# CVEs published 2024-04-26

138 CVEs were published on April 26, 2024: 15 critical, 40 high. Days are UTC.

- [CVE-2024-4244](https://cve.now/CVE-2024-4244.md): Tenda W9 DhcpSetSer fromDhcpSetSer stack-based overflow (CVSS 8.8, Tenda W9)
- [CVE-2024-4243](https://cve.now/CVE-2024-4243.md): Tenda W9 wifiSSIDset formwrlSSIDset stack-based overflow (CVSS 8.8, Tenda W9)
- [CVE-2024-3052](https://cve.now/CVE-2024-3052.md): Z/IP Gateway S2 Nonce Get Denial of Service Vulnerability (CVSS 7.5, silabs.com Z/IP Gateway SDK)
- [CVE-2024-3051](https://cve.now/CVE-2024-3051.md): Z/IP Gateway Device Reset Locally Denial of Service Vulnerability (CVSS 7.5, silabs.com Z/IP Gateway SDK)
- [CVE-2024-32883](https://cve.now/CVE-2024-32883.md): MCUboot Injection attack of unprotected TLV values (CVSS 7.7, mcu-tools mcuboot · github.com/mcu-tools/mcuboot)
- [CVE-2024-32887](https://cve.now/CVE-2024-32887.md): Reflected XSS in sidekiq (CVSS 5.5, sidekiq)
- [CVE-2024-4242](https://cve.now/CVE-2024-4242.md): Tenda W9 wifiSSIDget formwrlSSIDget stack-based overflow (CVSS 8.8, Tenda W9)
- [CVE-2024-4241](https://cve.now/CVE-2024-4241.md): Tenda W9 formQosManageDouble\_auto stack-based overflow (CVSS 8.8, Tenda W9)
- [CVE-2024-32881](https://cve.now/CVE-2024-32881.md): Unauthorized access to GET/SET of Slack Bot Tokens in Danswer (CVSS 9.8, danswer-ai danswer)
- [CVE-2024-32878](https://cve.now/CVE-2024-32878.md): Use of Uninitialized Variable Vulnerability in llama.cpp (CVSS 7.1, ggerganov llama.cpp)
- [CVE-2024-4240](https://cve.now/CVE-2024-4240.md): Tenda W9 formQosManageDouble\_user stack-based overflow (CVSS 8.8, Tenda W9)
- [CVE-2024-4239](https://cve.now/CVE-2024-4239.md): Tenda AX1806 SetRebootTimer formSetRebootTimer stack-based overflow (CVSS 8.8, Tenda AX1806)
- [CVE-2024-4238](https://cve.now/CVE-2024-4238.md): Tenda AX1806 SetOnlineDevName formSetDeviceName stack-based overflow (CVSS 8.8, Tenda AX1806)
- [CVE-2022-48611](https://cve.now/CVE-2022-48611.md): A logic issue was addressed with improved checks. (CVSS 7.8, Apple iTunes for Windows)
- [CVE-2024-4237](https://cve.now/CVE-2024-4237.md): Tenda AX1806 execCommand R7WebsSecurityHandler stack-based overflow (CVSS 8.8, Tenda AX1806)
- [CVE-2024-32884](https://cve.now/CVE-2024-32884.md): gix-transport indirect code execution via malicious username (CVSS 6.4, Byron gitoxide · gix-transport +2)
- [CVE-2024-4236](https://cve.now/CVE-2024-4236.md): Tenda AX1803 SetDDNSCfg formSetSysToolDDNS stack-based overflow (CVSS 8.8, Tenda AX1803)
- [CVE-2024-4235](https://cve.now/CVE-2024-4235.md): Netgear DG834Gv5 Web Management Interface cleartext storage (CVSS 2.7, Netgear DG834Gv5)
- [CVE-2024-32880](https://cve.now/CVE-2024-32880.md): pyLoad allows upload to arbitrary folder lead to RCE (CVSS 9.1, pyload · pyload-ng)
- [CVE-2024-32730](https://cve.now/CVE-2024-32730.md): Missing authorization check in SAP Enable Now Manager (CVSS 6.5, SAP\_SE SAP Enable Now)
- [CVE-2024-27790](https://cve.now/CVE-2024-27790.md): Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases hosted on FileMaker Se (CVSS 7.5, Claris FileMaker Server)
- [CVE-2023-42955](https://cve.now/CVE-2023-42955.md): Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to (CVSS 6.1, Claris FileMaker Server)
- [CVE-2024-32476](https://cve.now/CVE-2024-32476.md): Denial of Service via malicious jqPathExpressions in ignoreDifferences (CVSS 6.5, argoproj argo-cd · github.com/argoproj/argo-cd/v2 +1)
- [CVE-2023-41290](https://cve.now/CVE-2023-41290.md): QuFirewall (CVSS 4.1, QNAP Systems QuFirewall)
- [CVE-2023-41291](https://cve.now/CVE-2023-41291.md): QuFirewall (CVSS 5.5, QNAP Systems QuFirewall)
- [CVE-2023-47222](https://cve.now/CVE-2023-47222.md): Media Streaming add-on (CVSS 9.6, QNAP Systems Media Streaming add-on)
- [CVE-2023-50361](https://cve.now/CVE-2023-50361.md): QTS, QuTS hero (CVSS 5.0, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-50362](https://cve.now/CVE-2023-50362.md): QTS, QuTS hero (CVSS 5.0, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-50363](https://cve.now/CVE-2023-50363.md): QTS, QuTS hero (CVSS 7.4, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-50364](https://cve.now/CVE-2023-50364.md): QTS, QuTS hero (CVSS 6.4, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-51364](https://cve.now/CVE-2023-51364.md): QTS, QuTS hero, QuTScloud (CVSS 8.7, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-51365](https://cve.now/CVE-2023-51365.md): QTS, QuTS hero, QuTScloud (CVSS 8.7, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2024-21905](https://cve.now/CVE-2024-21905.md): QTS, QuTS hero, QuTScloud (CVSS 6.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2024-27124](https://cve.now/CVE-2024-27124.md): QTS, QuTS hero, QuTScloud (CVSS 7.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2024-32764](https://cve.now/CVE-2024-32764.md): myQNAPcloud Link (CVSS 9.9, QNAP Systems myQNAPcloud Link)
- [CVE-2024-32766](https://cve.now/CVE-2024-32766.md): QTS, QuTS hero, QuTScloud (CVSS 10.0, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2022-40975](https://cve.now/CVE-2022-40975.md): WordPress Post Slider plugin \<= 1.6.7 - Broken Access Control vulnerability (CVSS 5.4, Aazztech Post Slider)
- [CVE-2024-3076](https://cve.now/CVE-2024-3076.md): MM-email2image \<= 0.2.5 - Stored XSS via CSRF (CVSS 3.8, MM-email2image)
- [CVE-2024-4234](https://cve.now/CVE-2024-4234.md): WordPress Filterable Portfolio plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Sayful Islam Filterable Portfolio)
- [CVE-2024-33688](https://cve.now/CVE-2024-33688.md): WordPress Teluro theme \<= 1.0.31 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Extend Themes Teluro)
- [CVE-2024-33689](https://cve.now/CVE-2024-33689.md): WordPress Radio Station plugin \<= 2.5.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tony Zeoli Radio Station)
- [CVE-2024-33690](https://cve.now/CVE-2024-33690.md): WordPress Financio theme \<= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Jegstudio Financio)
- [CVE-2024-33691](https://cve.now/CVE-2024-33691.md): WordPress Popup Builder by OptinMonster plugin \<= 2.15.3 - Cross Site Request Forgery (CSRF) Notice Dismissal vulnerability (CVSS 4.3, OptinMonster Popup Builder Team OptinMonster)
- [CVE-2024-33692](https://cve.now/CVE-2024-33692.md): WordPress Smart Recent Posts Widget plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Satrya Smart Recent Posts Widget)
- [CVE-2024-33693](https://cve.now/CVE-2024-33693.md): WordPress Meks Smart Social Widget plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Meks Smart Social Widget)
- [CVE-2024-33694](https://cve.now/CVE-2024-33694.md): WordPress Meks ThemeForest Smart Widget plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Meks ThemeForest Smart Widget)
- [CVE-2024-33695](https://cve.now/CVE-2024-33695.md): WordPress Fan Page Widget by ThemeNcode plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Fan Page Widget by ThemeNcode)
- [CVE-2024-33696](https://cve.now/CVE-2024-33696.md): WordPress WordPress Ad Widget plugin \<= 2.20.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Broadstreet XPRESS WordPress Ad Widget)
- [CVE-2024-33697](https://cve.now/CVE-2024-33697.md): WordPress CF7 File Download plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Rimes Gold CF7 File Download – File Download for CF7)
- [CVE-2023-52646](https://cve.now/CVE-2023-52646.md): aio: fix mremap after fork null-deref (no CVSS, Linux)
- [CVE-2024-32822](https://cve.now/CVE-2024-32822.md): WordPress Reviews Plus plugin \<= 1.3.4 - Broken Access Control vulnerability (CVSS 4.3, impleCode Reviews Plus)
- [CVE-2024-32826](https://cve.now/CVE-2024-32826.md): WordPress VK Block Patterns plugin \<= 1.31.0 - Broken Access Control vulnerability (CVSS 5.3, Vektor VK Block Patterns)
- [CVE-2024-32828](https://cve.now/CVE-2024-32828.md): WordPress Table Rate Shipping Method for WooCommerce by Flexible Shipping plugin \<= 4.24.15 - Broken Access Control vulnerability (CVSS 4.3, Octolize Flexible Shipping)
- [CVE-2024-32829](https://cve.now/CVE-2024-32829.md): WordPress Data Tables Generator by Supsystic plugin \<= 1.10.31 - Broken Access Control vulnerability (CVSS 4.3, Data Tables Generator by Supsystic)
- [CVE-2024-32957](https://cve.now/CVE-2024-32957.md): WordPress Page Builder: Live Composer plugin \<= 1.5.38 - Broken Access Control vulnerability (CVSS 4.7, Live Composer Team Page Builder: Live Composer)
- [CVE-2024-33677](https://cve.now/CVE-2024-33677.md): WordPress Contact Form 7 Extension For Mailchimp plugin \<= 0.5.70 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Renzo Johnson Contact Form 7 Extension For Mailchimp)
- [CVE-2024-33678](https://cve.now/CVE-2024-33678.md): WordPress ClickCease Click Fraud Protection plugin \<= 3.2.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, eranfl ClickCease Click Fraud Protection)
- [CVE-2024-33679](https://cve.now/CVE-2024-33679.md): WordPress FameTheme Demo Importer plugin \<= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, FameThemes FameTheme Demo Importer)
- [CVE-2024-33680](https://cve.now/CVE-2024-33680.md): WordPress MainWP Child Reports plugin \<= 2.1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, MainWP Child Reports)
- [CVE-2024-33682](https://cve.now/CVE-2024-33682.md): WordPress WP GDPR Compliance plugin \<= 2.0.23 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Cookie Information A/S WP GDPR Compliance)
- [CVE-2024-33683](https://cve.now/CVE-2024-33683.md): WordPress Hide Dashboard Notifications plugin \<= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WP Republic Hide Dashboard Notifications)
- [CVE-2024-0740](https://cve.now/CVE-2024-0740.md): Eclipse Target Management \<= 4.5.500 Command Injection (CVSS 9.8, Eclipse Foundation Eclipse Target Management)
- [CVE-2024-3682](https://cve.now/CVE-2024-3682.md): WP STAGING \<= 3.4.3 and WP STAGING Pro \<= 5.4.3 - Sensitive Information Exposure via Log File (CVSS 5.3, renehermi WP STAGING – WordPress Backup, Restore & Migratio…)
- [CVE-2024-1789](https://cve.now/CVE-2024-1789.md): The WP SMTP plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in versions 1.2 to 1.2.6 due to insufficient esca (CVSS 7.2, jack-kitterhing WP SMTP)
- [CVE-2024-3962](https://cve.now/CVE-2024-3962.md): Product Addons & Fields for WooCommerce \<= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom\_upload\_file (CVSS 9.8, themeisle PPOM – Product Addons & Custom Fields for WooComm…)
- [CVE-2024-4198](https://cve.now/CVE-2024-4198.md): Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenti (CVSS 2.7, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2024-4195](https://cve.now/CVE-2024-4195.md): Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authent (CVSS 2.7, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2024-4183](https://cve.now/CVE-2024-4183.md): Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessi (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2024-4182](https://cve.now/CVE-2024-4182.md): Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom stat (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2024-32046](https://cve.now/CVE-2024-32046.md): Detailed error discloses full file path with dev mode off (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2024-22091](https://cve.now/CVE-2024-22091.md): Excessive resource consumption due to lack to request path size limits (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2024-2920](https://cve.now/CVE-2024-2920.md): WP-Members Membership Plugin \<= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files (CVSS 5.3, cbutlerjr WP-Members Membership Plugin)
- [CVE-2024-3678](https://cve.now/CVE-2024-3678.md): Blog2Social: Social Media Auto Post & Scheduler \<= 7.4.2 - Information Exposure (CVSS 5.3, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2024-3890](https://cve.now/CVE-2024-3890.md): Happy Addons for Elementor \<= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2023-6116](https://cve.now/CVE-2023-6116.md): Remote Code Execution without authentication using stack overflow (CVSS 8.9, Hanwha Vision Co. XRN-420S)
- [CVE-2024-33642](https://cve.now/CVE-2024-33642.md): WordPress Advanced Post List plugin \<= 0.5.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, EkoJR Advanced Post List)
- [CVE-2024-33639](https://cve.now/CVE-2024-33639.md): WordPress PopupAlly plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, AccessAlly PopupAlly)
- [CVE-2024-33598](https://cve.now/CVE-2024-33598.md): WordPress Annual Archive plugin \<= 1.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Twinpictures Annual Archive)
- [CVE-2023-6096](https://cve.now/CVE-2023-6096.md): using a inappropriate encryption logic (CVSS 7.4, Hanwha Vision Co. HRX-1620)
- [CVE-2024-33638](https://cve.now/CVE-2024-33638.md): WordPress Smart Maintenance Mode plugin \<= 1.4.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Brijesh Kothari Smart Maintenance Mode)
- [CVE-2024-33650](https://cve.now/CVE-2024-33650.md): WordPress Serious Slider plugin \<= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Cryout Creations Serious Slider)
- [CVE-2024-33651](https://cve.now/CVE-2024-33651.md): WordPress MF Gig Calendar plugin \<= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Matthew Fries MF Gig Calendar)
- [CVE-2023-6095](https://cve.now/CVE-2023-6095.md): Remote Code Execution without authentication using memory overflow (CVSS 8.9, Hanwha Vision Co. HRX-1620)
- [CVE-2024-4056](https://cve.now/CVE-2024-4056.md): Denial of service condition in M-Files Server (CVSS 7.5, M-Files Server)
- [CVE-2024-3188](https://cve.now/CVE-2024-3188.md): Shortcodes Ultimate \< 7.1.0 - Contributor+ Stored XSS (CVSS 6.3, WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2024-3075](https://cve.now/CVE-2024-3075.md): MM-email2image \<= 0.2.5 - Contributor+ Stored XSS (CVSS 8.1, MM-email2image)
- [CVE-2024-3060](https://cve.now/CVE-2024-3060.md): ENL Newsletter \<= 1.0.1 - Admin+ SQL Injection (CVSS 4.5, ENL Newsletter)
- [CVE-2024-3059](https://cve.now/CVE-2024-3059.md): ENL Newsletter \<= 1.0.1 - Campaign Deletion via CSRF (CVSS 5.7, ENL Newsletter)
- [CVE-2024-3058](https://cve.now/CVE-2024-3058.md): ENL Newsletter \<= 1.0.1 - Stored XSS via CSRF (CVSS 5.4, ENL Newsletter)
- [CVE-2024-3048](https://cve.now/CVE-2024-3048.md): Bannerlid \<= 1.1.0 - Reflected XSS (CVSS 5.5, Bannerlid)
- [CVE-2024-2908](https://cve.now/CVE-2024-2908.md): Call Now Button \< 1.4.7 - Admin+ Stored XSS (CVSS 4.3, Call Now Button)
- [CVE-2024-2837](https://cve.now/CVE-2024-2837.md): WP Chat App \< 3.6.4 - Admin+ Stored XSS (CVSS 5.4, WP Chat App)
- [CVE-2024-2603](https://cve.now/CVE-2024-2603.md): Salon booking system \<= 9.6.5 - Editor+ Stored XSS via Email Settings (CVSS 6.3, Salon booking system)
- [CVE-2024-2439](https://cve.now/CVE-2024-2439.md): Salon booking system \<= 9.6.5 - Editor+ Stored XSS (CVSS 4.8, Salon booking system)
- [CVE-2024-2429](https://cve.now/CVE-2024-2429.md): Salon booking system \<= 9.6.5 - Settings Update via CSRF (CVSS 4.3, Salon booking system)
- [CVE-2024-2310](https://cve.now/CVE-2024-2310.md): WP Google Review Slider \< 13.6 - Admin+ Stored XSS (CVSS 5.9, WP Google Review Slider)
- [CVE-2024-2159](https://cve.now/CVE-2024-2159.md): Sassy Social Share \< 3.3.61 - Contributor+ Stored XSS (CVSS 4.7, Social Sharing Plugin)
- [CVE-2024-0905](https://cve.now/CVE-2024-0905.md): Fancy Product Designer \< 6.1.8 - Reflected Cross Site Scripting (CVSS 6.3, Fancy Product Designer)
- [CVE-2024-3154](https://cve.now/CVE-2024-3154.md): Cri-o: arbitrary command injection via pod annotation (CVSS 7.2, cri-o · Red Hat OpenShift Container Platform +1)
- [CVE-2024-4163](https://cve.now/CVE-2024-4163.md): Privilege Escalation on Skylab IIoT Gateway (IGX) (CVSS 8.0, Skylab IIoT Gateway)
- [CVE-2022-48682](https://cve.now/CVE-2022-48682.md): In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink. (CVSS 6.0)
- [CVE-2023-26603](https://cve.now/CVE-2023-26603.md): JumpCloud Agent before 1.178.0 Creates a Temporary File in a Directory with Insecure Permissions. (CVSS 5.9)
- [CVE-2023-47252](https://cve.now/CVE-2023-47252.md): An issue was discovered in PnpSmm in Insyde InsydeH2O with kernel 5.0 through 5.6. (CVSS 6.3)
- [CVE-2023-51794](https://cve.now/CVE-2023-51794.md): Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/af\_stere (CVSS 7.8)
- [CVE-2024-22632](https://cve.now/CVE-2024-22632.md): Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability v (CVSS 9.8)
- [CVE-2024-22633](https://cve.now/CVE-2024-22633.md): Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability v (CVSS 9.8)
- [CVE-2024-25343](https://cve.now/CVE-2024-25343.md): Tenda N300 F3 router vulnerability allows users to bypass intended security policy and create weak passwords. (CVSS 9.1)
- [CVE-2024-28322](https://cve.now/CVE-2024-28322.md): SQL Injection vulnerability in /event-management-master/backend/register.php in PuneethReddyHC Event Management 1.0 allows attackers to run (CVSS 9.8)
- [CVE-2024-28325](https://cve.now/CVE-2024-28325.md): Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router se (CVSS 6.1)
- [CVE-2024-28326](https://cve.now/CVE-2024-28326.md): Incorrect Access Control in ASUS RT-N12+ B1 and RT-N12 D1 routers allows local attackers to obtain root terminal access via the the UART int (CVSS 6.8)
- [CVE-2024-28327](https://cve.now/CVE-2024-28327.md): Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to obtain unauthorized access and modify router (CVSS 8.4)
- [CVE-2024-28328](https://cve.now/CVE-2024-28328.md): CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client nam (CVSS 5.4)
- [CVE-2024-30804](https://cve.now/CVE-2024-30804.md): An issue discovered in the DeviceIoControl component in ASUS Fan\_Xpert before v.10013 allows an attacker to execute arbitrary code via craft (CVSS 9.8)
- [CVE-2024-31502](https://cve.now/CVE-2024-31502.md): An issue in Insurance Management System v.1.0.0 and before allows a remote attacker to escalate privileges via a crafted POST request to /ad (CVSS 8.1)
- [CVE-2024-31551](https://cve.now/CVE-2024-31551.md): Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via c (CVSS 7.5)
- [CVE-2024-31601](https://cve.now/CVE-2024-31601.md): An issue in Beijing Panabit Network Software Co., Ltd Panalog big data analysis platform v. (CVSS 9.8)
- [CVE-2024-31741](https://cve.now/CVE-2024-31741.md): Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after logi (CVSS 6.1)
- [CVE-2024-31755](https://cve.now/CVE-2024-31755.md): cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSON\_SetValues (CVSS 7.6)
- [CVE-2024-31828](https://cve.now/CVE-2024-31828.md): Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via (CVSS 6.1, lavalite/cms)
- [CVE-2024-32404](https://cve.now/CVE-2024-32404.md): Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1, allows remote attackers to execute arbitrary code via (CVSS 6.0)
- [CVE-2024-32406](https://cve.now/CVE-2024-32406.md): Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via (CVSS 7.5)
- [CVE-2024-33255](https://cve.now/CVE-2024-33255.md): Jerryscript commit cefd391 was discovered to contain an Assertion Failure via ECMA\_STRING\_IS\_REF\_EQUALS\_TO\_ONE (string\_p) in ecma\_free\_strin (CVSS 6.2)
- [CVE-2024-33258](https://cve.now/CVE-2024-33258.md): Jerryscript commit ff9ff8f was discovered to contain a segmentation violation via the component vm\_loop at jerry-core/vm/vm.c. (CVSS 7.1)
- [CVE-2024-33259](https://cve.now/CVE-2024-33259.md): Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component scanner\_seek at jerry-core/parser/js/js-scan (CVSS 5.5)
- [CVE-2024-33260](https://cve.now/CVE-2024-33260.md): Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component parser\_parse\_class at jerry-core/parser/js/j (CVSS 5.1)
- [CVE-2024-33263](https://cve.now/CVE-2024-33263.md): QuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JS\_FreeRuntime(JSRuntime \*) at quickjs.c. (CVSS 4.0)
- [CVE-2024-33342](https://cve.now/CVE-2024-33342.md): D-Link DIR-822+ V1.0.5 was found to contain a command injection in SetPlcNetworkpwd function of prog.cgi, which allows remote attackers to e (CVSS 7.5)
- [CVE-2024-33343](https://cve.now/CVE-2024-33343.md): D-Link DIR-822+ V1.0.5 was found to contain a command injection in ChgSambaUserSettings function of prog.cgi, which allows remote attackers (CVSS 8.8)
- [CVE-2024-33344](https://cve.now/CVE-2024-33344.md): D-Link DIR-822+ V1.0.5 was found to contain a command injection in ftext function of upload\_firmware.cgi, which allows remote attackers to e (CVSS 9.8)
- [CVE-2024-33665](https://cve.now/CVE-2024-33665.md): angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. (CVSS 6.1)
- [CVE-2024-33666](https://cve.now/CVE-2024-33666.md): An issue was discovered in Zammad before 6.3.0. (CVSS 8.6)
- [CVE-2024-33667](https://cve.now/CVE-2024-33667.md): An issue was discovered in Zammad before 6.3.0. (CVSS 6.5)
- [CVE-2024-33668](https://cve.now/CVE-2024-33668.md): An issue was discovered in Zammad before 6.3.0. (CVSS 9.1)
- [CVE-2024-33669](https://cve.now/CVE-2024-33669.md): An issue was discovered in Passbolt Browser Extension before 4.6.2. (CVSS 6.1, passbolt-browser-extension)
- [CVE-2024-33670](https://cve.now/CVE-2024-33670.md): Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the craft (CVSS 4.3, passbolt/passbolt\_api)
- [CVE-2024-33671](https://cve.now/CVE-2024-33671.md): An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. (CVSS 7.7)
- [CVE-2024-33672](https://cve.now/CVE-2024-33672.md): An issue was discovered in Veritas NetBackup before 10.4. (CVSS 7.7)
- [CVE-2024-33673](https://cve.now/CVE-2024-33673.md): An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.