CVEs published May 4, 2024
17 CVEs were published on May 4, 2024: 1 critical, 5 high.
- Published
- 17
- Critical
- 1
- High
- 5
- Medium
- 11
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Brainstorm Force ConvertPlus
- 2
- tribalsystems/zenario
- 2
- carazo Import and export users and customers
- 1
- IBM Aspera Orchestrator
- 1
- premio Folders – Unlimited Folders to Organize Media Librar…
- 1
- Tenda i21
- 1
- topthink/framework
- 1
- webguyio Stop Spammers Classic
- 1
Critical 1
High 5
- CVE-2024-4491Tenda i21 formGetDiagnoseInfo stack-based overflowTenda i21
- CVE-2024-3240ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object InjectionBrainstorm Force ConvertPlus
- CVE-2023-52729TCPServer.cpp in SimpleNetwork through 29bc615 has an off-by-one error that causes a buffer overflow when trying to add '\0' to the end of l
- CVE-2024-34469Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.
- CVE-2024-34475Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm_state_authentication
Medium, low and unrated 11
- CVE-2023-27283IBM Aspera Orchestrator information disclosureIBM Aspera Orchestrator
- CVE-2024-1050Import and export users and customers <= 1.26.5 - Missing Authorizationcarazo Import and export users and customers
- CVE-2023-7065Stop Spammers Security | Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_processwebguyio Stop Spammers Classic
- CVE-2024-3237ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options UpdateBrainstorm Force ConvertPlus
- CVE-2024-3868Folders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Namepremio Folders – Unlimited Folders to Organize Media Librar…
- CVE-2024-34460The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS.tribalsystems/zenario
- CVE-2024-34462Alinto SOGo through 5.10.0 allows XSS during attachment preview.
- CVE-2024-34467ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.topthink/framework
- CVE-2024-34468Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.
- CVE-2024-34473An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release.
- CVE-2024-34476Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs_nas_encrypt in lib/n