# CVEs published 2024-05-13

138 CVEs were published on May 13, 2024: 21 critical, 47 high. Days are UTC.

- [CVE-2024-27810](https://cve.now/CVE-2024-27810.md): A path handling issue was addressed with improved validation. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-27847](https://cve.now/CVE-2024-27847.md): This issue was addressed with improved checks. (CVSS 7.4, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-27796](https://cve.now/CVE-2024-27796.md): The issue was addressed with improved checks. (CVSS 8.1, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-27827](https://cve.now/CVE-2024-27827.md): This issue was addressed through improved state management. (CVSS 6.2, Apple macOS)
- [CVE-2024-27816](https://cve.now/CVE-2024-27816.md): A logic issue was addressed with improved checks. (CVSS 5.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-27841](https://cve.now/CVE-2024-27841.md): The issue was addressed with improved memory handling. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-27821](https://cve.now/CVE-2024-27821.md): A path handling issue was addressed with improved validation. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-27837](https://cve.now/CVE-2024-27837.md): A downgrade issue was addressed with additional code-signing restrictions. (CVSS 7.7, Apple macOS)
- [CVE-2024-23229](https://cve.now/CVE-2024-23229.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple macOS)
- [CVE-2024-27843](https://cve.now/CVE-2024-27843.md): A logic issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2024-27818](https://cve.now/CVE-2024-27818.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-27789](https://cve.now/CVE-2024-27789.md): A logic issue was addressed with improved checks. (CVSS 5.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-27822](https://cve.now/CVE-2024-27822.md): A logic issue was addressed with improved restrictions. (CVSS 7.4, Apple macOS)
- [CVE-2024-27834](https://cve.now/CVE-2024-27834.md): The issue was addressed with improved checks. (CVSS 8.1, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2024-27835](https://cve.now/CVE-2024-27835.md): This issue was addressed through improved state management. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2024-27839](https://cve.now/CVE-2024-27839.md): A privacy issue was addressed by moving sensitive data to a more secure location. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2024-27803](https://cve.now/CVE-2024-27803.md): A permissions issue was addressed with improved validation. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2024-27842](https://cve.now/CVE-2024-27842.md): The issue was addressed with improved checks. (CVSS 8.1, Apple macOS)
- [CVE-2024-23236](https://cve.now/CVE-2024-23236.md): A correctness issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-27824](https://cve.now/CVE-2024-27824.md): This issue was addressed by removing the vulnerable code. (CVSS 7.8, Apple macOS)
- [CVE-2024-27804](https://cve.now/CVE-2024-27804.md): The issue was addressed with improved memory handling. (CVSS 8.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-27829](https://cve.now/CVE-2024-27829.md): The issue was addressed with improved memory handling. (CVSS 7.5, Apple macOS)
- [CVE-2024-27852](https://cve.now/CVE-2024-27852.md): A privacy issue was addressed with improved client ID handling for alternative app marketplaces. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2024-27813](https://cve.now/CVE-2024-27813.md): The issue was addressed with improved checks. (CVSS 5.3, Apple macOS)
- [CVE-2024-27825](https://cve.now/CVE-2024-27825.md): A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2024-27798](https://cve.now/CVE-2024-27798.md): An authorization issue was addressed with improved state management. (CVSS 7.8, Apple macOS)
- [CVE-2024-4840](https://cve.now/CVE-2024-4840.md): Rhosp-director: cleartext passwords exposed in logs (CVSS 5.5, openstack-tripleo-heat-templates · Red Hat OpenStack Pla… +1)
- [CVE-2024-23576](https://cve.now/CVE-2024-23576.md): HCL Commerce is potentially affected by a denial of service and information disclosure vulnerability (CVSS 7.1, HCL Software Commerce)
- [CVE-2024-31810](https://cve.now/CVE-2024-31810.md): TOTOLINK EX200 V4.0.3c.7646\_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample. (CVSS 9.8)
- [CVE-2024-28276](https://cve.now/CVE-2024-28276.md): Sourcecodester School Task Manager 1.0 is vulnerable to Cross Site Scripting (XSS) via add-task.php?task\_name=. (CVSS 6.1)
- [CVE-2024-33433](https://cve.now/CVE-2024-33433.md): Cross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via th (CVSS 4.8)
- [CVE-2024-28279](https://cve.now/CVE-2024-28279.md): Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via book.php?bookisbn=. (CVSS 7.3)
- [CVE-2024-28277](https://cve.now/CVE-2024-28277.md): In Sourcecodester School Task Manager v1.0, a vulnerability was identified within the subject\_name= parameter, enabling Stored Cross-Site Sc (CVSS 6.1)
- [CVE-2024-34709](https://cve.now/CVE-2024-34709.md): Directus Lacks Session Tokens Invalidation (CVSS 5.4, directus)
- [CVE-2024-22774](https://cve.now/CVE-2024-22774.md): An issue in Panoramic Corporation Digital Imaging Software v.9.1.2.7600 allows a local attacker to escalate privileges via the ccsservice.ex (CVSS 7.8)
- [CVE-2024-34708](https://cve.now/CVE-2024-34708.md): Directus allows redacted data extraction on the API through "alias" (CVSS 4.9, directus)
- [CVE-2024-29513](https://cve.now/CVE-2024-29513.md): An issue in briscKernelDriver.sys in BlueRiSC WindowsSCOPE Cyber Forensics before 3.3 allows a local attacker to execute arbitrary code with (CVSS 7.8)
- [CVE-2024-35099](https://cve.now/CVE-2024-35099.md): TOTOLINK LR350 V9.3.5u.6698\_B20230810 was discovered to contain a stack overflow via the password parameter in the function loginAuth. (CVSS 9.8)
- [CVE-2024-34921](https://cve.now/CVE-2024-34921.md): TOTOLINK X5000R v9.1.0cu.2350\_B20230313 was discovered to contain a command injection via the disconnectVPN function. (CVSS 8.8)
- [CVE-2024-34707](https://cve.now/CVE-2024-34707.md): Nautobot's BANNER\_\* configuration can be used to inject arbitrary HTML content into Nautobot pages (CVSS 7.5, nautobot)
- [CVE-2024-34231](https://cve.now/CVE-2024-34231.md): A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scr (CVSS 7.1)
- [CVE-2024-34230](https://cve.now/CVE-2024-34230.md): A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scr (CVSS 6.1)
- [CVE-2024-34704](https://cve.now/CVE-2024-34704.md): era-compiler-solidity contains a \`xor(zext(cmp), -1)\` misoptimization (CVSS 5.9, matter-labs era-compiler-solidity)
- [CVE-2024-25662](https://cve.now/CVE-2024-25662.md): Oxygen XML Web Author v26.0.0 and older and Oxygen Content Fusion v6.1 and older are vulnerable to Cross-Site Scripting (XSS) for malicious (CVSS 6.1)
- [CVE-2024-28285](https://cve.now/CVE-2024-28285.md): A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-re (CVSS 9.8)
- [CVE-2024-34699](https://cve.now/CVE-2024-34699.md): GZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names. (CVSS 6.5, GZTimeWalker GZCTF)
- [CVE-2023-49781](https://cve.now/CVE-2023-49781.md): NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue (CVSS 7.3, nocodb)
- [CVE-2024-31771](https://cve.now/CVE-2024-31771.md): Insecure Permission vulnerability in TotalAV v.6.0.740 allows a local attacker to escalate privileges via a crafted file (CVSS 7.8)
- [CVE-2024-34899](https://cve.now/CVE-2024-34899.md): WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4, wwbn/avideo)
- [CVE-2023-46870](https://cve.now/CVE-2023-46870.md): extcap/nrf\_sniffer\_ble.py, extcap/nrf\_sniffer\_ble.sh, extcap/SnifferAPI/\*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1 (CVSS 7.3)
- [CVE-2024-34225](https://cve.now/CVE-2024-34225.md): Cross Site Scripting vulnerability in php-lms/admin/?page=system\_info in Computer Laboratory Management System using PHP and MySQL 1.0 allow (CVSS 6.1)
- [CVE-2024-34226](https://cve.now/CVE-2024-34226.md): SQL injection vulnerability in /php-sqlite-vms/?page=manage\_visitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to (CVSS 9.4)
- [CVE-2024-34224](https://cve.now/CVE-2024-34224.md): Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 all (CVSS 7.3)
- [CVE-2024-34221](https://cve.now/CVE-2024-34221.md): Sourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escalation. (CVSS 8.8)
- [CVE-2024-34222](https://cve.now/CVE-2024-34222.md): Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the searccountry parameter. (CVSS 5.9)
- [CVE-2024-34223](https://cve.now/CVE-2024-34223.md): Insecure permission vulnerability in /hrm/leaverequest.php in SourceCodester Human Resource Management System 1.0 allow attackers to approve (CVSS 4.3)
- [CVE-2023-50718](https://cve.now/CVE-2023-50718.md): NocoDB SQL Injection vulnerability (CVSS 6.5, nocodb)
- [CVE-2023-50717](https://cve.now/CVE-2023-50717.md): NocoDB Allows Preview of File with Dangerous Content (CVSS 5.7, nocodb)
- [CVE-2024-34706](https://cve.now/CVE-2024-34706.md): @valtimo/components exposes access token to form.io (CVSS 9.8, valtimo-platform valtimo-frontend-libraries · @valtimo/comp…)
- [CVE-2024-34701](https://cve.now/CVE-2024-34701.md): CreateWiki vulnerable to impersonation of wiki requester (CVSS 5.9, miraheze CreateWiki)
- [CVE-2024-34698](https://cve.now/CVE-2024-34698.md): Prototype Pollution in getQueryParam Function (URL Query Parser) (CVSS 4.6, freescout-helpdesk freescout)
- [CVE-2024-33250](https://cve.now/CVE-2024-33250.md): An issue in Open-Source Technology Committee SRS real-time video server RS/4.0.268(Leo) and SRS/4.0.195(Leo) allows a remote attacker to exe (CVSS 7.2)
- [CVE-2024-34697](https://cve.now/CVE-2024-34697.md): Freescout vulnerable to Stored HTML Injection in Editing Received Emails (CVSS 7.6, freescout-helpdesk freescout)
- [CVE-2020-18305](https://cve.now/CVE-2020-18305.md): Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, (CVSS 8.0)
- [CVE-2024-34353](https://cve.now/CVE-2024-34353.md): matrix-sdk-crypto contains a log exposure of private key of the server-side key backup (CVSS 5.5, matrix-org matrix-sdk-crypto · matrix-sdk-crypto)
- [CVE-2024-34081](https://cve.now/CVE-2024-34081.md): MantisBT Cross-site Scripting vulnerability (CVSS 6.6, mantisbt · mantisbt/mantisbt)
- [CVE-2024-34080](https://cve.now/CVE-2024-34080.md): MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.3, mantisbt · mantisbt/mantisbt)
- [CVE-2024-34077](https://cve.now/CVE-2024-34077.md): MantisBT user account takeover in the signup/reset password process (CVSS 7.3, mantisbt · mantisbt/mantisbt)
- [CVE-2024-34340](https://cve.now/CVE-2024-34340.md): Authentication Bypass when using using older password hashes (CVSS 9.1, cacti)
- [CVE-2024-31460](https://cve.now/CVE-2024-31460.md): Cacti SQL Injection vulnerability in lib/api\_automation.php caused by reading dirty data stored in database (CVSS 6.5, cacti)
- [CVE-2024-31459](https://cve.now/CVE-2024-31459.md): Cacti RCE vulnerability by file include in lib/plugin.php (CVSS 8.1, cacti)
- [CVE-2024-31458](https://cve.now/CVE-2024-31458.md): Cacti SQL Injection vulnerability in lib/html\_form\_templates.php by reading dirty data stored in database (CVSS 4.6, cacti)
- [CVE-2024-31445](https://cve.now/CVE-2024-31445.md): SQL Injection vulnerability in automation\_get\_new\_graphs\_sql (CVSS 8.8, cacti)
- [CVE-2024-31444](https://cve.now/CVE-2024-31444.md): Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database (CVSS 4.6, cacti)
- [CVE-2024-31443](https://cve.now/CVE-2024-31443.md): Cacti XSS vulnerability in lib/html\_tree.php by reading dirty data stored in database (CVSS 5.7, cacti)
- [CVE-2024-30268](https://cve.now/CVE-2024-30268.md): Cacti XSS vulnerability in display\_settings (CVSS 6.1, cacti)
- [CVE-2024-30259](https://cve.now/CVE-2024-30259.md): FastDDS heap buffer overflow when publisher sends malformed packet (CVSS 8.2, eProsima Fast-DDS)
- [CVE-2024-30258](https://cve.now/CVE-2024-30258.md): FastDDS crash when publisher send malformed packet (CVSS 8.2, eProsima Fast-DDS)
- [CVE-2024-29895](https://cve.now/CVE-2024-29895.md): Cacti command injection in cmd\_realtime.php (CVSS 10.0, cacti)
- [CVE-2024-29894](https://cve.now/CVE-2024-29894.md): Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API (CVSS 5.4, cacti)
- [CVE-2024-4820](https://cve.now/CVE-2024-4820.md): SourceCodester Online Computer and Laptop Store unrestricted upload (CVSS 5.3, SourceCodester Online Computer and Laptop Store)
- [CVE-2024-28866](https://cve.now/CVE-2024-28866.md): GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up (CVSS 3.1, gocd)
- [CVE-2024-27082](https://cve.now/CVE-2024-27082.md): Cacti Cross-site Scripting vulnerability when managing trees (CVSS 7.6, cacti)
- [CVE-2024-4819](https://cve.now/CVE-2024-4819.md): Campcodes Online Laundry Management System admin\_class.php improper authorization (CVSS 5.3, Campcodes Online Laundry Management System)
- [CVE-2024-25641](https://cve.now/CVE-2024-25641.md): Cacti RCE vulnerability when importing packages (CVSS 9.1, cacti)
- [CVE-2024-35050](https://cve.now/CVE-2024-35050.md): An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin. (CVSS 8.8)
- [CVE-2024-35049](https://cve.now/CVE-2024-35049.md): SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. (CVSS 9.1)
- [CVE-2024-35048](https://cve.now/CVE-2024-35048.md): An issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password. (CVSS 4.3)
- [CVE-2023-52656](https://cve.now/CVE-2023-52656.md): io\_uring: drop any code related to SCM\_RIGHTS (CVSS 7.8, Linux)
- [CVE-2024-4818](https://cve.now/CVE-2024-4818.md): Campcodes Online Laundry Management System index.php file inclusion (CVSS 6.9, Campcodes Online Laundry Management System)
- [CVE-2024-4817](https://cve.now/CVE-2024-4817.md): Campcodes Online Laundry Management System HTTP Request Parameter manage\_user.php resource injection (CVSS 5.3, Campcodes Online Laundry Management System)
- [CVE-2024-4816](https://cve.now/CVE-2024-4816.md): Ruijie RG-UAC gre\_add\_commit.php os command injection (CVSS 5.3, Ruijie RG-UAC)
- [CVE-2022-4967](https://cve.now/CVE-2022-4967.md): strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch ( (CVSS 7.7, strongSwan)
- [CVE-2024-25581](https://cve.now/CVE-2024-25581.md): Transfer requests received over DoH can lead to a denial of service in DNSdist (CVSS 7.5, PowerDNS DNSdist)
- [CVE-2024-4824](https://cve.now/CVE-2024-4824.md): SQL Injection in School ERP Pro+Responsive by AROX SOLUTION (CVSS 9.8, AROX SOLUTION School ERP Pro+Responsive)
- [CVE-2024-4823](https://cve.now/CVE-2024-4823.md): Cross-site Scripting in School ERP Pro+Responsive by AROX SOLUTION (CVSS 6.5, AROX SOLUTION School ERP Pro+Responsive)
- [CVE-2024-4822](https://cve.now/CVE-2024-4822.md): Cross-site Scripting in School ERP Pro+Responsive by AROX SOLUTION (CVSS 6.5, AROX SOLUTION School ERP Pro+Responsive)
- [CVE-2024-4825](https://cve.now/CVE-2024-4825.md): Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo (CVSS 9.8, Agentejo Cockpit CMS · cockpit-hq/cockpit)
- [CVE-2024-4815](https://cve.now/CVE-2024-4815.md): Ruijie RG-UAC detail.php os command injection (CVSS 5.3, Ruijie RG-UAC)
- [CVE-2024-27401](https://cve.now/CVE-2024-27401.md): firewire: nosy: ensure user\_length is taken into account when fetching packet contents (CVSS 7.8, Linux)
- [CVE-2024-27400](https://cve.now/CVE-2024-27400.md): drm/amdgpu: once more fix the call oder in amdgpu\_ttm\_move() v2 (CVSS 7.8, Linux)
- [CVE-2024-27399](https://cve.now/CVE-2024-27399.md): Bluetooth: l2cap: fix null-ptr-deref in l2cap\_chan\_timeout (no CVSS, Linux)
- [CVE-2024-27398](https://cve.now/CVE-2024-27398.md): Bluetooth: Fix use-after-free bugs caused by sco\_sock\_timeout (CVSS 8.0, Linux)
- [CVE-2023-52655](https://cve.now/CVE-2023-52655.md): usb: aqc111: check packet for fixup for true limit (no CVSS, Linux)
- [CVE-2024-4068](https://cve.now/CVE-2024-4068.md): Memory Exhaustion in braces (CVSS 7.5, micromatch braces · braces)
- [CVE-2024-4067](https://cve.now/CVE-2024-4067.md): Regular Expression Denial of Service in micromatch (CVSS 5.3, micromatch)
- [CVE-2024-35167](https://cve.now/CVE-2024-35167.md): WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin \<=1.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, EnvoThemes Envo's Elementor Templates & Widgets for WooComm…)
- [CVE-2024-35169](https://cve.now/CVE-2024-35169.md): WordPress All Bootstrap Blocks plugin \<= 1.3.15 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, all\_bootstrap\_blocks All Bootstrap Blocks)
- [CVE-2024-35170](https://cve.now/CVE-2024-35170.md): WordPress Sticky banner plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Hidden Depth Sticky banner)
- [CVE-2024-4814](https://cve.now/CVE-2024-4814.md): Ruijie RG-UAC static\_route\_edit\_commit.php os command injection (CVSS 5.3, Ruijie RG-UAC)
- [CVE-2024-4813](https://cve.now/CVE-2024-4813.md): Ruijie RG-UAC interface\_commit.php os command injection (CVSS 5.3, Ruijie RG-UAC)
- [CVE-2024-4747](https://cve.now/CVE-2024-4747.md): WordPress Propovoice CRM plugin \<= 1.7.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Propovoice CRM)
- [CVE-2024-32100](https://cve.now/CVE-2024-32100.md): WordPress Easy Digital Downloads plugin \<= 3.2.11 - Sensitive Data Exposure vulnerability (CVSS 5.3, Easy Digital Downloads)
- [CVE-2024-34812](https://cve.now/CVE-2024-34812.md): WordPress ShopBuilder plugin \<= 2.1.8 - Sensitive Data Exposure vulnerability (CVSS 5.3, RadiusTheme ShopBuilder – Elementor WooCommerce Builder Add…)
- [CVE-2024-35165](https://cve.now/CVE-2024-35165.md): WordPress Gutenify plugin \<= 1.4.0 - Sensitive Data Exposure via API vulnerability (CVSS 5.3, Gutenify)
- [CVE-2024-3263](https://cve.now/CVE-2024-3263.md): Improper authentication in YMS VIS Pro (CVSS 9.8, YMS VIS Pro)
- [CVE-2024-35166](https://cve.now/CVE-2024-35166.md): WordPress FileBird – WordPress Media Library Folders & File Manager plugin \<= 5.6.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, Ninja Team Filebird)
- [CVE-2024-35171](https://cve.now/CVE-2024-35171.md): WordPress Academy LMS plugin \<= 1.9.25 - Sensitive Data Exposure vulnerability (CVSS 5.3, Academy LMS)
- [CVE-2024-31377](https://cve.now/CVE-2024-31377.md): WordPress WP Photo Album Plus plugin \<= 8.7.01.001 - Unauth. Arbitrary File Upload vulnerability (CVSS 10.0, J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus)
- [CVE-2024-34411](https://cve.now/CVE-2024-34411.md): WordPress canvasio3D Light plugin \<= 2.5.0 - Arbitrary File Upload vulnerability (CVSS 9.9, Thomas Scholl canvasio3D Light)
- [CVE-2024-34416](https://cve.now/CVE-2024-34416.md): WordPress Pk Favicon Manager plugin \<= 2.1 - Arbitrary File Upload vulnerability (CVSS 9.1, Pk Favicon Manager)
- [CVE-2024-34440](https://cve.now/CVE-2024-34440.md): WordPress AI Engine plugin \<= 2.2.63 - Auth. Arbitrary File Upload vulnerability (CVSS 9.1, Jordy Meow AI Engine: ChatGPT Chatbot)
- [CVE-2024-34555](https://cve.now/CVE-2024-34555.md): WordPress Z-Downloads plugin \<= 1.11.3 - Auth. Arbitrary File Upload vulnerability (CVSS 9.1, URBAN BASE Z-Downloads)
- [CVE-2024-35172](https://cve.now/CVE-2024-35172.md): WordPress ShortPixel Adaptive Images plugin \<= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, ShortPixel Adaptive Images)
- [CVE-2024-34811](https://cve.now/CVE-2024-34811.md): WordPress WP SMS plugin \<= 6.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, VeronaLabs WP SMS)
- [CVE-2024-3462](https://cve.now/CVE-2024-3462.md): Authorization bypass in Ant Media Server (CVSS 5.4, Ant Media Server Community Edition · io.antmedia:ant-media-…)
- [CVE-2024-34749](https://cve.now/CVE-2024-34749.md): Phormer prior to version 3.35 contains a cross-site scripting vulnerability. (CVSS 6.1, Aidin Phormer)
- [CVE-2024-32700](https://cve.now/CVE-2024-32700.md): WordPress Kognetiks Chatbot for WordPress plugin \<= 2.0.0 - Arbitrary File Upload vulnerability (CVSS 10.0, Kognetiks Chatbot for WordPress)
- [CVE-2023-5052](https://cve.now/CVE-2023-5052.md): Cross Site Scripting (XSS) in Servidor Uniforme Zero (CVSS 6.3, Uniform Server Zero)
- [CVE-2024-3239](https://cve.now/CVE-2024-3239.md): PostX \< 4.0.2 - Contributor+ Stored XSS (CVSS 5.4, Post Grid Gutenberg Blocks and WordPress Blog Plugin)
- [CVE-2023-43040](https://cve.now/CVE-2023-43040.md): IBM Spectrum Fusion HCI improper access control (CVSS 6.5, IBM Spectrum Fusion HCI)
- [CVE-2024-29212](https://cve.now/CVE-2024-29212.md): Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management ag (CVSS 9.9, Veeam Service Provider Console)
- [CVE-2024-35205](https://cve.now/CVE-2024-35205.md): The WPS Office (aka cn.wps.moffice\_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them t (CVSS 7.8)
- [CVE-2024-4809](https://cve.now/CVE-2024-4809.md): SourceCodester Open Source Clinic Management System setting.php unrestricted upload (CVSS 5.3, SourceCodester Open Source Clinic Management System)
- [CVE-2024-4808](https://cve.now/CVE-2024-4808.md): Kashipara College Management System delete\_faculty.php sql injection (CVSS 5.3, Kashipara College Management System)
- [CVE-2024-26306](https://cve.now/CVE-2024-26306.md): iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption (CVSS 5.9)
- [CVE-2024-34459](https://cve.now/CVE-2024-34459.md): An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. (CVSS 7.5)
- [CVE-2024-35204](https://cve.now/CVE-2024-35204.md): Veritas System Recovery before 23.3\_Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users c (CVSS 8.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.