# CVEs published 2024-04-25

94 CVEs were published on April 25, 2024: 12 critical, 30 high. Days are UTC.

- [CVE-2024-32868](https://cve.now/CVE-2024-32868.md): ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass (CVSS 6.5, zitadel · github.com/zitadel/zitadel)
- [CVE-2024-32651](https://cve.now/CVE-2024-32651.md): Server Side Template Injection in Jinja2 allows Remote Command Execution (CVSS 10.0, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2024-0916](https://cve.now/CVE-2024-0916.md): Unauthenticated Remote Code Execution in UvDesk Community (CVSS 10.0, Webkul Software UvDesk Community)
- [CVE-2024-3265](https://cve.now/CVE-2024-3265.md): WP Advanced Search \<= 1.1.6 - Admin+ SQL Injection (CVSS 4.7, Advanced Search)
- [CVE-2022-36029](https://cve.now/CVE-2022-36029.md): BigBlueButton Greenlight Open Redirect vulnerability (CVSS 9.1, bigbluebutton greenlight)
- [CVE-2022-36028](https://cve.now/CVE-2022-36028.md): BigBlueButton Greenlight Open Redirect vulnerability (CVSS 9.1, bigbluebutton greenlight)
- [CVE-2024-32649](https://cve.now/CVE-2024-32649.md): vyper performs double eval of the argument of sqrt (CVSS 5.3, vyperlang vyper · vyper)
- [CVE-2024-32648](https://cve.now/CVE-2024-32648.md): vyper default functions don't respect nonreentrancy keys (CVSS 5.3, vyperlang vyper · vyper)
- [CVE-2024-3624](https://cve.now/CVE-2024-3624.md): Mirror-registry: database user and password stored in plain-text (CVSS 7.3, mirror-registry · mirror registry for Red Hat OpenShift)
- [CVE-2024-3625](https://cve.now/CVE-2024-3625.md): Mirror-registry: redis password stored in plain-text (CVSS 7.3, mirror-registry · mirror registry for Red Hat OpenShift)
- [CVE-2024-3623](https://cve.now/CVE-2024-3623.md): Mirror-registry: default database secret key stored in plain-text on initial configuration file (CVSS 6.5, mirror-registry · mirror registry for Red Hat OpenShift)
- [CVE-2024-3622](https://cve.now/CVE-2024-3622.md): Mirror-registry: plain-text default csrf secret key (CVSS 8.8, mirror-registry · mirror registry for Red Hat OpenShift)
- [CVE-2024-3508](https://cve.now/CVE-2024-3508.md): Bzip2: compressed content bomb leads to denial of service of bombastic api (CVSS 4.3, bzip2 · Red Hat Trusted Profile Analyzer)
- [CVE-2024-2905](https://cve.now/CVE-2024-2905.md): Rpm-ostree: world-readable /etc/shadow file (CVSS 6.2, rpm-ostree · Red Hat Enterprise Linux +1)
- [CVE-2024-32647](https://cve.now/CVE-2024-32647.md): vyper performs double eval of raw\_args in create\_from\_blueprint (CVSS 5.3, vyperlang vyper · vyper)
- [CVE-2024-32646](https://cve.now/CVE-2024-32646.md): vyper performs double eval of the slice args when buffer from adhoc locations (CVSS 5.3, vyperlang vyper · vyper)
- [CVE-2024-32645](https://cve.now/CVE-2024-32645.md): vyper performs incorrect topic logging in raw\_log (CVSS 5.3, vyperlang vyper · vyper)
- [CVE-2024-32481](https://cve.now/CVE-2024-32481.md): vyper's range(start, start + N) reverts for negative numbers (CVSS 5.3, vyperlang vyper · vyper)
- [CVE-2024-32467](https://cve.now/CVE-2024-32467.md): Meteraphsere vulnerable to unauthorized viewing by workspace members (CVSS 5.7, metersphere)
- [CVE-2024-2467](https://cve.now/CVE-2024-2467.md): Perl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack) (CVSS 5.9, perl-Crypt-OpenSSL-RSA · Red Hat Enterprise Linux)
- [CVE-2024-28241](https://cve.now/CVE-2024-28241.md): GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder (CVSS 7.3, glpi-project glpi-agent)
- [CVE-2024-28240](https://cve.now/CVE-2024-28240.md): GLPI-Agent's MSI package installation permits local users to change Agent configuration (CVSS 7.3, glpi-project glpi-agent)
- [CVE-2024-25624](https://cve.now/CVE-2024-25624.md): iris-web vulnerable to Server Side Template Injection in reports (CVSS 6.8, dfir-iris iris-web)
- [CVE-2024-1726](https://cve.now/CVE-2024-1726.md): Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service (CVSS 5.3, quarkus-resteasy-reactive · Red Hat build of Quarkus 3.2… +2)
- [CVE-2024-1657](https://cve.now/CVE-2024-1657.md): Platform: insecure websocket used when interacting with eda server (CVSS 8.1, ansible · Red Hat Ansible Automation Platform 2.4 for RHEL)
- [CVE-2024-1139](https://cve.now/CVE-2024-1139.md): Cluster-monitoring-operator: credentials leak (CVSS 7.7, cluster-monitoring-operator · Red Hat OpenShift Containe… +2)
- [CVE-2024-1102](https://cve.now/CVE-2024-1102.md): Jberet: jberet-core logging database credentials (CVSS 6.5, jberet · Red Hat JBoss Enterprise Application Platform +6)
- [CVE-2024-0874](https://cve.now/CVE-2024-0874.md): Coredns: cd bit response is cached and served later (CVSS 5.3, coredns · Red Hat OpenShift Container Platform +3)
- [CVE-2023-6787](https://cve.now/CVE-2023-6787.md): Keycloak: session hijacking via re-authentication (CVSS 6.5, keycloak · Red Hat build of Keycloak +2)
- [CVE-2023-6717](https://cve.now/CVE-2023-6717.md): Keycloak: xss via assertion consumer service url in saml post-binding flow (CVSS 6.0, keycloak · Red Hat AMQ Broker +16)
- [CVE-2023-6596](https://cve.now/CVE-2023-6596.md): Openshift: incomplete fix for rapid reset (cve-2023-44487/cve-2023-39325) (CVSS 7.5, openshift · Red Hat OpenShift Container Platform)
- [CVE-2023-6544](https://cve.now/CVE-2023-6544.md): Keycloak: authorization bypass (CVSS 5.4, org.keycloak:keycloak-services · Red Hat build of Keyclo… +3)
- [CVE-2023-6484](https://cve.now/CVE-2023-6484.md): Keycloak: log injection during webauthn authentication or registration (CVSS 5.3, keycloak · Red Hat build of Keycloak +4)
- [CVE-2023-5675](https://cve.now/CVE-2023-5675.md): Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used. (CVSS 6.5, quarkus-resteasy-reactive · Red Hat build of Quarkus 2.… +13)
- [CVE-2024-33592](https://cve.now/CVE-2024-33592.md): WordPress Radio Player plugin \<= 2.0.73 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, SoftLab Radio Player)
- [CVE-2024-22391](https://cve.now/CVE-2024-22391.md): A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. (CVSS 7.7, Grassroot DICOM)
- [CVE-2024-22373](https://cve.now/CVE-2024-22373.md): An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3 (CVSS 8.1, Grassroot DICOM)
- [CVE-2024-25569](https://cve.now/CVE-2024-25569.md): An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. (CVSS 6.5, Grassroot DICOM)
- [CVE-2024-4172](https://cve.now/CVE-2024-4172.md): idcCMS cross-site request forgery (CVSS 4.3, idcCMS)
- [CVE-2024-4171](https://cve.now/CVE-2024-4171.md): Tenda W30E WizardHandle fromWizardHandle stack-based overflow (CVSS 8.8, Tenda W30E)
- [CVE-2024-4024](https://cve.now/CVE-2024-4024.md): Authentication Bypass by Assumed-Immutable Data in GitLab (CVSS 7.3, GitLab)
- [CVE-2024-4006](https://cve.now/CVE-2024-4006.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-4170](https://cve.now/CVE-2024-4170.md): Tenda 4G300 sub\_429A30 stack-based overflow (CVSS 8.8, Tenda 4G300)
- [CVE-2024-4169](https://cve.now/CVE-2024-4169.md): Tenda 4G300 sub\_4279CC stack-based overflow (CVSS 8.8, Tenda 4G300)
- [CVE-2023-3597](https://cve.now/CVE-2023-3597.md): Keycloak: secondary factor bypass in step-up authentication (CVSS 5.0, keycloak · Red Hat build of Keycloak +2)
- [CVE-2024-25026](https://cve.now/CVE-2024-25026.md): IBM WebSphere Application Server denial of service (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2024-4168](https://cve.now/CVE-2024-4168.md): Tenda 4G300 sub\_4260F0 stack-based overflow (CVSS 8.8, Tenda 4G300)
- [CVE-2024-4167](https://cve.now/CVE-2024-4167.md): Tenda 4G300 sub\_422AA4 stack-based overflow (CVSS 8.8, Tenda 4G300)
- [CVE-2024-4175](https://cve.now/CVE-2024-4175.md): Improper Input Validation vulnerability in Hyperion Web Server (CVSS 5.4, Hyperion Web Server)
- [CVE-2024-4174](https://cve.now/CVE-2024-4174.md): Cross-Site Scripting (XSS) vulnerability in Hyperion Web Server (CVSS 5.4, Hyperion Web Server)
- [CVE-2024-4166](https://cve.now/CVE-2024-4166.md): Tenda 4G300 sub\_41E858 stack-based overflow (CVSS 8.8, Tenda 4G300)
- [CVE-2024-4165](https://cve.now/CVE-2024-4165.md): Tenda G3 modifyDhcpRule stack-based overflow (CVSS 8.8, Tenda G3)
- [CVE-2024-1347](https://cve.now/CVE-2024-1347.md): Authentication Bypass by Spoofing in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-2434](https://cve.now/CVE-2024-2434.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (CVSS 8.5, GitLab)
- [CVE-2024-2829](https://cve.now/CVE-2024-2829.md): Inefficient Regular Expression Complexity in GitLab (CVSS 7.5, GitLab)
- [CVE-2024-3730](https://cve.now/CVE-2024-3730.md): Simple Membership \<= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4, wpinsider-1 Simple Membership)
- [CVE-2024-32676](https://cve.now/CVE-2024-32676.md): WordPress LoginPress Pro plugin \< 3.0.0 - Captcha Bypass vulnerability (CVSS 5.3, LoginPress Pro)
- [CVE-2024-4164](https://cve.now/CVE-2024-4164.md): Tenda G3 ModifyPppAuthWhiteMac formModifyPppAuthWhiteMac stack-based overflow (CVSS 8.8, Tenda G3)
- [CVE-2024-25583](https://cve.now/CVE-2024-25583.md): Crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured (CVSS 7.5, PowerDNS Recursor)
- [CVE-2023-52220](https://cve.now/CVE-2023-52220.md): WordPress MonsterInsights plugin \<= 8.21.0 - Broken Access Control vulnerability (CVSS 4.3, MonsterInsights Google Analytics by Monster Insights)
- [CVE-2024-3994](https://cve.now/CVE-2024-3994.md): Tutor LMS – eLearning and online course solution \<= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor\_instructor\_list' Shortcode (CVSS 5.4, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-4035](https://cve.now/CVE-2024-4035.md): Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery \<= 2.7.7.21 - Authenticated (Author+) Cross-Site Scripting (CVSS 6.4, gt3themes Photo Gallery – GT3 Image Gallery & Gutenberg Blo…)
- [CVE-2024-32961](https://cve.now/CVE-2024-32961.md): WordPress Blocksy theme \<= 2.0.33 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, creativethemeshq Blocksy)
- [CVE-2024-4077](https://cve.now/CVE-2024-4077.md): WordPress UDesign theme \<= 4.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AndonDesign UDesign)
- [CVE-2024-31266](https://cve.now/CVE-2024-31266.md): WordPress Advanced Order Export For WooCommerce plugin \<= 3.4.4 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, AlgolPlus Advanced Order Export For WooCommerce)
- [CVE-2024-30560](https://cve.now/CVE-2024-30560.md): WordPress DX-Watermark plugin \<= 1.0.4 - CSRF to Arbitrary File Upload and XSS vulnerability (CVSS 9.6, 大侠WP DX-Watermark)
- [CVE-2024-25917](https://cve.now/CVE-2024-25917.md): WordPress WP Setup Wizard plugin \<= 1.0.8.1 - Auth. Full Database Download Vulnerability (CVSS 8.8, CodeRevolution WP Setup Wizard)
- [CVE-2024-3733](https://cve.now/CVE-2024-3733.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.15 - Information Exposure (CVSS 5.3, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-22144](https://cve.now/CVE-2024-22144.md): WordPress Anti-Malware Security and Brute-Force Firewall plugin \<= 4.21.96 - Unauthenticated Predictable Nonce Brute-Force Leading to RCE vulnerability (CVSS 9.0, Eli Scheetz Anti-Malware Security and Brute-Force Firewall)
- [CVE-2023-51484](https://cve.now/CVE-2023-51484.md): WordPress Login as User or Customer plugin \<= 3.8 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, wp-buy Login as User or Customer)
- [CVE-2023-51482](https://cve.now/CVE-2023-51482.md): WordPress Eazy Plugin Manager plugin \<= 4.1.2 - Auth. Arbitrary Options Update lead to RCE vulnerability (CVSS 9.9, EazyPlugins Eazy Plugin Manager)
- [CVE-2023-51478](https://cve.now/CVE-2023-51478.md): WordPress Build App Online plugin \<= 1.0.19 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, Abdul Hakeem Build App Online)
- [CVE-2024-3893](https://cve.now/CVE-2024-3893.md): Classified Listing – Classified ads & Business Directory Plugin \<= 3.0.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion (CVSS 4.3, techlabpro1 Classified Listing – AI-Powered Classified ads…)
- [CVE-2024-3988](https://cve.now/CVE-2024-3988.md): Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) \<= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sina Fancy Text Widget (CVSS 6.4, shaonsina Sina Extension for Elementor)
- [CVE-2024-3929](https://cve.now/CVE-2024-3929.md): Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) \<= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Post Overlay (CVSS 6.4, pt-guy Content Views – Post Grid & Filter, Recent Posts, Ca…)
- [CVE-2024-4173](https://cve.now/CVE-2024-4173.md): SANnav versions exposes Kafka in the wan interface. (CVSS 7.6, Brocade SANnav)
- [CVE-2023-6237](https://cve.now/CVE-2023-6237.md): Excessive time spent checking invalid RSA public keys (CVSS 5.9, OpenSSL)
- [CVE-2024-2907](https://cve.now/CVE-2024-2907.md): AGCA – Custom Dashboard & Login Page \< 7.2.2 - Admin+ Stored XSS via Image URL (CVSS 6.8, AGCA)
- [CVE-2024-4161](https://cve.now/CVE-2024-4161.md): Syslog traffic sent in clear-text (CVSS 8.6, Brocade SANnav)
- [CVE-2024-4159](https://cve.now/CVE-2024-4159.md): Protection mechanisms (CVSS 4.3, Brocade SANnav)
- [CVE-2024-29660](https://cve.now/CVE-2024-29660.md): Cross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselec (CVSS 5.3)
- [CVE-2024-30890](https://cve.now/CVE-2024-30890.md): Cross Site Scripting vulnerability in ED01-CMS v.1.0 allows an attacker to obtain sensitive information via the categories.php component. (CVSS 4.7)
- [CVE-2024-30939](https://cve.now/CVE-2024-30939.md): An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attacker to gain control (CVSS 6.8)
- [CVE-2024-31574](https://cve.now/CVE-2024-31574.md): Cross Site Scripting vulnerability in TWCMS v.2.6 allows a local attacker to execute arbitrary code via a crafted script (CVSS 5.0)
- [CVE-2024-31609](https://cve.now/CVE-2024-31609.md): Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields (CVSS 7.1)
- [CVE-2024-31610](https://cve.now/CVE-2024-31610.md): File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management System v1.0 allows attac (CVSS 6.3)
- [CVE-2024-31615](https://cve.now/CVE-2024-31615.md): ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php. (CVSS 9.8)
- [CVE-2024-32236](https://cve.now/CVE-2024-32236.md): An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php compo (CVSS 3.5)
- [CVE-2024-32324](https://cve.now/CVE-2024-32324.md): Buffer Overflow vulnerability in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v.3.2 allows a local attacker to execute arbitrary code (CVSS 7.8)
- [CVE-2024-32358](https://cve.now/CVE-2024-32358.md): An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a (CVSS 7.5)
- [CVE-2024-33247](https://cve.now/CVE-2024-33247.md): Sourcecodester Employee Task Management System v1.0 is vulnerable to SQL Injection via admin-manage-user.php. (CVSS 8.8)
- [CVE-2024-33661](https://cve.now/CVE-2024-33661.md): Portainer before 2.20.0 allows redirects when the target is not index.yaml. (CVSS 9.1)
- [CVE-2024-33663](https://cve.now/CVE-2024-33663.md): python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. (CVSS 6.5, python-jose)
- [CVE-2024-33664](https://cve.now/CVE-2024-33664.md): python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryp (CVSS 5.3, python-jose)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.