager)
- [CVE-2024-32038](https://cve.now/CVE-2024-32038.md): Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8, wazuh)
- [CVE-2023-50260](https://cve.now/CVE-2023-50260.md): Wazuh's vulnerability in host\_deny AR script allows arbitrary command execution (CVSS 8.8, wazuh)
- [CVE-2024-3684](https://cve.now/CVE-2024-3684.md): Improper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console (CVSS 8.0, GitHub Enterprise Server)
- [CVE-2023-49275](https://cve.now/CVE-2023-49275.md): Wazuh vulnerable to NULL Pointer Dereference in wazuh-analysisd (CVSS 6.5, wazuh)
- [CVE-2024-3646](https://cve.now/CVE-2024-3646.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console (CVSS 8.0, GitHub Enterprise Server)
- [CVE-2024-3470](https://cve.now/CVE-2024-3470.md): Repository administrator can bypass organization's ruleset using deploy keys (CVSS 5.9, GitHub Enterprise Server)
- [CVE-2023-37400](https://cve.now/CVE-2023-37400.md): IBM Aspera Faspex privilege escalation (CVSS 7.8, IBM Aspera Faspex)
- [CVE-2024-3654](https://cve.now/CVE-2024-3654.md): Cross-Site Scripting Vulnerability in Teixo by Teimas Global (CVSS 6.3, Teimas Global Teixo)
- [CVE-2024-32683](https://cve.now/CVE-2024-32683.md): WordPress WP Ultimate Review plugin \<= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, Wpmet Wp Ultimate Review)
- [CVE-2024-1065](https://cve.now/CVE-2024-1065.md): Mali GPU Kernel Driver allows improper GPU memory processing operations (CVSS 5.9, Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1)
- [CVE-2024-0671](https://cve.now/CVE-2024-0671.md): Mali GPU Kernel Driver allows improper GPU memory processing operations (CVSS 6.8, Arm Midgard GPU Kernel Driver · Arm Bifrost GPU Kernel D… +2)
- [CVE-2024-29969](https://cve.now/CVE-2024-29969.md): TLS/SSL weak message authentication code ciphers are added by default for port 18082 (CVSS 7.5, Brocade SANnav)
- [CVE-2024-29968](https://cve.now/CVE-2024-29968.md): SQL Table names, column names, and SQL queries are collected in DR standby Supportsave (CVSS 7.7, Brocade SANnav)
- [CVE-2024-29967](https://cve.now/CVE-2024-29967.md): In Brocade SANnav before v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points (CVSS 4.4, Brocade SANnav)
- [CVE-2024-2761](https://cve.now/CVE-2024-2761.md): Genesis Blocks \< 3.1.3 - Contributor+ Stored XSS (CVSS 6.8, Genesis Blocks)
- [CVE-2024-29966](https://cve.now/CVE-2024-29966.md): hard-coded credentials in the documentation that appear as the appliance root password (CVSS 7.5, Brocade SANnav)
- [CVE-2024-29965](https://cve.now/CVE-2024-29965.md): Insecure backup (CVSS 6.8, Brocade SANnav)
- [CVE-2024-29964](https://cve.now/CVE-2024-29964.md): Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files (CVSS 5.7, Brocade SANnav)
- [CVE-2024-29962](https://cve.now/CVE-2024-29962.md): Insecure file permission setting that makes files world-readable (CVSS 5.5, Brocade SANnav)
- [CVE-2024-29963](https://cve.now/CVE-2024-29963.md): Brocade SANnav contains hardcoded TLS keys used by Docker (CVSS 1.9, Brocade SANnav)
- [CVE-2024-29961](https://cve.now/CVE-2024-29961.md): supply-chain attack risk (CVSS 8.2, Brocade SANnav)
- [CVE-2024-29960](https://cve.now/CVE-2024-29960.md): Identical SSH keys utilized inside the OVA image (CVE-2024-29960) (CVSS 6.8, Brocade SANnav)
- [CVE-2024-29959](https://cve.now/CVE-2024-29959.md): Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save (CVSS 8.6, Brocade SANnav)
- [CVE-2024-29958](https://cve.now/CVE-2024-29958.md): Encryption key in the console when a privileged user executes the script to replace the Brocade SANnav Management Portal standby node. (CVSS 7.5, Brocade SANnav)
- [CVE-2024-29957](https://cve.now/CVE-2024-29957.md): Encryption key is stored in the DR log files (CVSS 7.5, Brocade SANnav)
- [CVE-2024-3600](https://cve.now/CVE-2024-3600.md): Poll Maker – Best WordPress Poll Plugin \<= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, ays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…)
- [CVE-2024-3731](https://cve.now/CVE-2024-3731.md): Customer Reviews for WooCommerce \<= 5.47.0 - Reflected Cross-Site Scripting via 's' (CVSS 6.1, ivole Customer Reviews for WooCommerce)
- [CVE-2024-3818](https://cve.now/CVE-2024-3818.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 4.5.9 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting via "Social Icons" Block (CVSS 5.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2024-3615](https://cve.now/CVE-2024-3615.md): Media Library Folders \<= 8.2.0 - Reflected Cross-Site Scripting via 's' (CVSS 6.1, maxfoundry Media Library Folders)
- [CVE-2024-3598](https://cve.now/CVE-2024-3598.md): ElementsKit Pro \<= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ekit\_btn\_id' (CVSS 6.4, wpmet ElementsKit Pro)
- [CVE-2024-3560](https://cve.now/CVE-2024-3560.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-23526](https://cve.now/CVE-2024-23526.md): An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an una (CVSS 5.3, Ivanti Avalanche)
- [CVE-2024-22061](https://cve.now/CVE-2024-22061.md): A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to ex (CVSS 8.1, Ivanti Avalanche)
- [CVE-2024-23529](https://cve.now/CVE-2024-23529.md): An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an una (CVSS 5.3, Ivanti Avalanche)
- [CVE-2024-23528](https://cve.now/CVE-2024-23528.md): An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an una (CVSS 5.3, Ivanti Avalanche)
- [CVE-2024-25000](https://cve.now/CVE-2024-25000.md): A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary (CVSS 8.8, Ivanti Avalanche)
- [CVE-2024-27977](https://cve.now/CVE-2024-27977.md): A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete arbitrary (CVSS 7.1, Ivanti Avalanche)
- [CVE-2024-24992](https://cve.now/CVE-2024-24992.md): A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary (CVSS 8.8, Ivanti Avalanche)
- [CVE-2024-23532](https://cve.now/CVE-2024-23532.md): An out-of-bounds Read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker (CVSS 7.5, Ivanti Avalanche)
- [CVE-2024-23535](https://cve.now/CVE-2024-23535.md): A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary (CVSS 8.8, Ivanti Avalanche)
- [CVE-2024-24998](https://cve.now/CVE-2024-24998.md): A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary (CVSS 8.8, Ivanti Avalanche)
- [CVE-2024-24995](https://cve.now/CVE-2024-24995.md): A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute (CVSS 8.8, Ivanti Avalanche)
- [CVE-2024-24993](https://cve.now/CVE-2024-24993.md): A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute (CVSS 8.8, Ivanti Avalanche)
- [CVE-2024-24999](https://cve.now/CVE-2024-24999.md): A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary (CVSS 8.8, Ivanti Avlanche)
- [CVE-2024-24991](https://cve.now/CVE-2024-24991.md): A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote att (CVSS 6.5, Ivanti Avalanche)
- [CVE-2024-24997](https://cve.now/CVE-2024-24997.md): A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary (CVSS 8.8, Ivanti Avalanche)
- [CVE-2024-27978](https://cve.now/CVE-2024-27978.md): A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote att (CVSS 6.5, Ivanti Avalanche)
- [CVE-2024-24994](https://cve.now/CVE-2024-24994.md): A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary (CVSS 8.8, Ivanti Avalanche)
- [CVE-2024-24996](https://cve.now/CVE-2024-24996.md): A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to e (CVSS 9.8, Ivanti Avalanche)
- [CVE-2024-23534](https://cve.now/CVE-2024-23534.md): An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execut (CVSS 8.8, Ivanti Avalanche)
- [CVE-2024-23533](https://cve.now/CVE-2024-23533.md): An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an aut (CVSS 4.3, Ivanti Avalanche)
- [CVE-2024-23531](https://cve.now/CVE-2024-23531.md): An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker (CVSS 7.5, Ivanti Avalanche)
- [CVE-2024-23530](https://cve.now/CVE-2024-23530.md): An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an una (CVSS 5.3, Ivanti Avalanche)
- [CVE-2024-27976](https://cve.now/CVE-2024-27976.md): A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary (CVSS 8.8, Ivanti Avalanche)
- [CVE-2024-29204](https://cve.now/CVE-2024-29204.md): A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to e (CVSS 9.8, Ivanti Avalanche)
- [CVE-2024-27975](https://cve.now/CVE-2024-27975.md): An Use-after-free vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to e (CVSS 8.8, Ivanti Avalanche)
- [CVE-2024-27984](https://cve.now/CVE-2024-27984.md): A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete specific t (CVSS 7.1, Ivanti Avalanche)
- [CVE-2023-47435](https://cve.now/CVE-2023-47435.md): An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected (CVSS 9.8)
- [CVE-2023-49501](https://cve.now/CVE-2023-49501.md): Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config\_eq\_output func (CVSS 8.0)
- [CVE-2023-49502](https://cve.now/CVE-2023-49502.md): Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff\_bwdif\_filter\_intra (CVSS 8.8)
- [CVE-2023-49963](https://cve.now/CVE-2023-49963.md): DYMO LabelWriter Print Server through 2.366 contains a backdoor hard-coded password that could allow an attacker to take control. (CVSS 8.8)
- [CVE-2023-50007](https://cve.now/CVE-2023-50007.md): FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av\_samples\_set\_silence function in thel (CVSS 4.0)
- [CVE-2023-50008](https://cve.now/CVE-2023-50008.md): FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av\_malloc function in libavutil/mem.c:105:9 (CVSS 7.8)
- [CVE-2023-50009](https://cve.now/CVE-2023-50009.md): FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff\_gaussian\_blur\_8 function in libavfilter/edge\_template.c:116:5 com (CVSS 8.0)
- [CVE-2023-50010](https://cve.now/CVE-2023-50010.md): FFmpeg v.n6.1-3-g466799d4f5 allows a buffer over-read at ff\_gradfun\_blur\_line\_movdqa\_sse2, as demonstrated by a call to the set\_encoder\_id f (CVSS 7.8)
- [CVE-2023-51791](https://cve.now/CVE-2023-51791.md): Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl\_pa (CVSS 7.8)
- [CVE-2023-51792](https://cve.now/CVE-2023-51792.md): Buffer Overflow vulnerability in libde265 v1.0.12 allows a local attacker to cause a denial of service via the allocation size exceeding the (CVSS 3.3)
- [CVE-2023-51793](https://cve.now/CVE-2023-51793.md): Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c (CVSS 7.8)
- [CVE-2023-51795](https://cve.now/CVE-2023-51795.md): Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf\_show (CVSS 8.0)
- [CVE-2023-51796](https://cve.now/CVE-2023-51796.md): Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/f\_revers (CVSS 3.6)
- [CVE-2023-51797](https://cve.now/CVE-2023-51797.md): Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf\_show (CVSS 6.7)
- [CVE-2023-51798](https://cve.now/CVE-2023-51798.md): Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point excepti (CVSS 7.8)
- [CVE-2024-22640](https://cve.now/CVE-2024-22640.md): TCPDF version \<=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color. (CVSS 7.5, tecnickcom/tcpdf)
- [CVE-2024-22905](https://cve.now/CVE-2024-22905.md): Buffer Overflow vulnerability in ARM mbed-os v.6.17.0 allows a remote attacker to execute arbitrary code via a crafted script to the hciTrSe (CVSS 7.0)
- [CVE-2024-27752](https://cve.now/CVE-2024-27752.md): Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the Default Keyword field in th (CVSS 5.4)
- [CVE-2024-30974](https://cve.now/CVE-2024-30974.md): SQL Injection vulnerability in autoexpress v.1.3.0 allows attackers to run arbitrary SQL commands via the carId parameter. (CVSS 7.3)
- [CVE-2024-31546](https://cve.now/CVE-2024-31546.md): Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/damage/view\_damage.php. (CVSS 9.8)
- [CVE-2024-31547](https://cve.now/CVE-2024-31547.md): Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/item/view\_item.php. (CVSS 9.1)
- [CVE-2024-31552](https://cve.now/CVE-2024-31552.md): CuteHttpFileServer v.3.1 version has an arbitrary file download vulnerability, which allows attackers to download arbitrary files on the ser (CVSS 7.1)
- [CVE-2024-31584](https://cve.now/CVE-2024-31584.md): Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer\_loader.cpp. (CVSS 5.5, torch)
- [CVE-2024-31587](https://cve.now/CVE-2024-31587.md): SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a (CVSS 6.5)
- [CVE-2024-31744](https://cve.now/CVE-2024-31744.md): In Jasper 4.2.2, the jpc\_streamlist\_remove function in src/libjasper/jpc/jpc\_dec.c:2407 has an assertion failure vulnerability, allowing att (CVSS 7.5)
- [CVE-2024-31841](https://cve.now/CVE-2024-31841.md): An issue was discovered in Italtel Embrace 1.6.4. (CVSS 7.5)
- [CVE-2024-31846](https://cve.now/CVE-2024-31846.md): An issue was discovered in Italtel Embrace 1.6.4. (CVSS 7.5)
- [CVE-2024-32166](https://cve.now/CVE-2024-32166.md): Webid v1.2.1 suffers from an Insecure Direct Object Reference (IDOR) - Broken Access Control vulnerability, allowing attackers to buy now an (CVSS 8.8)
- [CVE-2024-32206](https://cve.now/CVE-2024-32206.md): A stored cross-site scripting (XSS) vulnerability in the component \\affiche\\admin\\index.php of WUZHICMS v4.1.0 allows attackers to execute a (CVSS 4.6)
- [CVE-2024-32391](https://cve.now/CVE-2024-32391.md): Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload. (CVSS 7.3)
- [CVE-2024-32392](https://cve.now/CVE-2024-32392.md): Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component. (CVSS 4.5)
- [CVE-2024-32409](https://cve.now/CVE-2024-32409.md): An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script. (CVSS 7.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.