# CVEs published 2024-05-05 37 CVEs were published on May 5, 2024: 2 critical, 19 high. Days are UTC. - [CVE-2024-4507](https://cve.now/CVE-2024-4507.md): Ruijie RG-UAC static\_route\_add\_ipv6.php os command injection (CVSS 4.7, Ruijie RG-UAC) - [CVE-2024-4506](https://cve.now/CVE-2024-4506.md): Ruijie RG-UAC ip\_addr\_edit\_commit.php os command injection (CVSS 4.7, Ruijie RG-UAC) - [CVE-2024-4505](https://cve.now/CVE-2024-4505.md): Ruijie RG-UAC ip\_addr\_add\_commit.php os command injection (CVSS 4.7, Ruijie RG-UAC) - [CVE-2024-4504](https://cve.now/CVE-2024-4504.md): Ruijie RG-UAC commit.php os command injection (CVSS 4.7, Ruijie RG-UAC) - [CVE-2024-4503](https://cve.now/CVE-2024-4503.md): Ruijie RG-UAC dhcp\_relay\_commit.php os command injection (CVSS 4.7, Ruijie RG-UAC) - [CVE-2024-4502](https://cve.now/CVE-2024-4502.md): Ruijie RG-UAC dhcp\_client\_commit.php os command injection (CVSS 4.7, Ruijie RG-UAC) - [CVE-2024-4501](https://cve.now/CVE-2024-4501.md): Ruijie RG-UAC commit.php os command injection (CVSS 4.7, Ruijie RG-UAC) - [CVE-2024-4500](https://cve.now/CVE-2024-4500.md): SourceCodester Prison Management System edit-photo.php unrestricted upload (CVSS 6.3, SourceCodester Prison Management System) - [CVE-2024-4497](https://cve.now/CVE-2024-4497.md): Tenda i21 formexeCommand stack-based overflow (CVSS 8.8, Tenda i21) - [CVE-2024-4496](https://cve.now/CVE-2024-4496.md): Tenda i21 formWifiMacFilterSet stack-based overflow (CVSS 8.8, Tenda i21) - [CVE-2024-4495](https://cve.now/CVE-2024-4495.md): Tenda i21 formWifiMacFilterGet stack-based overflow (CVSS 8.8, Tenda i21) - [CVE-2024-4494](https://cve.now/CVE-2024-4494.md): Tenda i21 setUplinkInfo formSetUplinkInfo stack-based overflow (CVSS 8.8, Tenda i21) - [CVE-2024-4493](https://cve.now/CVE-2024-4493.md): Tenda i21 formSetAutoPing stack-based overflow (CVSS 8.8, Tenda i21) - [CVE-2024-4492](https://cve.now/CVE-2024-4492.md): Tenda i21 setStaOffline formOfflineSet stack-based overflow (CVSS 8.8, Tenda i21) - [CVE-2024-34474](https://cve.now/CVE-2024-34474.md): Clario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\\Clario and tries to load DLLs from there as SYSTEM. (CVSS 7.8) - [CVE-2024-34478](https://cve.now/CVE-2024-34478.md): btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failu (CVSS 7.5, github.com/btcsuite/btcd) - [CVE-2024-34483](https://cve.now/CVE-2024-34483.md): OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPBucket.len=0. (CVSS 7.5, ryu) - [CVE-2024-34484](https://cve.now/CVE-2024-34484.md): OFPBucket in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via action.len=0. (CVSS 5.3, ryu) - [CVE-2024-34486](https://cve.now/CVE-2024-34486.md): OFPPacketQueue in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPQueueProp.len=0. (CVSS 7.5, ryu) - [CVE-2024-34487](https://cve.now/CVE-2024-34487.md): OFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0. (CVSS 7.5, ryu) - [CVE-2024-34488](https://cve.now/CVE-2024-34488.md): OFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0. (CVSS 7.5, ryu) - [CVE-2024-34489](https://cve.now/CVE-2024-34489.md): OFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0. (CVSS 7.5, ryu) - [CVE-2024-34490](https://cve.now/CVE-2024-34490.md): In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. (CVSS 5.1) - [CVE-2024-34500](https://cve.now/CVE-2024-34500.md): An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. (CVSS 6.1, samwilson/unlinked-wikibase) - [CVE-2024-34502](https://cve.now/CVE-2024-34502.md): An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. (CVSS 9.8) - [CVE-2024-34506](https://cve.now/CVE-2024-34506.md): An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. (CVSS 7.5) - [CVE-2024-34507](https://cve.now/CVE-2024-34507.md): An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1 (CVSS 7.4) - [CVE-2024-34508](https://cve.now/CVE-2024-34508.md): dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. (CVSS 4.3) - [CVE-2024-34509](https://cve.now/CVE-2024-34509.md): dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. (CVSS 5.3) - [CVE-2024-34510](https://cve.now/CVE-2024-34510.md): Gradio before 4.20 allows credential leakage on Windows. (CVSS 7.5, gradio) - [CVE-2024-34515](https://cve.now/CVE-2024-34515.md): image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file\_exists(). (CVSS 8.8, spatie/image-optimizer) - [CVE-2024-34519](https://cve.now/CVE-2024-34519.md): Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367. (CVSS 6.8) - [CVE-2024-34524](https://cve.now/CVE-2024-34524.md): In XLANG OpenAgents through fe73ac4, the allowed\_file protection mechanism can be bypassed by using an incorrect file extension for the natu (CVSS 9.1) - [CVE-2024-34525](https://cve.now/CVE-2024-34525.md): FileCodeBox 2.0 stores a OneDrive password and AWS key in a cleartext env file. (CVSS 5.3) - [CVE-2024-34527](https://cve.now/CVE-2024-34527.md): spaces\_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key. (CVSS 7.5) - [CVE-2024-34528](https://cve.now/CVE-2024-34528.md): WordOps through 3.20.0 has a wo/cli/plugins/stack\_pref.py TOCTOU race condition because the conf\_path os.open does not use a mode parameter (CVSS 7.7, wordops) - [CVE-2024-34529](https://cve.now/CVE-2024-34529.md): Nebari through 2024.4.1 prints the temporary Keycloak root password. (CVSS 4.8, nebari) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-05-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.