# CVEs published 2024-05-04

17 CVEs were published on May 4, 2024: 1 critical, 5 high. Days are UTC.

- [CVE-2024-4491](https://cve.now/CVE-2024-4491.md): Tenda i21 formGetDiagnoseInfo stack-based overflow (CVSS 8.8, Tenda i21)
- [CVE-2023-27283](https://cve.now/CVE-2023-27283.md): IBM Aspera Orchestrator information disclosure (CVSS 5.3, IBM Aspera Orchestrator)
- [CVE-2024-1050](https://cve.now/CVE-2024-1050.md): Import and export users and customers \<= 1.26.5 - Missing Authorization (CVSS 4.3, carazo Import and export users and customers)
- [CVE-2023-7065](https://cve.now/CVE-2023-7065.md): Stop Spammers Security | Block Spam Users, Comments, Forms \<= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs\_process (CVSS 5.4, webguyio Stop Spammers Classic)
- [CVE-2024-3240](https://cve.now/CVE-2024-3240.md): ConvertPlug \<= 3.5.25 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, Brainstorm Force ConvertPlus)
- [CVE-2024-3237](https://cve.now/CVE-2024-3237.md): ConvertPlug \<= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update (CVSS 5.4, Brainstorm Force ConvertPlus)
- [CVE-2024-3868](https://cve.now/CVE-2024-3868.md): Folders Pro \<= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name (CVSS 5.4, premio Folders – Unlimited Folders to Organize Media Librar…)
- [CVE-2023-52729](https://cve.now/CVE-2023-52729.md): TCPServer.cpp in SimpleNetwork through 29bc615 has an off-by-one error that causes a buffer overflow when trying to add '\\0' to the end of l (CVSS 7.5)
- [CVE-2024-34460](https://cve.now/CVE-2024-34460.md): The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (CVSS 6.5, tribalsystems/zenario)
- [CVE-2024-34461](https://cve.now/CVE-2024-34461.md): Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code (CVSS 9.8, tribalsystems/zenario)
- [CVE-2024-34462](https://cve.now/CVE-2024-34462.md): Alinto SOGo through 5.10.0 allows XSS during attachment preview. (CVSS 6.1)
- [CVE-2024-34467](https://cve.now/CVE-2024-34467.md): ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think\_exception.tpl. (CVSS 6.1, topthink/framework)
- [CVE-2024-34468](https://cve.now/CVE-2024-34468.md): Rukovoditel before 3.5.3 allows XSS via user\_photo to My Page. (CVSS 6.1)
- [CVE-2024-34469](https://cve.now/CVE-2024-34469.md): Rukovoditel before 3.5.3 allows XSS via user\_photo to index.php?module=users/registration&action=save. (CVSS 7.1)
- [CVE-2024-34473](https://cve.now/CVE-2024-34473.md): An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. (CVSS 5.3)
- [CVE-2024-34475](https://cve.now/CVE-2024-34475.md): Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm\_state\_authentication (CVSS 7.5)
- [CVE-2024-34476](https://cve.now/CVE-2024-34476.md): Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs\_nas\_encrypt in lib/n (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.