# CVEs published 2024-05-08

114 CVEs were published on May 8, 2024: 23 critical, 25 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-27793](https://cve.now/CVE-2024-27793.md): The issue was addressed with improved checks. (CVSS 6.3, Apple iTunes for Windows)
- [CVE-2024-34196](https://cve.now/CVE-2024-34196.md): Totolink AC1200 Wireless Dual Band Gigabit Router A3002RU\_V3 Firmware V3.0.0-B20230809.1615 is vulnerable to Buffer Overflow. (CVSS 8.8)
- [CVE-2024-26517](https://cve.now/CVE-2024-26517.md): SQL Injection vulnerability in School Task Manager v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to t (CVSS 9.1)
- [CVE-2024-27281](https://cve.now/CVE-2024-27281.md): An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. (CVSS 4.5, rdoc)
- [CVE-2024-27280](https://cve.now/CVE-2024-27280.md): A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. (CVSS 9.8, stringio)
- [CVE-2024-27282](https://cve.now/CVE-2024-27282.md): An issue was discovered in Ruby 3.x through 3.3.0. (CVSS 6.6)
- [CVE-2024-34308](https://cve.now/CVE-2024-34308.md): TOTOLINK LR350 V9.3.5u.6369\_B20220309 was discovered to contain a stack overflow via the password parameter in the function urldecode. (CVSS 8.8)
- [CVE-2024-28759](https://cve.now/CVE-2024-28759.md): A crafted network packet may cause a buffer overrun in Wind River VxWorks 7 through 23.09. (CVSS 4.3)
- [CVE-2024-22460](https://cve.now/CVE-2024-22460.md): Dell PowerProtect DM5500 version 5.15.0.0 and prior contains an insecure deserialization Vulnerability. (CVSS 2.2, Dell Data Manager Appliance Software)
- [CVE-2024-24908](https://cve.now/CVE-2024-24908.md): Dell PowerProtect DM5500 version 5.15.0.0 and prior contain an Arbitrary File Delete via Path Traversal vulnerability. (CVSS 6.5, Dell Data Manager Appliance Software)
- [CVE-2024-28971](https://cve.now/CVE-2024-28971.md): Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. (CVSS 3.5, Dell Update Manager Plugin)
- [CVE-2024-24787](https://cve.now/CVE-2024-24787.md): Arbitrary code execution during build on Darwin in cmd/go (CVSS 6.4, Go toolchain cmd/go · toolchain)
- [CVE-2024-24788](https://cve.now/CVE-2024-24788.md): Malformed DNS message can cause infinite loop in net (CVSS 5.9, Go standard library net · stdlib)
- [CVE-2024-26579](https://cve.now/CVE-2024-26579.md): Apache Inlong JDBC Vulnerability (CVSS 9.8, Apache Software Foundation Apache InLong · org.apache.inlon…)
- [CVE-2024-32761](https://cve.now/CVE-2024-32761.md): BIG-IP TMM tenants on VELOS and rSeries vulnerability (CVSS 6.5, F5 BIG-IP)
- [CVE-2024-26026](https://cve.now/CVE-2024-26026.md): BIG-IP Central Manager SQL Injection (CVSS 7.5, F5 BIG-IP Next Central Manager)
- [CVE-2024-21793](https://cve.now/CVE-2024-21793.md): BIG-IP Central Manager OData Injection Vulnerability (CVSS 7.5, F5 BIG-IP Next Central Manager)
- [CVE-2024-33612](https://cve.now/CVE-2024-33612.md): BIG-IP Next Central Manager vulnerability (CVSS 6.8, F5 BIG-IP Next Central Manager)
- [CVE-2024-31156](https://cve.now/CVE-2024-31156.md): BIG-IP Configuration utility XSS vulnerability (CVSS 8.0, F5 BIG-IP)
- [CVE-2024-33604](https://cve.now/CVE-2024-33604.md): BIG-IP Configuration utility XSS vulnerability (CVSS 6.1, F5 BIG-IP)
- [CVE-2024-28132](https://cve.now/CVE-2024-28132.md): BIG-IP NEXT CNF vulnerability (CVSS 4.4, F5 BIG-IP Next CNF)
- [CVE-2024-28889](https://cve.now/CVE-2024-28889.md): BIG-IP SSL vulnerability (CVSS 5.9, F5 BIG-IP)
- [CVE-2024-32049](https://cve.now/CVE-2024-32049.md): BIG-IP Next Central Manager vulnerability (CVSS 7.4, F5 BIG-IP Next Central Manager)
- [CVE-2024-27202](https://cve.now/CVE-2024-27202.md): BIG-IP TMUI XSS vulnerability (CVSS 4.7, F5 BIG-IP)
- [CVE-2024-25560](https://cve.now/CVE-2024-25560.md): TMM Vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2024-33608](https://cve.now/CVE-2024-33608.md): BIG-IP IPsec vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2024-28883](https://cve.now/CVE-2024-28883.md): BIG-IP APM browser network access VPN client vulnerability (CVSS 7.4, F5 BIG-IP Edge Client · F5 BIG-IP)
- [CVE-2024-4654](https://cve.now/CVE-2024-4654.md): BlueNet Technology Clinical Browsing System cloudInterface.php sql injection (CVSS 6.3, BlueNet Technology Clinical Browsing System)
- [CVE-2024-32113](https://cve.now/CVE-2024-32113.md): Apache OFBiz: Path traversal leading to RCE (CVSS 9.1, KEV, Apache Software Foundation Apache OFBiz)
- [CVE-2024-3951](https://cve.now/CVE-2024-3951.md): Cross-site Scripting in PTC Codebeamer (CVSS 7.1, PTC Codebeamer)
- [CVE-2024-32980](https://cve.now/CVE-2024-32980.md): Spin contains a potential network sandbox escape for specifically configured Spin applications (CVSS 9.1, fermyon spin · spin-sdk)
- [CVE-2024-4653](https://cve.now/CVE-2024-4653.md): BlueNet Technology Clinical Browsing System outIndex.php sql injection (CVSS 6.3, BlueNet Technology Clinical Browsing System)
- [CVE-2024-34347](https://cve.now/CVE-2024-34347.md): @hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE (CVSS 8.4, hoppscotch · @hoppscotch/cli)
- [CVE-2024-32886](https://cve.now/CVE-2024-32886.md): Vitess vulnerable to infinite memory consumption and vtgate crash (CVSS 4.9, vitessio vitess · vitess.io/vitess +1)
- [CVE-2024-4652](https://cve.now/CVE-2024-4652.md): Campcodes Complete Web-Based School Management System show\_teacher2.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4651](https://cve.now/CVE-2024-4651.md): Campcodes Complete Web-Based School Management System student\_attendance\_history1.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System)
- [CVE-2024-33573](https://cve.now/CVE-2024-33573.md): WordPress EPROLO Dropshipping plugin \<= 1.7.1 - Broken Access Control vulnerability (CVSS 4.3, EPROLO Dropshipping)
- [CVE-2024-33574](https://cve.now/CVE-2024-33574.md): WordPress Vitepos plugin \<= 3.0.1 - Broken Access Control vulnerability (CVSS 4.3, appsbd Vitepos)
- [CVE-2024-4650](https://cve.now/CVE-2024-4650.md): Campcodes Complete Web-Based School Management System student\_due\_payment.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4649](https://cve.now/CVE-2024-4649.md): Campcodes Complete Web-Based School Management System student\_exam\_mark\_insert\_form1.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System)
- [CVE-2024-24833](https://cve.now/CVE-2024-24833.md): WordPress Happy Addons for Elementor plugin \<= 3.10.1 - Broken Access Control on Post Clone vulnerability (CVSS 4.3, HappyMonster Happy Addons for Elementor)
- [CVE-2024-31270](https://cve.now/CVE-2024-31270.md): WordPress ARForms Form Builder plugin \<= 1.6.1 - Broken Access Control vulnerability (CVSS 7.6, Repute InfoSystems ARForms Form Builder)
- [CVE-2024-30459](https://cve.now/CVE-2024-30459.md): WordPress AI WP Writer plugin \<= 3.6.5 - Broken Access Control vulnerability (CVSS 5.3, AIpost AI WP Writer)
- [CVE-2024-4233](https://cve.now/CVE-2024-4233.md): Broken Access Control vulnerability in multiple WordPress plugins by Tyche Softwares (CVSS 4.3, Tyche Softwares Print Invoice & Delivery Notes for WooCo… +1)
- [CVE-2024-1438](https://cve.now/CVE-2024-1438.md): WordPress Rolo Slider plugin \<= 1.0.9 - Broken Access Control vulnerability (CVSS 7.7, PressFore Rolo Slider)
- [CVE-2024-4648](https://cve.now/CVE-2024-4648.md): Campcodes Complete Web-Based School Management System student\_exam\_mark\_update\_form.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4647](https://cve.now/CVE-2024-4647.md): Campcodes Complete Web-Based School Management System student\_first\_payment.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4646](https://cve.now/CVE-2024-4646.md): Campcodes Complete Web-Based School Management System student\_payment\_details.php cross site scripting (CVSS 3.5, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4645](https://cve.now/CVE-2024-4645.md): SourceCodester Prison Management System changepassword.php cross site scripting (CVSS 5.3, SourceCodester Prison Management System)
- [CVE-2022-40218](https://cve.now/CVE-2022-40218.md): WordPress TH Advance Product Search plugin \<= 1.1.4 - Unauthenticated Plugin Settings Change vulnerability (CVSS 6.5, ThemeHunk Advance WordPress Search Plugin)
- [CVE-2024-34414](https://cve.now/CVE-2024-34414.md): WordPress Raindrops theme \<= 1.600 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nobita raindrops)
- [CVE-2024-34546](https://cve.now/CVE-2024-34546.md): WordPress Sticky Social Link plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Habibur Rahman Sticky Social Link)
- [CVE-2024-34547](https://cve.now/CVE-2024-34547.md): WordPress Magical Addons For Elementor plugin \<= 1.1.34 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Noor alam Magical Addons For Elementor)
- [CVE-2024-4644](https://cve.now/CVE-2024-4644.md): SourceCodester Prison Management System changepassword.php cross site scripting (CVSS 3.5, SourceCodester Prison Management System)
- [CVE-2024-34548](https://cve.now/CVE-2024-34548.md): WordPress All-in-One Addons for Elementor – WidgetKit plugin \<= 2.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themesgrove WidgetKit)
- [CVE-2024-34553](https://cve.now/CVE-2024-34553.md): WordPress Stockholm Core plugin \<= 2.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Select-Themes Stockholm Core)
- [CVE-2024-34558](https://cve.now/CVE-2024-34558.md): WordPress WOLF plugin \<= 1.0.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, realmag777 WOLF)
- [CVE-2024-34560](https://cve.now/CVE-2024-34560.md): WordPress gee Search Plus plugin \<= 1.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, GOMO gee Search Plus)
- [CVE-2024-34561](https://cve.now/CVE-2024-34561.md): WordPress Real3D Flipbook PDF Viewer Lite plugin \<= 3.71 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Creative interactive media 3D FlipBook, PDF Viewer, PDF Emb…)
- [CVE-2024-34562](https://cve.now/CVE-2024-34562.md): WordPress Move Addons for Elementor plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Moveaddons Move Addons for Elementor)
- [CVE-2024-34563](https://cve.now/CVE-2024-34563.md): WordPress Gold Addons for Elementor plugin \<= 1.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GoldAddons Gold Addons for Elementor)
- [CVE-2024-34564](https://cve.now/CVE-2024-34564.md): WordPress Counter Up plugin \<= 2.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LogicHunt Counter Up)
- [CVE-2024-34565](https://cve.now/CVE-2024-34565.md): WordPress Debug Info plugin \<= 1.3.10 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, AMP-MODE Debug Info)
- [CVE-2024-34566](https://cve.now/CVE-2024-34566.md): WordPress Content Blocks (Custom Post Widget) plugin \<= 3.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Johan van der Wijk Content Blocks)
- [CVE-2024-34568](https://cve.now/CVE-2024-34568.md): WordPress LetterPress Newsletter plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Themeqx LetterPress)
- [CVE-2024-3507](https://cve.now/CVE-2024-3507.md): Privilege escalation vulnerability in Lunar (CVSS 7.7, Lunar)
- [CVE-2024-34569](https://cve.now/CVE-2024-34569.md): WordPress Zotpress plugin \<= 7.3.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Katie Zotpress)
- [CVE-2024-34570](https://cve.now/CVE-2024-34570.md): WordPress Xpro Elementor Addons plugin \<= 1.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Xpro Elementor Addons)
- [CVE-2024-34571](https://cve.now/CVE-2024-34571.md): WordPress Himalayas theme \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeGrill Himalayas)
- [CVE-2024-4135](https://cve.now/CVE-2024-4135.md): WP Latest Posts \<= 5.0.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4, joomunited WP Latest Posts)
- [CVE-2024-4281](https://cve.now/CVE-2024-4281.md): Link Library \<= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library Shortcode (CVSS 6.4, jackdewey Link Library)
- [CVE-2024-34572](https://cve.now/CVE-2024-34572.md): WordPress Fancy Elementor Flipbox plugin \<= 2.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemePrix Fancy Elementor Flipbox)
- [CVE-2024-34573](https://cve.now/CVE-2024-34573.md): WordPress Pootle Pagebuilder plugin \<= 5.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pootlepress Pootle Pagebuilder – WordPress Page builder)
- [CVE-2024-4438](https://cve.now/CVE-2024-4438.md): Etcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platform (CVSS 7.5, etcd · Red Hat OpenStack Platform)
- [CVE-2024-34574](https://cve.now/CVE-2024-34574.md): WordPress Table Maker plugin \<= 1.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Wpsoul Table Maker)
- [CVE-2024-4437](https://cve.now/CVE-2024-4437.md): Etcd: incomplete fix for cve-2021-44716 in openstack platform (CVSS 7.5, etcd · Red Hat OpenStack Platform)
- [CVE-2024-4436](https://cve.now/CVE-2024-4436.md): Etcd: incomplete fix for cve-2022-41723 in openstack platform (CVSS 7.5, etcd as shipped in Red Hat Openstack · Red Hat OpenStack Pl…)
- [CVE-2023-41651](https://cve.now/CVE-2023-41651.md): WordPress Multi-column Tag Map plugin \<= 17.0.26 - Broken Access Control vulnerability (CVSS 6.5, Multi-column Tag Map)
- [CVE-2024-1076](https://cve.now/CVE-2024-1076.md): SSL Zen \<= 4.5.3 - Unauthenticated Private Keys Access (CVSS 6.5, SSL Zen)
- [CVE-2024-3494](https://cve.now/CVE-2024-3494.md): Mesmerize Companion \<= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize\_contact\_form Shortcode (CVSS 6.4, horearadu Mesmerize Companion)
- [CVE-2024-22266](https://cve.now/CVE-2024-22266.md): VMware Avi Load Balancer updates address multiple vulnerabilities (CVSS 6.5, VMware Avi Load Balancer)
- [CVE-2024-22264](https://cve.now/CVE-2024-22264.md): VMware Avi Load Balancer updates address multiple vulnerabilities (CVSS 7.2, VMware Avi Load Balancer)
- [CVE-2024-32674](https://cve.now/CVE-2024-32674.md): Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. (CVSS 5.4, Heateor Social Login WordPress)
- [CVE-2024-4418](https://cve.now/CVE-2024-4418.md): Libvirt: stack use-after-free in virnetclientioeventloop() (CVSS 6.2, libvirt · Red Hat Enterprise Linux)
- [CVE-2024-4393](https://cve.now/CVE-2024-4393.md): Social Connect \<= 1.2 - Authentication Bypass (CVSS 9.8, thenbrent Social Connect)
- [CVE-2024-4162](https://cve.now/CVE-2024-4162.md): KW Watcher Vulnerability ALlows Malicious Read Access to Memory (CVSS 4.4, Panasonic Holdings KW Watcher)
- [CVE-2024-2746](https://cve.now/CVE-2024-2746.md): Incomplete fix for CVE-2024-1929 (CVSS 8.8, Fedora dnf5daemon-server)
- [CVE-2024-1929](https://cve.now/CVE-2024-1929.md): Local Root Exploit via Configuration Dictionary (CVSS 7.5, Fedora dnf5daemon-server)
- [CVE-2024-1930](https://cve.now/CVE-2024-1930.md): No Limit on Number of Open Sessions / Bad Session Close Behaviour (CVSS 6.5, Fedora dnf5daemon-server)
- [CVE-2024-2860](https://cve.now/CVE-2024-2860.md): The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. (CVSS 7.8, Brocade SAnnav)
- [CVE-2024-4456](https://cve.now/CVE-2024-4456.md): In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page. (CVSS 4.1, Octopus Deploy Octopus Server)
- [CVE-2024-25515](https://cve.now/CVE-2024-25515.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys\_file\_storage\_id parameter at /WorkFlow/wf\_work (CVSS 7.3)
- [CVE-2024-25517](https://cve.now/CVE-2024-25517.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx. (CVSS 9.8)
- [CVE-2024-25518](https://cve.now/CVE-2024-25518.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template\_id parameter at /WorkFlow/wf\_get\_fields\_a (CVSS 9.4)
- [CVE-2024-25519](https://cve.now/CVE-2024-25519.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wf\_work\_print.aspx. (CVSS 9.8)
- [CVE-2024-25520](https://cve.now/CVE-2024-25520.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys\_blogtemplate\_new.as (CVSS 9.8)
- [CVE-2024-25521](https://cve.now/CVE-2024-25521.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt\_keyword parameter at get\_company.aspx. (CVSS 9.4)
- [CVE-2024-25522](https://cve.now/CVE-2024-25522.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office\_missive\_id parameter at /WorkFlow/wf\_work\_f (CVSS 9.4)
- [CVE-2024-25523](https://cve.now/CVE-2024-25523.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file\_id parameter at /filemanage/file\_memo.aspx. (CVSS 9.8)
- [CVE-2024-25524](https://cve.now/CVE-2024-25524.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys\_file\_storage\_id parameter at /WorkPlan/WorkPla (CVSS 9.4)
- [CVE-2024-25525](https://cve.now/CVE-2024-25525.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload (CVSS 9.8)
- [CVE-2024-25526](https://cve.now/CVE-2024-25526.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project\_id parameter at /ProjectManage/pm\_gatt\_inc (CVSS 8.1)
- [CVE-2024-25527](https://cve.now/CVE-2024-25527.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog\_template\_s (CVSS 9.4)
- [CVE-2024-25528](https://cve.now/CVE-2024-25528.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog\_template\_s (CVSS 5.9)
- [CVE-2024-25529](https://cve.now/CVE-2024-25529.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf\_office\_file\_history\_s (CVSS 9.8)
- [CVE-2024-25530](https://cve.now/CVE-2024-25530.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get\_find\_condictio (CVSS 9.8)
- [CVE-2024-25531](https://cve.now/CVE-2024-25531.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCondiction.a (CVSS 9.8)
- [CVE-2024-25532](https://cve.now/CVE-2024-25532.md): RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt\_id parameter at /include/get\_dict.aspx. (CVSS 9.8)
- [CVE-2024-25533](https://cve.now/CVE-2024-25533.md): Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.aspx). (CVSS 9.4)
- [CVE-2024-31961](https://cve.now/CVE-2024-31961.md): A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands vi (CVSS 9.8)
- [CVE-2024-33382](https://cve.now/CVE-2024-33382.md): An issue in Open5GS v.2.7.0 allows an attacker to cause a denial of service via the 64 unsuccessful UE/gnb registration (CVSS 5.3)
- [CVE-2024-34244](https://cve.now/CVE-2024-34244.md): libmodbus v3.1.10 is vulnerable to Buffer Overflow via the modbus\_write\_bits function. (CVSS 7.5)
- [CVE-2024-34255](https://cve.now/CVE-2024-34255.md): jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function. (CVSS 6.1)
- [CVE-2024-34257](https://cve.now/CVE-2024-34257.md): TOTOLINK EX1800T V9.1.0cu.2112\_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrar (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.