# CVEs published 2024-04-22

78 CVEs were published on April 22, 2024: 13 critical, 27 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-3177](https://cve.now/CVE-2024-3177.md): Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (CVSS 2.7, Kubernetes · k8s.io/kubernetes)
- [CVE-2024-32657](https://cve.now/CVE-2024-32657.md): Hydra has persistent XSS vulnerability serving HTML build outputs (CVSS 4.6, NixOS hydra)
- [CVE-2024-32656](https://cve.now/CVE-2024-32656.md): Ant Media Server vulnerable to local privilege escalation (CVSS 7.8, Ant-Media-Server · io.antmedia:ant-media-server)
- [CVE-2024-32653](https://cve.now/CVE-2024-32653.md): Insufficient input filtering of "package name" allows command execution in the device with shell privileges (CVSS 6.1, skylot jadx)
- [CVE-2024-32480](https://cve.now/CVE-2024-32480.md): LibreNMS's Time-Based Blind SQL injection leads to database extraction (CVSS 7.2, librenms · librenms/librenms)
- [CVE-2024-32479](https://cve.now/CVE-2024-32479.md): LibreNMS's Improper Sanitization on Service template name leads to Stored XSS (CVSS 7.1, librenms · librenms/librenms)
- [CVE-2024-32461](https://cve.now/CVE-2024-32461.md): LibreNMS vulnerable to time-based SQL injection that leads to database extraction (CVSS 7.1, librenms · librenms/librenms)
- [CVE-2024-32460](https://cve.now/CVE-2024-32460.md): FreeRDP Out-Of-Bounds Read in interleaved\_decompress (CVSS 8.1, FreeRDP)
- [CVE-2024-32459](https://cve.now/CVE-2024-32459.md): FreeRDP Out-Of-Bounds Read in ncrush\_decompress (CVSS 9.8, FreeRDP)
- [CVE-2024-32458](https://cve.now/CVE-2024-32458.md): FreeRDP Out-Of-Bounds Read in planar\_skip\_plane\_rle (CVSS 9.8, FreeRDP)
- [CVE-2024-32041](https://cve.now/CVE-2024-32041.md): FreeRDP OutOfBound Read in zgfx\_decompress\_segment (CVSS 9.8, FreeRDP)
- [CVE-2024-32040](https://cve.now/CVE-2024-32040.md): FreeRDP vulnerable to integer underflow in nsc\_rle\_decode (CVSS 8.1, FreeRDP)
- [CVE-2024-32039](https://cve.now/CVE-2024-32039.md): FreeRDP Integer overflow & OutOfBound Write in clear\_decompress\_residual\_data (CVSS 9.8, FreeRDP)
- [CVE-2024-4040](https://cve.now/CVE-2024-4040.md): Unauthenticated arbitrary file read and remote code execution in CrushFTP (CVSS 9.8, KEV, CrushFTP)
- [CVE-2024-27349](https://cve.now/CVE-2024-27349.md): Apache HugeGraph-Server: Bypass whitelist in Auth mode (CVSS 9.1, Apache Software Foundation Apache HugeGraph-Server · org.ap…)
- [CVE-2024-27348](https://cve.now/CVE-2024-27348.md): Apache HugeGraph-Server: Command execution in gremlin (CVSS 9.8, KEV, Apache Software Foundation Apache HugeGraph-Server · org… +1)
- [CVE-2024-27347](https://cve.now/CVE-2024-27347.md): Apache HugeGraph-Hubble: SSRF in Hubble connection page (CVSS 5.3, Apache Software Foundation Apache HugeGraph-Hubble · org.ap…)
- [CVE-2024-3645](https://cve.now/CVE-2024-3645.md): Essential Addons for Elementor Pro \<= 5.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title\_html\_tag' (CVSS 6.4, Essential Addons for Elementor Pro)
- [CVE-2024-4026](https://cve.now/CVE-2024-4026.md): Cross-Site Scripting in the Holded application (CVSS 4.6, Holded)
- [CVE-2024-32681](https://cve.now/CVE-2024-32681.md): WordPress Prime Slider plugin \<= 3.13.2 - Broken Access Control vulnerability (CVSS 4.3, BdThemes Prime Slider – Addons For Elementor)
- [CVE-2024-32682](https://cve.now/CVE-2024-32682.md): WordPress Prime Slider plugin \<= 3.13.2 - Broken Access Control vulnerability (CVSS 7.1, BdThemes Prime Slider – Addons For Elementor)
- [CVE-2024-32684](https://cve.now/CVE-2024-32684.md): WordPress WP Ultimate Review plugin \<= 2.2.5 - Broken Access Control on Review vulnerability (CVSS 5.3, Wpmet Wp Ultimate Review)
- [CVE-2024-32687](https://cve.now/CVE-2024-32687.md): WordPress WPC Frequently Bought Together for WooCommerce plugin \<= 7.0.3 - Broken Access Control vulnerability (CVSS 4.3, WPClever WPC Frequently Bought Together for WooCommerce)
- [CVE-2024-32688](https://cve.now/CVE-2024-32688.md): WordPress MyRewards plugin \<= 5.3.0 - Broken Access Control vulnerability (CVSS 6.5, Long Watch Studio MyRewards)
- [CVE-2024-32691](https://cve.now/CVE-2024-32691.md): WordPress Active Products Tables for WooCommerce plugin \<= 1.0.6.2 - Broken Access Control vulnerability (CVSS 5.3, realmag777 Active Products Tables for WooCommerce)
- [CVE-2024-32693](https://cve.now/CVE-2024-32693.md): WordPress Automatic plugin \< 3.93.0 - Multiple Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.6, ValvePress Automatic)
- [CVE-2024-32698](https://cve.now/CVE-2024-32698.md): WordPress Happy Addons for Elementor plugin \<= 3.10.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HappyMonster Happy Addons for Elementor)
- [CVE-2024-32697](https://cve.now/CVE-2024-32697.md): WordPress HelloAsso plugin \<= 1.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HelloAsso)
- [CVE-2024-32696](https://cve.now/CVE-2024-32696.md): WordPress AI Infographic Maker OpenAI plugin \<= 4.6.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, QuantumCloud Infographic Maker – iList)
- [CVE-2024-32695](https://cve.now/CVE-2024-32695.md): WordPress Language Switcher for Transposh plugin \<= 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Marco Gasi Language Switcher for Transposh)
- [CVE-2024-32694](https://cve.now/CVE-2024-32694.md): WordPress 3D FlipBook, PDF Viewer, PDF Embedder plugin \<= 3.62 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Creative interactive media 3D FlipBook, PDF Viewer, PDF Emb…)
- [CVE-2024-32690](https://cve.now/CVE-2024-32690.md): WordPress RSS Feed Widget plugin \<= 2.9.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Fahad Mahmood RSS Feed Widget)
- [CVE-2023-7252](https://cve.now/CVE-2023-7252.md): Tickera \< 3.5.2.5 - Ticket leakage through IDOR (CVSS 5.3, Tickera)
- [CVE-2018-25101](https://cve.now/CVE-2018-25101.md): l2c2technologies Koha opac-MARCdetail.pl cross site scripting (CVSS 3.5, l2c2technologies Koha)
- [CVE-2022-34560](https://cve.now/CVE-2022-34560.md): A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 7.1)
- [CVE-2022-34561](https://cve.now/CVE-2022-34561.md): A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 4.3)
- [CVE-2022-34562](https://cve.now/CVE-2022-34562.md): A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2022-35503](https://cve.now/CVE-2022-35503.md): Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM m (CVSS 7.5)
- [CVE-2022-46897](https://cve.now/CVE-2022-46897.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 5.3)
- [CVE-2023-38290](https://cve.now/CVE-2023-38290.md): Certain software builds for the BLU View 2 and Sharp Rouvo V Android devices contain a vulnerable pre-installed app with a package name of c (CVSS 7.8)
- [CVE-2023-38291](https://cve.now/CVE-2023-38291.md): An issue was discovered in a third-party component related to ro.boot.wifimacaddr, shipped on devices from multiple device manufacturers. (CVSS 7.1)
- [CVE-2023-38292](https://cve.now/CVE-2023-38292.md): Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmen (CVSS 8.7)
- [CVE-2023-38293](https://cve.now/CVE-2023-38293.md): Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a vulnerable, pre-installed app with a package name of com (CVSS 7.3)
- [CVE-2023-38294](https://cve.now/CVE-2023-38294.md): Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsi (CVSS 6.1)
- [CVE-2023-38295](https://cve.now/CVE-2023-38295.md): Certain software builds for the TCL 30Z and TCL 10 Android devices contain a vulnerable, pre-installed app that relies on a missing permissi (CVSS 7.8)
- [CVE-2023-38296](https://cve.now/CVE-2023-38296.md): Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local (CVSS 8.0)
- [CVE-2023-38297](https://cve.now/CVE-2023-38297.md): An issue was discovered in a third-party com.factory.mmigroup component, shipped on devices from multiple device manufacturers. (CVSS 8.4)
- [CVE-2023-38298](https://cve.now/CVE-2023-38298.md): Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed b (CVSS 8.8)
- [CVE-2023-38299](https://cve.now/CVE-2023-38299.md): Various software builds for the AT&T Calypso, Nokia C100, Nokia C200, and BLU View 3 devices leak the device IMEI to a system property that (CVSS 5.5)
- [CVE-2023-38300](https://cve.now/CVE-2023-38300.md): A certain software build for the Orbic Maui device (Orbic/RC545L/RC545L:10/ORB545L\_V1.4.2\_BVZPP/230106:user/release-keys) leaks the IMEI and (CVSS 6.2)
- [CVE-2023-38301](https://cve.now/CVE-2023-38301.md): An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple device manufacturers. (CVSS 3.4)
- [CVE-2023-38302](https://cve.now/CVE-2023-38302.md): A certain software build for the Sharp Rouvo V device (SHARP/VZW\_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0\_0\_530:user/release-keys) leak (CVSS 4.3)
- [CVE-2024-22807](https://cve.now/CVE-2024-22807.md): An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to erase a critical sector of the flash memory, causing (CVSS 6.5)
- [CVE-2024-22808](https://cve.now/CVE-2024-22808.md): An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the com (CVSS 7.5)
- [CVE-2024-22809](https://cve.now/CVE-2024-22809.md): Incorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder and (CVSS 6.5)
- [CVE-2024-22811](https://cve.now/CVE-2024-22811.md): An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the com (CVSS 8.2)
- [CVE-2024-22813](https://cve.now/CVE-2024-22813.md): An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memo (CVSS 4.4)
- [CVE-2024-22815](https://cve.now/CVE-2024-22815.md): An issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Servi (CVSS 5.3)
- [CVE-2024-22856](https://cve.now/CVE-2024-22856.md): A SQL injection vulnerability via the Save Favorite Search function in Axefinance Axe Credit Portal \>= v.3.0 allows authenticated attackers (CVSS 5.4)
- [CVE-2024-27574](https://cve.now/CVE-2024-27574.md): SQL Injection vulnerability in Trainme Academy version Ichin v.1.3.2 allows a remote attacker to obtain sensitive information via the inform (CVSS 9.1)
- [CVE-2024-28436](https://cve.now/CVE-2024-28436.md): Cross Site Scripting vulnerability in D-Link DAP products DAP-2230, DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2590, DAP-2690, DAP-2695, DA (CVSS 6.1)
- [CVE-2024-28699](https://cve.now/CVE-2024-28699.md): A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev (CVSS 7.8)
- [CVE-2024-28717](https://cve.now/CVE-2024-28717.md): An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component. (CVSS 4.9, storlets)
- [CVE-2024-28722](https://cve.now/CVE-2024-28722.md): Cross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the qu (CVSS 6.3)
- [CVE-2024-29368](https://cve.now/CVE-2024-29368.md): An arbitrary file upload vulnerability in the file handling module of moziloCMS v2.0 allows attackers to bypass extension restrictions via f (CVSS 6.5)
- [CVE-2024-29376](https://cve.now/CVE-2024-29376.md): Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. (CVSS 6.4, sylius/sylius)
- [CVE-2024-29661](https://cve.now/CVE-2024-29661.md): A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload. (CVSS 9.8)
- [CVE-2024-30799](https://cve.now/CVE-2024-30799.md): An issue in PX4 Autopilot v1.14 and before allows a remote attacker to execute arbitrary code and cause a denial of service via the Breach R (CVSS 4.4)
- [CVE-2024-31036](https://cve.now/CVE-2024-31036.md): A heap-buffer-overflow vulnerability in the read\_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of service via transmis (CVSS 6.8)
- [CVE-2024-31545](https://cve.now/CVE-2024-31545.md): Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manage\_user&id=6. (CVSS 9.4)
- [CVE-2024-31666](https://cve.now/CVE-2024-31666.md): An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit\_addon\_post.php component. (CVSS 9.8)
- [CVE-2024-32238](https://cve.now/CVE-2024-32238.md): H3C ER8300G2-X is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2024-32368](https://cve.now/CVE-2024-32368.md): Insecure Permission vulnerability in Agasta Sanketlife 2.0 Pocket 12-Lead ECG Monitor FW Version 3.0 allows a local attacker to cause a deni (CVSS 7.3)
- [CVE-2024-32394](https://cve.now/CVE-2024-32394.md): An issue in ruijie.com/cn RG-RSR10-01G-T(WA)-S RSR\_3.0(1)B9P2\_RSR10-01G-TW-S\_07150910 and RG-RSR10-01G-T(WA)-S RSR\_3.0(1)B9P2\_RSR10-01G-TW-S (CVSS 8.8)
- [CVE-2024-32399](https://cve.now/CVE-2024-32399.md): Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via (CVSS 7.6)
- [CVE-2024-32405](https://cve.now/CVE-2024-32405.md): Cross Site Scripting vulnerability in inducer relate before v.2024.1 allows a remote attacker to escalate privileges via a crafted payload t (CVSS 2.6)
- [CVE-2024-32407](https://cve.now/CVE-2024-32407.md): An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feat (CVSS 8.8)
- [CVE-2024-32418](https://cve.now/CVE-2024-32418.md): An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add\_addon.php component. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.