# CVEs published 2024-05-07

186 CVEs were published on May 7, 2024: 21 critical, 76 high. Days are UTC.

- [CVE-2023-40490](https://cve.now/CVE-2023-40490.md): Maxon Cinema 4D SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Maxon Cinema)
- [CVE-2023-37325](https://cve.now/CVE-2023-37325.md): D-Link DAP-2622 DDP Set SSID List Missing Authentication Vulnerability (CVSS 5.4, D-Link DAP-2622)
- [CVE-2023-35757](https://cve.now/CVE-2023-35757.md): D-Link DAP-2622 DDP Set Date-Time NTP Server Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, D-Link DAP-2622)
- [CVE-2023-35749](https://cve.now/CVE-2023-35749.md): D-Link DAP-2622 DDP Firmware Upgrade Filename Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, D-Link DAP-2622)
- [CVE-2023-35748](https://cve.now/CVE-2023-35748.md): D-Link DAP-2622 DDP Firmware Upgrade Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, D-Link DAP-2622)
- [CVE-2023-27321](https://cve.now/CVE-2023-27321.md): OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability (CVSS 7.5, OPC Foundation UA .NET Standard · OPCFoundation.NetStandard…)
- [CVE-2022-43656](https://cve.now/CVE-2022-43656.md): Bentley View FBX File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Bentley View)
- [CVE-2022-43655](https://cve.now/CVE-2022-43655.md): Bentley View FBX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Bentley View)
- [CVE-2022-43654](https://cve.now/CVE-2022-43654.md): NETGEAR CAX30S SSO Command Injection Remote Code Execution Vulnerability (CVSS 8.8, NETGEAR CAX30S)
- [CVE-2022-43653](https://cve.now/CVE-2022-43653.md): Bentley View SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Bentley View)
- [CVE-2022-43652](https://cve.now/CVE-2022-43652.md): Bentley View SKP File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Bentley View)
- [CVE-2022-43651](https://cve.now/CVE-2022-43651.md): Bentley View SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Bentley View)
- [CVE-2022-0369](https://cve.now/CVE-2022-0369.md): Triangle MicroWorks SCADA Data Gateway Restore Workspace Directory Traversal Remote Code Execution Vulnerability (CVSS 7.2, Triangle MicroWorks SCADA Data Gateway)
- [CVE-2021-35002](https://cve.now/CVE-2021-35002.md): BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability (CVSS 8.8, BMC Track-It!)
- [CVE-2021-35001](https://cve.now/CVE-2021-35001.md): BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability (CVSS 3.1, BMC Track-It!)
- [CVE-2021-35000](https://cve.now/CVE-2021-35000.md): OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability (CVSS 3.3, OpenBSD Kernel)
- [CVE-2021-34999](https://cve.now/CVE-2021-34999.md): OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability (CVSS 3.8, OpenBSD Kernel)
- [CVE-2021-34983](https://cve.now/CVE-2021-34983.md): NETGEAR Multiple Routers httpd Missing Authentication for Critical Function Information Disclosure Vulnerability (CVSS 6.5, NETGEAR Multiple Routers)
- [CVE-2021-34982](https://cve.now/CVE-2021-34982.md): NETGEAR Multiple Routers httpd Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, NETGEAR Multiple Routers)
- [CVE-2021-34981](https://cve.now/CVE-2021-34981.md): Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability (CVSS 7.5, Linux Kernel)
- [CVE-2021-34976](https://cve.now/CVE-2021-34976.md): Foxit PDF Reader PDF File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34975](https://cve.now/CVE-2021-34975.md): Foxit PDF Reader transitionToState Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34974](https://cve.now/CVE-2021-34974.md): Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34973](https://cve.now/CVE-2021-34973.md): Foxit PDF Reader PDF File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34972](https://cve.now/CVE-2021-34972.md): Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34971](https://cve.now/CVE-2021-34971.md): Foxit PDF Reader JPG2000 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34970](https://cve.now/CVE-2021-34970.md): Foxit PDF Reader print Method Use of Externally-Controlled Format String Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34969](https://cve.now/CVE-2021-34969.md): Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34968](https://cve.now/CVE-2021-34968.md): Foxit PDF Editor transitionToState Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34967](https://cve.now/CVE-2021-34967.md): Foxit PDF Editor Line Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34966](https://cve.now/CVE-2021-34966.md): Foxit PDF Editor FileAttachment Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34965](https://cve.now/CVE-2021-34965.md): Foxit PDF Editor Squiggly Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34964](https://cve.now/CVE-2021-34964.md): Foxit PDF Editor Polygon Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34963](https://cve.now/CVE-2021-34963.md): Foxit PDF Editor PolyLine Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34962](https://cve.now/CVE-2021-34962.md): Foxit PDF Editor Caret Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34961](https://cve.now/CVE-2021-34961.md): Foxit PDF Editor Ink Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34960](https://cve.now/CVE-2021-34960.md): Foxit PDF Editor Circle Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34959](https://cve.now/CVE-2021-34959.md): Foxit PDF Editor Square Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34958](https://cve.now/CVE-2021-34958.md): Foxit PDF Editor Text Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34957](https://cve.now/CVE-2021-34957.md): Foxit PDF Editor Highlight Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34956](https://cve.now/CVE-2021-34956.md): Foxit PDF Editor Underline Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34955](https://cve.now/CVE-2021-34955.md): Foxit PDF Editor Stamp Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34954](https://cve.now/CVE-2021-34954.md): Foxit PDF Editor StrikeOut Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Editor)
- [CVE-2021-34953](https://cve.now/CVE-2021-34953.md): Foxit PDF Reader Annotation Use of Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34952](https://cve.now/CVE-2021-34952.md): Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34951](https://cve.now/CVE-2021-34951.md): Foxit PDF Reader Annotation Use of Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34950](https://cve.now/CVE-2021-34950.md): Foxit PDF Reader Annotation Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34949](https://cve.now/CVE-2021-34949.md): Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2021-34948](https://cve.now/CVE-2021-34948.md): Foxit PDF Reader Square Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34947](https://cve.now/CVE-2021-34947.md): NETGEAR R7800 net-cgi Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 8.8, NETGEAR R7800)
- [CVE-2024-23551](https://cve.now/CVE-2024-23551.md): HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint (CVSS 6.5, HCL Software BigFix Compliance)
- [CVE-2023-40694](https://cve.now/CVE-2023-40694.md): IBM Watson CP4D Data Stores information disclosure (CVSS 6.2, IBM Watson CP4D Data Stores)
- [CVE-2024-23709](https://cve.now/CVE-2024-23709.md): In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 6.5, Google Android)
- [CVE-2024-23708](https://cve.now/CVE-2024-23708.md): In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has b (CVSS 9.8, Google Android)
- [CVE-2024-23707](https://cve.now/CVE-2024-23707.md): In multiple locations, there is a possible permissions bypass due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2024-23706](https://cve.now/CVE-2024-23706.md): In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. (CVSS 7.4, Google Android)
- [CVE-2024-23705](https://cve.now/CVE-2024-23705.md): In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. (CVSS 9.8, Google Android)
- [CVE-2024-0043](https://cve.now/CVE-2024-0043.md): In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the cod (CVSS 7.8, Google Android)
- [CVE-2024-0025](https://cve.now/CVE-2024-0025.md): In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. (CVSS 7.8, Google Android)
- [CVE-2024-0024](https://cve.now/CVE-2024-0024.md): In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due to improper input va (CVSS 7.8, Google Android)
- [CVE-2024-4030](https://cve.now/CVE-2024-4030.md): tempfile.mkdtemp() may be readable and writeable by all users on Windows (CVSS 7.1, Python Software Foundation CPython)
- [CVE-2024-34346](https://cve.now/CVE-2024-34346.md): Deno contains a permission escalation via open of privileged files with missing \`--deny\` flag (CVSS 8.5, denoland deno · deno)
- [CVE-2024-23713](https://cve.now/CVE-2024-23713.md): In migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications settings due to improp (CVSS 7.8, Google Android)
- [CVE-2024-23712](https://cve.now/CVE-2024-23712.md): In multiple functions of AppOpsService.java, there is a possible way to saturate the content of /data/system/appops\_accesses.xml due to reso (CVSS 5.5, Google Android)
- [CVE-2024-23710](https://cve.now/CVE-2024-23710.md): In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a privileg (CVSS 7.8, Google Android)
- [CVE-2024-23704](https://cve.now/CVE-2024-23704.md): In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW\_ADD\_WIFI\_CONFIG restriction due to a missing permissi (CVSS 7.0, Google Android)
- [CVE-2024-0042](https://cve.now/CVE-2024-0042.md): In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. (CVSS 5.6, Google Android)
- [CVE-2024-0027](https://cve.now/CVE-2024-0027.md): In multiple functions of SnoozeHelper.java, there is a possible way to cause a boot loop due to resource exhaustion. (CVSS 5.9, Google Android)
- [CVE-2024-0026](https://cve.now/CVE-2024-0026.md): In multiple functions of SnoozeHelper.java, there is a possible persistent denial of service due to resource exhaustion. (CVSS 4.7, Google Android)
- [CVE-2024-0022](https://cve.now/CVE-2024-0022.md): In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another us (CVSS 5.5, Google Android)
- [CVE-2024-27273](https://cve.now/CVE-2024-27273.md): IBM AIX privilege escalation (CVSS 8.1, IBM AIX)
- [CVE-2024-4559](https://cve.now/CVE-2024-4559.md): Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption v (CVSS 7.5, Google Chrome)
- [CVE-2024-4558](https://cve.now/CVE-2024-4558.md): Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 7.5, Google Chrome)
- [CVE-2024-29209](https://cve.now/CVE-2024-29209.md): A medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an atta (CVSS 6.0, KnowBe4 Phish Alert Button (PAB) for Outlook · KnowBe4 S… +1)
- [CVE-2024-29210](https://cve.now/CVE-2024-29210.md): A local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifically within its config (CVSS 2.8, KnowBe4 Phish Alert Button (PAB) for Outlook · KnowBe4 P… +2)
- [CVE-2024-29206](https://cve.now/CVE-2024-29206.md): An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported (CVSS 2.2, Ubiquiti UniFi Connect EV Station · Ubiquiti UniFi Acces… +3)
- [CVE-2024-27982](https://cve.now/CVE-2024-27982.md): The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to (CVSS 6.5, NodeJS Node)
- [CVE-2024-29207](https://cve.now/CVE-2024-29207.md): An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. (CVSS 7.5, Ubiquiti UniFi Connect Application · Ubiquiti UniFi Conn… +1)
- [CVE-2024-29208](https://cve.now/CVE-2024-29208.md): An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the (CVSS 2.2, Ubiquiti Update UniFi Connect EV Station · Ubiquiti Update…)
- [CVE-2024-4596](https://cve.now/CVE-2024-4596.md): Kimai Session information disclosure (CVSS 3.7, Kimai · kimai/kimai)
- [CVE-2024-34341](https://cve.now/CVE-2024-34341.md): The Trix Editor Contains an Arbitrary Code Execution Vulnerability (CVSS 5.4, basecamp trix · trix +1)
- [CVE-2024-32867](https://cve.now/CVE-2024-32867.md): Suricata's defrag contains various issues leading to policy bypass (CVSS 5.3, OISF suricata)
- [CVE-2024-4595](https://cve.now/CVE-2024-4595.md): SEMCMS function.php locate sql injection (CVSS 6.3, SEMCMS)
- [CVE-2024-32664](https://cve.now/CVE-2024-32664.md): Suricata's base64 contains an out of bounds write (CVSS 5.3, OISF suricata)
- [CVE-2024-32663](https://cve.now/CVE-2024-32663.md): Suricata 's http2 parser contains an improper compressed header handling can lead to resource starvation (CVSS 7.5, OISF suricata)
- [CVE-2024-4594](https://cve.now/CVE-2024-4594.md): DedeCMS sys\_safe.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-34342](https://cve.now/CVE-2024-34342.md): react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF (CVSS 7.1, wojtekmaj react-pdf · react-pdf)
- [CVE-2024-34084](https://cve.now/CVE-2024-34084.md): Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests (CVSS 7.5, stacklok minder · github.com/stacklok/minder)
- [CVE-2024-31456](https://cve.now/CVE-2024-31456.md): GLPI contains an authenticated SQL injection (CVSS 7.7, glpi-project glpi)
- [CVE-2024-29889](https://cve.now/CVE-2024-29889.md): GLPI contains an SQL injection through the saved searches (CVSS 7.1, glpi-project glpi)
- [CVE-2024-4593](https://cve.now/CVE-2024-4593.md): DedeCMS sys\_multiserv.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4592](https://cve.now/CVE-2024-4592.md): DedeCMS sys\_group\_edit.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-28148](https://cve.now/CVE-2024-28148.md): Apache Superset: Incorrect datasource authorization on explore REST API (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-4591](https://cve.now/CVE-2024-4591.md): DedeCMS sys\_group\_add.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4590](https://cve.now/CVE-2024-4590.md): DedeCMS sys\_info.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4536](https://cve.now/CVE-2024-4536.md): Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability (CVSS 6.8, Eclipse Foundation EDC · org.eclipse.edc:connector-core)
- [CVE-2023-7240](https://cve.now/CVE-2023-7240.md): Broken Access Control leading to SSRF in NetIQ Identity Console (CVSS 5.8, OpenText NetIQ Identity Console)
- [CVE-2023-31234](https://cve.now/CVE-2023-31234.md): WordPress Tilda Publishing plugin \<= 0.3.23 - Broken Access Control vulnerability (CVSS 6.3, Tilda Publishing)
- [CVE-2024-4589](https://cve.now/CVE-2024-4589.md): DedeCMS mytag\_edit.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4588](https://cve.now/CVE-2024-4588.md): DedeCMS mytag\_add.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4587](https://cve.now/CVE-2024-4587.md): DedeCMS tpl.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4586](https://cve.now/CVE-2024-4586.md): DedeCMS shops\_delivery.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4585](https://cve.now/CVE-2024-4585.md): DedeCMS member\_type.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-4538](https://cve.now/CVE-2024-4538.md): IDOR vulnerability in Janto Ticketing Software (CVSS 7.5, Impronta Janto Ticketing Software)
- [CVE-2024-4537](https://cve.now/CVE-2024-4537.md): IDOR vulnerability in Janto Ticketing Software (CVSS 7.5, Impronta Janto Ticketing Software)
- [CVE-2024-4601](https://cve.now/CVE-2024-4601.md): Improper Authentication vulnerability in Socomec Net Vision (CVSS 6.7, Socomec Net vision)
- [CVE-2024-4584](https://cve.now/CVE-2024-4584.md): Faraday GM8181/GM828x command\_port.ini information disclosure (CVSS 5.3, Faraday GM8181 · Faraday GM828x)
- [CVE-2024-4600](https://cve.now/CVE-2024-4600.md): Cross-Site Request Forgery vulnerability in Socomec Net Vision (CVSS 7.1, Socomec Net vision)
- [CVE-2024-4583](https://cve.now/CVE-2024-4583.md): Faraday GM8181/GM828x Request information disclosure (CVSS 5.3, Faraday GM8181 · Faraday GM828x)
- [CVE-2024-4582](https://cve.now/CVE-2024-4582.md): Faraday GM8181/GM828x NTP Service os command injection (CVSS 7.3, Faraday GM8181 · Faraday GM828x)
- [CVE-2024-4599](https://cve.now/CVE-2024-4599.md): Denial of service vulnerability in LAN Messenger (CVSS 7.5, LAN Messenger)
- [CVE-2023-6810](https://cve.now/CVE-2023-6810.md): ClickCease Click Fraud Protection \<= 3.2.4 - Improper Authorization to sensitive information exposure via get\_settings (CVSS 4.3, eranfl ClickCease Click Fraud Protection)
- [CVE-2024-4346](https://cve.now/CVE-2024-4346.md): Startklar Elementor Addons \<= 1.7.13 - Unauthenticated Arbitrary File Deletion (CVSS 9.1, wshberlin Startklar Elementor Addons)
- [CVE-2024-4345](https://cve.now/CVE-2024-4345.md): Startklar Elementor Addons \<= 1.7.13 - Unauthenticated Arbitrary File Upload (CVSS 9.8, wshberlin Startklar Elementor Addons)
- [CVE-2024-3759](https://cve.now/CVE-2024-3759.md): Hmdfs has a use after free vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2024-3758](https://cve.now/CVE-2024-3758.md): Hmdfs has a heap buffer overflow vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2024-3757](https://cve.now/CVE-2024-3757.md): Arkcompiler runtime has an integer overflow vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-31078](https://cve.now/CVE-2024-31078.md): Bluetooth Service has a use after free vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-23808](https://cve.now/CVE-2024-23808.md): Arkcompiler ets frontend has an out-of-bounds read vulnerability (CVSS 5.2, OpenHarmony)
- [CVE-2024-27217](https://cve.now/CVE-2024-27217.md): MSDP has a use after free vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2024-3628](https://cve.now/CVE-2024-3628.md): EasyEvent \<= 1.0.0 - Admin+ Stored XSS (CVSS 3.8, EasyEvent)
- [CVE-2024-4186](https://cve.now/CVE-2024-4186.md): Edwiser Bridge \<= 3.0.5 - Authentication Bypass due to Missing Empty Value Check (CVSS 9.8, wisdmlabs Edwiser Bridge – WordPress Moodle Integration)
- [CVE-2024-22472](https://cve.now/CVE-2024-22472.md): Long S0 frames received by 500 series Z-Wave devices may cause buffer overflow (CVSS 8.1, Silicon Labs Z-Wave SDK)
- [CVE-2024-20855](https://cve.now/CVE-2024-20855.md): Improper access control vulnerability in multitasking framework prior to SMR May-2024 Release 1 allows physical attackers to access unlocked (CVSS 2.4, Samsung Mobile Devices)
- [CVE-2024-20872](https://cve.now/CVE-2024-20872.md): Improper handling of insufficient privileges vulnerability in TalkbackSE prior to version Android 14 allows local attackers to modify settin (CVSS 6.2, Samsung Mobile TalkbackSE)
- [CVE-2024-20871](https://cve.now/CVE-2024-20871.md): Improper authorization vulnerability in Samsung Keyboard prior to version One UI 5.1.1 allows physical attackers to partially bypass the fac (CVSS 4.9, Samsung Mobile Samsung Keyboard)
- [CVE-2024-20870](https://cve.now/CVE-2024-20870.md): Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.71.8 allows local attackers to writ (CVSS 5.1, Samsung Mobile Galaxy Store)
- [CVE-2024-20869](https://cve.now/CVE-2024-20869.md): Improper privilege management vulnerability in Samsung Internet prior to version 25.0.0.41 allows local attackers to bypass protection for c (CVSS 5.5, Samsung Mobile Samsung Internet)
- [CVE-2024-20868](https://cve.now/CVE-2024-20868.md): Improper input validation in Samsung Notes prior to version 4.4.15 allows local attackers to delete files with Samsung Notes privilege under (CVSS 4.4, Samsung Mobile Samsung Notes)
- [CVE-2024-20867](https://cve.now/CVE-2024-20867.md): Improper privilege management vulnerability in Samsung Email prior to version 6.1.91.14 allows local attackers to access sensitive informati (CVSS 5.5, Samsung Mobile Samsung Email)
- [CVE-2024-20866](https://cve.now/CVE-2024-20866.md): Authentication bypass vulnerability in Setupwizard prior to SMR May-2024 Release 1 allows physical attackers to skip activation step. (CVSS 5.7, Samsung Mobile Devices)
- [CVE-2024-20865](https://cve.now/CVE-2024-20865.md): Authentication bypass in bootloader prior to SMR May-2024 Release 1 allows physical attackers to flash arbitrary images. (CVSS 6.6, Samsung Mobile Devices)
- [CVE-2024-20864](https://cve.now/CVE-2024-20864.md): Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows local attackers to monitor system resource (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2024-20863](https://cve.now/CVE-2024-20863.md): Out of bounds write vulnerability in SNAP in HAL prior to SMR May-2024 Release 1 allows local privileged attackers to execute arbitrary code (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2024-20862](https://cve.now/CVE-2024-20862.md): Out-of-bounds write in SveService prior to SMR May-2024 Release 1 allows local privileged attackers to execute arbitrary code. (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2024-20861](https://cve.now/CVE-2024-20861.md): Use after free vulnerability in SveService prior to SMR May-2024 Release 1 allows local privileged attackers to cause memory corruption. (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2024-20860](https://cve.now/CVE-2024-20860.md): Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to reb (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20859](https://cve.now/CVE-2024-20859.md): Improper access control vulnerability in FactoryCamera prior to SMR May-2024 Release 1 allows local attackers to take pictures without privi (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2024-20858](https://cve.now/CVE-2024-20858.md): Improper access control vulnerability in setCocktailHostCallbacks of CocktailBarService prior to SMR May-2024 Release 1 allows local attacke (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20857](https://cve.now/CVE-2024-20857.md): Improper access control vulnerability in startListening of CocktailBarService prior to SMR May-2024 Release 1 allows local attackers to acce (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20856](https://cve.now/CVE-2024-20856.md): Improper Authentication vulnerability in Secure Folder prior to SMR May-2024 Release 1 allows physical attackers to access Secure Folder wit (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2024-20821](https://cve.now/CVE-2024-20821.md): A vulnerability possible to reconfigure OTP allows local attackers to transit RMA(Return Merchandise Authorization) mode, which disables sec (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2023-42757](https://cve.now/CVE-2023-42757.md): Process Explorer before 17.04 allows attackers to make it functionally unavailable (a denial of service for analysis) by renaming an executa (CVSS 4.2)
- [CVE-2023-46012](https://cve.now/CVE-2023-46012.md): Buffer Overflow vulnerability LINKSYS EA7500 3.0.1.207964 allows a remote attacker to execute arbitrary code via an HTTP request to the IGD (CVSS 9.8)
- [CVE-2024-25507](https://cve.now/CVE-2024-25507.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email\_attach\_id parameter at /LHMail/AttachDown.as (CVSS 9.4)
- [CVE-2024-25508](https://cve.now/CVE-2024-25508.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletin\_template\_show.a (CVSS 9.8)
- [CVE-2024-25509](https://cve.now/CVE-2024-25509.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys\_file\_storage\_id parameter at /WorkFlow/wf\_file (CVSS 9.4)
- [CVE-2024-25510](https://cve.now/CVE-2024-25510.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address\_public\_show.a (CVSS 9.8)
- [CVE-2024-25511](https://cve.now/CVE-2024-25511.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address\_public\_new.as (CVSS 9.4)
- [CVE-2024-25512](https://cve.now/CVE-2024-25512.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attach\_id parameter at /Bulletin/AttachDownLoad.as (CVSS 8.1)
- [CVE-2024-25513](https://cve.now/CVE-2024-25513.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file\_id parameter at /CorporateCulture/kaizen\_down (CVSS 7.8)
- [CVE-2024-25514](https://cve.now/CVE-2024-25514.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template\_id parameter at /SysManage/wf\_template\_ch (CVSS 9.4)
- [CVE-2024-29149](https://cve.now/CVE-2024-29149.md): An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8\_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8\_SIP-R200.1.0 (CVSS 7.4)
- [CVE-2024-29150](https://cve.now/CVE-2024-29150.md): An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8\_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8\_SIP-R200.1.0 (CVSS 8.8)
- [CVE-2024-32369](https://cve.now/CVE-2024-32369.md): SQL Injection vulnerability in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive infor (CVSS 4.3)
- [CVE-2024-32370](https://cve.now/CVE-2024-32370.md): An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafte (CVSS 9.8)
- [CVE-2024-32371](https://cve.now/CVE-2024-32371.md): An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a regular user account to escalate their privileges and gain a (CVSS 7.5)
- [CVE-2024-33120](https://cve.now/CVE-2024-33120.md): Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function. (CVSS 9.8)
- [CVE-2024-33122](https://cve.now/CVE-2024-33122.md): Roothub v2.6 was discovered to contain a SQL injection vulnerability via the topic parameter in the list() function. (CVSS 6.3)
- [CVE-2024-33124](https://cve.now/CVE-2024-33124.md): Roothub v2.6 was discovered to contain a SQL injection vulnerability via the nodeTitle parameter in the parentNode() function.. (CVSS 9.8)
- [CVE-2024-33139](https://cve.now/CVE-2024-33139.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the findpage function. (CVSS 7.5)
- [CVE-2024-33144](https://cve.now/CVE-2024-33144.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the findApplyedTasksPage function in (CVSS 8.8)
- [CVE-2024-33146](https://cve.now/CVE-2024-33146.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the export function. (CVSS 9.1)
- [CVE-2024-33147](https://cve.now/CVE-2024-33147.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the authRoleList function. (CVSS 8.8)
- [CVE-2024-33148](https://cve.now/CVE-2024-33148.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the list function. (CVSS 7.3)
- [CVE-2024-33149](https://cve.now/CVE-2024-33149.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the myProcessList function. (CVSS 8.1)
- [CVE-2024-33153](https://cve.now/CVE-2024-33153.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the commentList() function. (CVSS 9.8)
- [CVE-2024-33155](https://cve.now/CVE-2024-33155.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the getDeptList() function. (CVSS 9.8)
- [CVE-2024-33161](https://cve.now/CVE-2024-33161.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the unallocatedList() function. (CVSS 5.3)
- [CVE-2024-33164](https://cve.now/CVE-2024-33164.md): J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql\_filter parameter in the authUserList() function. (CVSS 9.8)
- [CVE-2024-33434](https://cve.now/CVE-2024-33434.md): An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a (CVSS 9.8, github.com/tiagorlampert/CHAOS)
- [CVE-2024-33748](https://cve.now/CVE-2024-33748.md): Cross-site scripting (XSS) vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier. (CVSS 4.1, net.mingsoft:ms-basic)
- [CVE-2024-33780](https://cve.now/CVE-2024-33780.md): MP-SPDZ v0.3.8 was discovered to contain a segmentation violation via the function osuCrypto::copyOut at /Tools/SilentPprf.cpp. (CVSS 6.5)
- [CVE-2024-33781](https://cve.now/CVE-2024-33781.md): MP-SPDZ v0.3.8 was discovered to contain a stack overflow via the function octetStream::get\_bytes in /Tools/octetStream.cpp. (CVSS 7.5)
- [CVE-2024-33782](https://cve.now/CVE-2024-33782.md): MP-SPDZ v0.3.8 was discovered to contain a stack overflow via the function OTExtensionWithMatrix::extend in /OT/OTExtensionWithMatrix.cpp. (CVSS 7.5)
- [CVE-2024-33783](https://cve.now/CVE-2024-33783.md): MP-SPDZ v0.3.8 was discovered to contain a segmentation violation via the function osuCrypto::SilentMultiPprfReceiver::expand in /Tools/Sile (CVSS 6.5)
- [CVE-2024-33856](https://cve.now/CVE-2024-33856.md): An issue was discovered in Logpoint before 7.4.0. (CVSS 5.3)
- [CVE-2024-33857](https://cve.now/CVE-2024-33857.md): An issue was discovered in Logpoint before 7.4.0. (CVSS 9.6)
- [CVE-2024-33858](https://cve.now/CVE-2024-33858.md): An issue was discovered in Logpoint before 7.4.0. (CVSS 5.3)
- [CVE-2024-33859](https://cve.now/CVE-2024-33859.md): An issue was discovered in Logpoint before 7.4.0. (CVSS 6.1)
- [CVE-2024-33860](https://cve.now/CVE-2024-33860.md): An issue was discovered in Logpoint before 7.4.0. (CVSS 6.5)
- [CVE-2024-34314](https://cve.now/CVE-2024-34314.md): CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file\_get\_contents function in the fetch\_action method (CVSS 7.5)
- [CVE-2024-34315](https://cve.now/CVE-2024-34315.md): CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file\_get\_contents function in the fckedit\_action meth (CVSS 7.5)
- [CVE-2024-34397](https://cve.now/CVE-2024-34397.md): An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. (CVSS 5.2)
- [CVE-2024-34517](https://cve.now/CVE-2024-34517.md): The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin acce (CVSS 6.5, Neo4j · org.neo4j:neo4j-cypher)
- [CVE-2024-34523](https://cve.now/CVE-2024-34523.md): AChecker 1.5 allows remote attackers to read the contents of arbitrary files via the download.php path parameter by using Unauthenticated Pa (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.