CVEs published May 5, 2024
37 CVEs were published on May 5, 2024: 2 critical, 19 high.
- Published
- 37
- Critical
- 2
- High
- 19
- Medium
- 16
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Ruijie RG-UAC
- 7
- ryu
- 6
- Tenda i21
- 6
- github.com/btcsuite/btcd
- 1
- gradio
- 1
- nebari
- 1
- samwilson/unlinked-wikibase
- 1
- SourceCodester Prison Management System
- 1
- spatie/image-optimizer
- 1
- wordops
- 1
Critical 2
High 19
- CVE-2024-4497Tenda i21 formexeCommand stack-based overflowTenda i21
- CVE-2024-4496Tenda i21 formWifiMacFilterSet stack-based overflowTenda i21
- CVE-2024-4495Tenda i21 formWifiMacFilterGet stack-based overflowTenda i21
- CVE-2024-4494Tenda i21 setUplinkInfo formSetUplinkInfo stack-based overflowTenda i21
- CVE-2024-4493Tenda i21 formSetAutoPing stack-based overflowTenda i21
- CVE-2024-4492Tenda i21 setStaOffline formOfflineSet stack-based overflowTenda i21
- CVE-2024-34474Clario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there as SYSTEM.
- CVE-2024-34478btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failugithub.com/btcsuite/btcd
- CVE-2024-34483OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPBucket.len=0.ryu
- CVE-2024-34486OFPPacketQueue in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPQueueProp.len=0.ryu
- CVE-2024-34487OFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0.ryu
- CVE-2024-34488OFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0.ryu
- CVE-2024-34489OFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0.ryu
- CVE-2024-34506An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1.
- CVE-2024-34507An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1
- CVE-2024-34510Gradio before 4.20 allows credential leakage on Windows.gradio
- CVE-2024-34515image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists().spatie/image-optimizer
- CVE-2024-34527spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key.
- CVE-2024-34528WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter wordops
Medium, low and unrated 16
- CVE-2024-4507Ruijie RG-UAC static_route_add_ipv6.php os command injectionRuijie RG-UAC
- CVE-2024-4506Ruijie RG-UAC ip_addr_edit_commit.php os command injectionRuijie RG-UAC
- CVE-2024-4505Ruijie RG-UAC ip_addr_add_commit.php os command injectionRuijie RG-UAC
- CVE-2024-4504Ruijie RG-UAC commit.php os command injectionRuijie RG-UAC
- CVE-2024-4503Ruijie RG-UAC dhcp_relay_commit.php os command injectionRuijie RG-UAC
- CVE-2024-4502Ruijie RG-UAC dhcp_client_commit.php os command injectionRuijie RG-UAC
- CVE-2024-4501Ruijie RG-UAC commit.php os command injectionRuijie RG-UAC
- CVE-2024-4500SourceCodester Prison Management System edit-photo.php unrestricted uploadSourceCodester Prison Management System
- CVE-2024-34484OFPBucket in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via action.len=0.ryu
- CVE-2024-34490In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp.
- CVE-2024-34500An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1.samwilson/unlinked-wikibase
- CVE-2024-34508dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
- CVE-2024-34509dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
- CVE-2024-34519Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367.
- CVE-2024-34525FileCodeBox 2.0 stores a OneDrive password and AWS key in a cleartext env file.
- CVE-2024-34529Nebari through 2024.4.1 prints the temporary Keycloak root password.nebari