# CVEs published 2024-05-14

281 CVEs were published on May 14, 2024: 26 critical, 120 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2024-0437](https://cve.now/CVE-2024-0437.md): Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease \<= 2.6.6 - Missing Authorization to Sensitive Information Exposure (CVSS 4.3, saadiqbal Password Protected — Lock Entire Site, Pages, Pos…)
- [CVE-2024-4370](https://cve.now/CVE-2024-4370.md): WPZOOM Addons for Elementor (Templates, Widgets) \<= 1.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget (CVSS 6.4, WPZOOM Addons for Elementor – Starter Templates & Widgets)
- [CVE-2024-4363](https://cve.now/CVE-2024-4363.md): Visual Portfolio, Photo Gallery & Post Grid \<= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via title\_tag Parameter (CVSS 6.4, nko Visual Portfolio, Photo Gallery & Post Grid)
- [CVE-2024-31483](https://cve.now/CVE-2024-31483.md): An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. (CVSS 4.9, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31482](https://cve.now/CVE-2024-31482.md): An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. (CVSS 5.3, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31481](https://cve.now/CVE-2024-31481.md): Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. (CVSS 5.3, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31480](https://cve.now/CVE-2024-31480.md): Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. (CVSS 5.3, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31479](https://cve.now/CVE-2024-31479.md): Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. (CVSS 5.3, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31478](https://cve.now/CVE-2024-31478.md): Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. (CVSS 5.3, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31477](https://cve.now/CVE-2024-31477.md): Multiple authenticated command injection vulnerabilities exist in the command line interface. (CVSS 7.2, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-4666](https://cve.now/CVE-2024-4666.md): Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg \<= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, visualmodo Borderless – Addons and Templates for Elementor)
- [CVE-2024-31476](https://cve.now/CVE-2024-31476.md): Multiple authenticated command injection vulnerabilities exist in the command line interface. (CVSS 7.2, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31475](https://cve.now/CVE-2024-31475.md): There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management pr (CVSS 8.2, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31474](https://cve.now/CVE-2024-31474.md): There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). (CVSS 8.2, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31473](https://cve.now/CVE-2024-31473.md): There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code executi (CVSS 9.8, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31472](https://cve.now/CVE-2024-31472.md): There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code executio (CVSS 9.8, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31471](https://cve.now/CVE-2024-31471.md): There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code e (CVSS 9.8, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31470](https://cve.now/CVE-2024-31470.md): There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenti (CVSS 9.8, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31469](https://cve.now/CVE-2024-31469.md): There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code ex (CVSS 9.8, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31468](https://cve.now/CVE-2024-31468.md): There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code ex (CVSS 9.8, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-31467](https://cve.now/CVE-2024-31467.md): Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2024-35175](https://cve.now/CVE-2024-35175.md): sshpiper's Enabling of Proxy Protocol without proper feature flagging allows faking source address (CVSS 5.3, tg123 sshpiper · github.com/tg123/sshpiper)
- [CVE-2024-31466](https://cve.now/CVE-2024-31466.md): Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP)
- [CVE-2023-33327](https://cve.now/CVE-2023-33327.md): WordPress Leyka plugin \<= 3.30.2 - Privilege Escalation vulnerability (CVSS 8.8, Teplitsa of social technologies Leyka)
- [CVE-2024-4562](https://cve.now/CVE-2024-4562.md): WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via HttpMonitorSettings (CVSS 5.4, Progress Software WhatsUp Gold)
- [CVE-2024-4561](https://cve.now/CVE-2024-4561.md): WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconController (CVSS 4.2, Progress Software WhatsUp Gold)
- [CVE-2020-26312](https://cve.now/CVE-2020-26312.md): GHSL-2020-254: Arbitrary file read and/or write in dotmesh (CVSS 8.1, dotmesh-io dotmesh · github.com/dotmesh-io/dotmesh)
- [CVE-2022-28132](https://cve.now/CVE-2022-28132.md): The T-Soft E-Commerce 4 web application is susceptible to SQL injection (SQLi) attacks when authenticated as an admin or privileged user. (CVSS 7.2)
- [CVE-2024-3044](https://cve.now/CVE-2024-3044.md): Graphic on-click binding allows unchecked script execution (CVSS 6.5, The Document Foundation LibreOffice)
- [CVE-2024-31556](https://cve.now/CVE-2024-31556.md): An issue in Reportico Web before v.8.1.0 allows a local attacker to execute arbitrary code and obtain sensitive information via the sessioni (CVSS 7.8, reportico-web/reportico)
- [CVE-2021-22280](https://cve.now/CVE-2021-22280.md): DLL Hijacking Vulnerability in Automation Studio (CVSS 7.2, B&R Industrial Automation Automation Studio)
- [CVE-2024-32465](https://cve.now/CVE-2024-32465.md): Git's protections for cloning untrusted repositories can be bypassed (CVSS 7.4, git)
- [CVE-2024-32021](https://cve.now/CVE-2024-32021.md): Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory (CVSS 3.9, git)
- [CVE-2024-3676](https://cve.now/CVE-2024-3676.md): The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an un (CVSS 7.5, Proofpoint Enterprise Protection)
- [CVE-2024-0862](https://cve.now/CVE-2024-0862.md): The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains a Server-Side Request Forgery vulnerability that allows an a (CVSS 5.0, Proofpoint Enterprise Protection)
- [CVE-2024-32020](https://cve.now/CVE-2024-32020.md): Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will (CVSS 3.9, git)
- [CVE-2024-2637](https://cve.now/CVE-2024-2637.md): Insecure Loading of Code in B&R Products (CVSS 7.2, B&R Industrial Automation Scene Viewer · B&R Industrial… +19)
- [CVE-2024-32004](https://cve.now/CVE-2024-32004.md): Git vulnerable to Remote Code Execution while cloning special-crafted local repositories (CVSS 8.2, git)
- [CVE-2024-32002](https://cve.now/CVE-2024-32002.md): Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution (CVSS 9.1, git)
- [CVE-2024-33485](https://cve.now/CVE-2024-33485.md): SQL Injection vulnerability in CASAP Automated Enrollment System using PHP/MySQLi with Source Code V1.0 allows a remote attacker to obtain s (CVSS 9.8)
- [CVE-2024-4778](https://cve.now/CVE-2024-4778.md): Memory safety bugs present in Firefox 125. (CVSS 9.8, Mozilla Firefox)
- [CVE-2024-4776](https://cve.now/CVE-2024-4776.md): A file dialog shown while in full-screen mode could have resulted in the window remaining disabled. (CVSS 8.2, Mozilla Firefox)
- [CVE-2024-4775](https://cve.now/CVE-2024-4775.md): An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and un (CVSS 5.9, Mozilla Firefox)
- [CVE-2024-4774](https://cve.now/CVE-2024-4774.md): The \`ShmemCharMapHashEntry()\` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data mem (CVSS 6.5, Mozilla Firefox)
- [CVE-2024-4773](https://cve.now/CVE-2024-4773.md): When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. (CVSS 7.5, Mozilla Firefox)
- [CVE-2024-4772](https://cve.now/CVE-2024-4772.md): An HTTP digest authentication nonce value was generated using \`rand()\` which could lead to predictable values. (CVSS 5.9, Mozilla Firefox)
- [CVE-2024-4771](https://cve.now/CVE-2024-4771.md): A memory allocation check was missing which would lead to a use-after-free if the allocation failed. (CVSS 8.6, Mozilla Firefox)
- [CVE-2024-4766](https://cve.now/CVE-2024-4766.md): Different techniques existed to obscure the fullscreen notification in Firefox for Android. (CVSS 4.3, Mozilla Firefox)
- [CVE-2024-4765](https://cve.now/CVE-2024-4765.md): Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's ma (CVSS 8.1, Mozilla Firefox)
- [CVE-2024-4764](https://cve.now/CVE-2024-4764.md): Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. (CVSS 9.8, Mozilla Firefox)
- [CVE-2024-4777](https://cve.now/CVE-2024-4777.md): Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-4770](https://cve.now/CVE-2024-4770.md): When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-4769](https://cve.now/CVE-2024-4769.md): When importing resources using Web Workers, error messages would distinguish the difference between \`application/javascript\` responses and n (CVSS 5.9, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-4768](https://cve.now/CVE-2024-4768.md): A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. (CVSS 6.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-4767](https://cve.now/CVE-2024-4767.md): If the \`browser.privatebrowsing.autostart\` preference is enabled, IndexedDB files were not properly deleted when the window was closed. (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-4367](https://cve.now/CVE-2024-4367.md): A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. (CVSS 5.6, Mozilla Firefox · Mozilla Thunderbird +1)
- [CVE-2024-27110](https://cve.now/CVE-2024-27110.md): Elevation of privilege vulnerability in GE HealthCare EchoPAC products (CVSS 8.4, GE HealthCare EchoPAC Software Only · GE HealthCare Imag… +1)
- [CVE-2024-27109](https://cve.now/CVE-2024-27109.md): Insufficiently protected credentials in GE HealthCare EchoPAC products (CVSS 7.6, GE HealthCare EchoPAC Software Only · GE HealthCare Imag… +1)
- [CVE-2024-27108](https://cve.now/CVE-2024-27108.md): Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products (CVSS 6.8, GE HealthCare EchoPAC Software Only · GE HealthCare Imag… +1)
- [CVE-2024-27107](https://cve.now/CVE-2024-27107.md): Weak account password in GE HealthCare EchoPAC products (CVSS 9.6, GE HealthCare EchoPAC Software Only · GE HealthCare Imag… +1)
- [CVE-2024-27106](https://cve.now/CVE-2024-27106.md): Vulnerable data in transit in GE HealthCare EchoPAC products (CVSS 5.7, GE HealthCare EchoPAC Software Only · GE HealthCare Imag… +1)
- [CVE-2024-30054](https://cve.now/CVE-2024-30054.md): Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability (CVSS 6.5, Microsoft PowerBI-client JS SDK · Microsoft.PowerBI.JavaScr…)
- [CVE-2024-30051](https://cve.now/CVE-2024-30051.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2024-30049](https://cve.now/CVE-2024-30049.md): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30048](https://cve.now/CVE-2024-30048.md): Dynamics 365 Customer Insights Spoofing Vulnerability (CVSS 7.6, Microsoft Dynamics)
- [CVE-2024-30047](https://cve.now/CVE-2024-30047.md): Dynamics 365 Customer Insights Spoofing Vulnerability (CVSS 7.6, Microsoft Dynamics)
- [CVE-2024-30046](https://cve.now/CVE-2024-30046.md): Visual Studio Denial of Service Vulnerability (CVSS 5.9, Microsoft .NET · Microsoft Visual Studio +12)
- [CVE-2024-30045](https://cve.now/CVE-2024-30045.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 6.3, Microsoft .NET · Microsoft Visual Studio +13)
- [CVE-2024-30043](https://cve.now/CVE-2024-30043.md): Microsoft SharePoint Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-30042](https://cve.now/CVE-2024-30042.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office Online Server · Microsoft Office +2)
- [CVE-2024-30041](https://cve.now/CVE-2024-30041.md): Microsoft Bing Search Spoofing Vulnerability (CVSS 5.4, Microsoft Bing Search for iOS)
- [CVE-2024-30040](https://cve.now/CVE-2024-30040.md): Windows MSHTML Platform Security Feature Bypass Vulnerability (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2024-30039](https://cve.now/CVE-2024-30039.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-30038](https://cve.now/CVE-2024-30038.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30037](https://cve.now/CVE-2024-30037.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-30036](https://cve.now/CVE-2024-30036.md): Windows Deployment Services Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2024-30035](https://cve.now/CVE-2024-30035.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30034](https://cve.now/CVE-2024-30034.md): Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-30033](https://cve.now/CVE-2024-30033.md): Windows Search Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-30032](https://cve.now/CVE-2024-30032.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30031](https://cve.now/CVE-2024-30031.md): Windows CNG Key Isolation Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30030](https://cve.now/CVE-2024-30030.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server 2008 Service Pack · Microsoft W… +1)
- [CVE-2024-30029](https://cve.now/CVE-2024-30029.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-30028](https://cve.now/CVE-2024-30028.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30027](https://cve.now/CVE-2024-30027.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30025](https://cve.now/CVE-2024-30025.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30024](https://cve.now/CVE-2024-30024.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-29994](https://cve.now/CVE-2024-29994.md): Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26238](https://cve.now/CVE-2024-26238.md): Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30059](https://cve.now/CVE-2024-30059.md): Microsoft Intune for Android Mobile Application Management Tampering Vulnerability (CVSS 6.1, Microsoft Intune Mobile Application Management)
- [CVE-2024-30053](https://cve.now/CVE-2024-30053.md): Azure Migrate Cross-Site Scripting Vulnerability (CVSS 6.5, Microsoft Azure Migrate)
- [CVE-2024-30050](https://cve.now/CVE-2024-30050.md): Windows Mark of the Web Security Feature Bypass Vulnerability (CVSS 5.4, Microsoft Windows)
- [CVE-2024-30044](https://cve.now/CVE-2024-30044.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-30023](https://cve.now/CVE-2024-30023.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-30022](https://cve.now/CVE-2024-30022.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-30021](https://cve.now/CVE-2024-30021.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-30020](https://cve.now/CVE-2024-30020.md): Windows Cryptographic Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-30019](https://cve.now/CVE-2024-30019.md): DHCP Server Service Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2024-30018](https://cve.now/CVE-2024-30018.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30017](https://cve.now/CVE-2024-30017.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-30016](https://cve.now/CVE-2024-30016.md): Windows Cryptographic Services Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-30015](https://cve.now/CVE-2024-30015.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-30014](https://cve.now/CVE-2024-30014.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-30012](https://cve.now/CVE-2024-30012.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-30011](https://cve.now/CVE-2024-30011.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2024-30010](https://cve.now/CVE-2024-30010.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server)
- [CVE-2024-30009](https://cve.now/CVE-2024-30009.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-30008](https://cve.now/CVE-2024-30008.md): Windows DWM Core Library Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-30007](https://cve.now/CVE-2024-30007.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows Server 2022, 23H2 Edition)
- [CVE-2024-30006](https://cve.now/CVE-2024-30006.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-30005](https://cve.now/CVE-2024-30005.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-30004](https://cve.now/CVE-2024-30004.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-30003](https://cve.now/CVE-2024-30003.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-30002](https://cve.now/CVE-2024-30002.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-30001](https://cve.now/CVE-2024-30001.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-30000](https://cve.now/CVE-2024-30000.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-29999](https://cve.now/CVE-2024-29999.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-29998](https://cve.now/CVE-2024-29998.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-29997](https://cve.now/CVE-2024-29997.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-29996](https://cve.now/CVE-2024-29996.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-1630](https://cve.now/CVE-2024-1630.md): Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component (CVSS 7.7, GE HealthCare Venue · GE HealthCare LOGIQ e +9)
- [CVE-2024-1629](https://cve.now/CVE-2024-1629.md): Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component (CVSS 6.2, GE HealthCare Venue · GE HealthCare LOGIQ e +10)
- [CVE-2023-24204](https://cve.now/CVE-2023-24204.md): SQL injection vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitrary code (CVSS 5.4)
- [CVE-2023-36640](https://cve.now/CVE-2023-36640.md): A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, (CVSS 6.2, Fortinet FortiOS · Fortinet FortiPAM +1)
- [CVE-2023-45583](https://cve.now/CVE-2023-45583.md): A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, (CVSS 6.2, Fortinet FortiOS · Fortinet FortiProxy +2)
- [CVE-2024-23105](https://cve.now/CVE-2024-23105.md): A Use Of Less Trusted Source \[CWE-348\] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 all (CVSS 7.1, Fortinet FortiPortal)
- [CVE-2023-50180](https://cve.now/CVE-2023-50180.md): An exposure of sensitive system information to an unauthorized control sphere vulnerability \[CWE-497\] in FortiADC version 7.4.1 and below, v (CVSS 5.2, Fortinet FortiADC)
- [CVE-2023-46714](https://cve.now/CVE-2023-46714.md): A stack-based buffer overflow \[CWE-121\] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows (CVSS 6.8, Fortinet FortiOS)
- [CVE-2023-44247](https://cve.now/CVE-2023-44247.md): A double free vulnerability \[CWE-415\] vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacker to execute code or (CVSS 6.5, Fortinet FortiOS)
- [CVE-2023-40720](https://cve.now/CVE-2023-40720.md): An authorization bypass through user-controlled key vulnerability \[CWE-639\] in FortiVoiceEntreprise version 7.0.0 through 7.0.1 and before 6 (CVSS 6.7, Fortinet FortiVoice)
- [CVE-2023-45586](https://cve.now/CVE-2023-45586.md): An insufficient verification of data authenticity vulnerability \[CWE-345\] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4. (CVSS 4.7, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2024-26007](https://cve.now/CVE-2024-26007.md): An improper check or handling of exceptional conditions vulnerability \[CWE-703\] in Fortinet FortiOS version 7.4.1 allows an unauthenticated (CVSS 5.0, Fortinet FortiOS)
- [CVE-2024-31488](https://cve.now/CVE-2024-31488.md): An improper neutralization of inputs during web page generation vulnerability \[CWE-79\] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 throug (CVSS 6.1, Fortinet FortiNAC)
- [CVE-2024-31491](https://cve.now/CVE-2024-31491.md): A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2 (CVSS 8.6, Fortinet FortiSandbox)
- [CVE-2023-24203](https://cve.now/CVE-2023-24203.md): Cross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitary (CVSS 5.4)
- [CVE-2024-26367](https://cve.now/CVE-2024-26367.md): Cross Site Scripting vulnerability in Evertz microsystems MViP-II Firmware 8.6.5, XPS-EDGE-\* Build 1467, evEDGE-EO-\* Build 0029, MMA10G-\* Bu (CVSS 6.1)
- [CVE-2024-1628](https://cve.now/CVE-2024-1628.md): OS command injection vulnerabilities in GE HealthCare ultrasound devices (CVSS 8.4, GE HealthCare Venue · GE HealthCare LOGIQ e +11)
- [CVE-2024-32355](https://cve.now/CVE-2024-32355.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setS (CVSS 8.0)
- [CVE-2024-32354](https://cve.now/CVE-2024-32354.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain a command injection vulnerability via the 'timeout' parameter in the setSS (CVSS 6.0)
- [CVE-2024-32353](https://cve.now/CVE-2024-32353.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSSer (CVSS 9.8)
- [CVE-2024-32352](https://cve.now/CVE-2024-32352.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ips (CVSS 8.8)
- [CVE-2024-32351](https://cve.now/CVE-2024-32351.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mru (CVSS 8.8)
- [CVE-2024-32350](https://cve.now/CVE-2024-32350.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ips (CVSS 8.8)
- [CVE-2024-32349](https://cve.now/CVE-2024-32349.md): TOTOLINK X5000R V9.1.0cu.2350\_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu (CVSS 6.0)
- [CVE-2024-34717](https://cve.now/CVE-2024-34717.md): Anonymous PrestaShop customer can download other customers' invoices (CVSS 5.3, PrestaShop · prestashop/prestashop)
- [CVE-2024-34716](https://cve.now/CVE-2024-34716.md): PrestaShop vulnerable to XSS via customer contact form in FO, through file upload (CVSS 9.7, PrestaShop · prestashop/prestashop)
- [CVE-2024-34191](https://cve.now/CVE-2024-34191.md): htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete\_post() function at admin.php. (CVSS 6.5)
- [CVE-2024-34950](https://cve.now/CVE-2024-34950.md): D-Link DIR-822+ v1.0.5 was discovered to contain a stack-based buffer overflow vulnerability in the SetNetworkTomographySettings module. (CVSS 7.5)
- [CVE-2024-34243](https://cve.now/CVE-2024-34243.md): Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter. (CVSS 5.4, kongadmin)
- [CVE-2024-34914](https://cve.now/CVE-2024-34914.md): php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember\_key value. (CVSS 5.3, php-censor/php-censor)
- [CVE-2024-1486](https://cve.now/CVE-2024-1486.md): Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices (CVSS 7.4, GE HealthCare Venue · GE HealthCare LOGIQ e +6)
- [CVE-2024-1598](https://cve.now/CVE-2024-1598.md): Potential buffer overflow when handling UEFI variables (CVSS 7.5, Phoenix SecureCore™ for Intel Gemini Lake)
- [CVE-2024-0762](https://cve.now/CVE-2024-0762.md): Potential buffer overflow when handling UEFI variables (CVSS 7.5, Phoenix SecureCore™ for Intel Kaby Lake · Phoenix Secure… +7)
- [CVE-2023-35841](https://cve.now/CVE-2023-35841.md): WinFlash Driver Permissions Issue (CVSS 7.8, Phoenix WinFlash Driver)
- [CVE-2024-34714](https://cve.now/CVE-2024-34714.md): Hoppscotch Extension responds to calls made by origins not in the domain list (CVSS 7.6, hoppscotch-extension)
- [CVE-2024-34256](https://cve.now/CVE-2024-34256.md): OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function. (CVSS 9.8)
- [CVE-2024-34713](https://cve.now/CVE-2024-34713.md): sshproxy vulnerable to SSH option injection (CVSS 3.5, cea-hpc sshproxy · github.com/cea-hpc/sshproxy)
- [CVE-2024-34712](https://cve.now/CVE-2024-34712.md): Oceanic allows unsanitized user input to lead to path traversal in URLs (CVSS 6.5, OceanicJS Oceanic · oceanic.js)
- [CVE-2024-4871](https://cve.now/CVE-2024-4871.md): Foreman: host ssh key not being checked in remote execution (CVSS 6.8, foreman · Red Hat Satellite 6.15 for RHEL)
- [CVE-2024-34358](https://cve.now/CVE-2024-34358.md): TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController (CVSS 5.3, typo3 · typo3/cms-core)
- [CVE-2024-34357](https://cve.now/CVE-2024-34357.md): TYPO3 vulnerable to Cross-Site Scripting in ShowImageController (CVSS 5.4, typo3 · typo3/cms-core)
- [CVE-2024-34356](https://cve.now/CVE-2024-34356.md): TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module (CVSS 5.4, typo3 · typo3/cms-core)
- [CVE-2024-34355](https://cve.now/CVE-2024-34355.md): TYPO3 vulnerable to an HTML Injection in the History Module (CVSS 3.5, typo3 · typo3/cms-core)
- [CVE-2024-35012](https://cve.now/CVE-2024-35012.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType\_deal.php?mudi=add&nohrefStr=clo (CVSS 6.3)
- [CVE-2024-35011](https://cve.now/CVE-2024-35011.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType\_deal.php?mudi=rev&nohrefStr=clo (CVSS 5.4)
- [CVE-2024-35010](https://cve.now/CVE-2024-35010.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/banner\_deal.php?mudi=del&dataType=&dataT (CVSS 8.8)
- [CVE-2024-35009](https://cve.now/CVE-2024-35009.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share\_switch.php?mudi=switch&dataType=&f (CVSS 8.8)
- [CVE-2024-32977](https://cve.now/CVE-2024-32977.md): OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled (CVSS 7.1, OctoPrint)
- [CVE-2024-1914](https://cve.now/CVE-2024-1914.md): An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible. (CVSS 6.5, ABB RobotWare)
- [CVE-2024-33868](https://cve.now/CVE-2024-33868.md): An issue was discovered in linqi before 1.4.0.1 on Windows. (CVSS 9.8)
- [CVE-2024-33867](https://cve.now/CVE-2024-33867.md): An issue was discovered in linqi before 1.4.0.1 on Windows. (CVSS 4.8)
- [CVE-2024-33866](https://cve.now/CVE-2024-33866.md): An issue was discovered in linqi before 1.4.0.1 on Windows. (CVSS 5.5)
- [CVE-2024-33865](https://cve.now/CVE-2024-33865.md): An issue was discovered in linqi before 1.4.0.1 on Windows. (CVSS 7.5)
- [CVE-2024-33864](https://cve.now/CVE-2024-33864.md): An issue was discovered in linqi before 1.4.0.1 on Windows. (CVSS 5.9)
- [CVE-2024-33863](https://cve.now/CVE-2024-33863.md): An issue was discovered in linqi before 1.4.0.1 on Windows. (CVSS 9.8)
- [CVE-2024-3374](https://cve.now/CVE-2024-3374.md): MongoDB Server (mongod) may crash when generating ftdc (CVSS 5.3, MongoDB Server)
- [CVE-2024-3372](https://cve.now/CVE-2024-3372.md): MongoDB Server may have unexpected application behaviour due to invalid BSON (CVSS 7.5, MongoDB Server)
- [CVE-2024-1913](https://cve.now/CVE-2024-1913.md): An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible, or exec (CVSS 7.6, ABB RobotWare)
- [CVE-2024-22270](https://cve.now/CVE-2024-22270.md): VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. (CVSS 7.1, VMware Workstation · VMware Fusion)
- [CVE-2024-22269](https://cve.now/CVE-2024-22269.md): VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. (CVSS 7.1, VMware Workstation · VMware Fusion)
- [CVE-2024-22268](https://cve.now/CVE-2024-22268.md): VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. (CVSS 7.1, VMware Workstation · VMware Fusion)
- [CVE-2024-22267](https://cve.now/CVE-2024-22267.md): VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. (CVSS 9.3, VMware Workstation · VMware Fusion)
- [CVE-2024-4333](https://cve.now/CVE-2024-4333.md): Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) \<= 3.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting (CVSS 6.4, shaonsina Sina Extension for Elementor)
- [CVE-2024-4473](https://cve.now/CVE-2024-4473.md): Sydney Toolbox \<= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget (CVSS 6.4, smub Sydney Toolbox)
- [CVE-2024-4624](https://cve.now/CVE-2024-4624.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-32077](https://cve.now/CVE-2024-32077.md): Apache Airflow: XSS vulnerability in Task Instance Log/Log Details (CVSS 5.4, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-34773](https://cve.now/CVE-2024-34773.md): A vulnerability has been identified in Solid Edge (All versions \< V224.0 Update 2). (CVSS 7.8, Siemens Solid Edge)
- [CVE-2024-34772](https://cve.now/CVE-2024-34772.md): A vulnerability has been identified in Solid Edge (All versions \< V224.0 Update 4). (CVSS 7.8, Siemens Solid Edge)
- [CVE-2024-34771](https://cve.now/CVE-2024-34771.md): A vulnerability has been identified in Solid Edge (All versions \< V224.0 Update 2). (CVSS 7.8, Siemens Solid Edge)
- [CVE-2024-34086](https://cve.now/CVE-2024-34086.md): A vulnerability has been identified in JT2Go (All versions \< V2312.0001), Teamcenter Visualization V14.1 (All versions \< V14.1.0.13), Teamce (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2024-34085](https://cve.now/CVE-2024-34085.md): A vulnerability has been identified in JT2Go (All versions \< V2312.0001), Teamcenter Visualization V14.1 (All versions \< V14.1.0.13), Teamce (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2024-33647](https://cve.now/CVE-2024-33647.md): A vulnerability has been identified in Polarion ALM (All versions \< V2404.0). (CVSS 6.5, Siemens Polarion ALM)
- [CVE-2024-33583](https://cve.now/CVE-2024-33583.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions \< V3.0.1.1), SIMATIC RTLS Locating Manage (CVSS 3.3, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2024-33577](https://cve.now/CVE-2024-33577.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-33499](https://cve.now/CVE-2024-33499.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions \< V3.0.1.1), SIMATIC RTLS Locating Manage (CVSS 9.1, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2024-33498](https://cve.now/CVE-2024-33498.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions \< V3.0.1.1), SIMATIC RTLS Locating Manage (CVSS 5.3, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2024-33497](https://cve.now/CVE-2024-33497.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions \< V3.0.1.1), SIMATIC RTLS Locating Manage (CVSS 6.3, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2024-33496](https://cve.now/CVE-2024-33496.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions \< V3.0.1.1), SIMATIC RTLS Locating Manage (CVSS 6.3, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2024-33495](https://cve.now/CVE-2024-33495.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions \< V3.0.1.1), SIMATIC RTLS Locating Manage (CVSS 6.5, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2024-33494](https://cve.now/CVE-2024-33494.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions \< V3.0.1.1), SIMATIC RTLS Locating Manage (CVSS 6.5, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2024-33493](https://cve.now/CVE-2024-33493.md): A vulnerability has been identified in Solid Edge (All versions \< V224.0 Update 5). (CVSS 7.8, Siemens Solid Edge)
- [CVE-2024-33492](https://cve.now/CVE-2024-33492.md): A vulnerability has been identified in Solid Edge (All versions \< V224.0 Update 5). (CVSS 7.8, Siemens Solid Edge)
- [CVE-2024-33491](https://cve.now/CVE-2024-33491.md): A vulnerability has been identified in Solid Edge (All versions \< V224.0 Update 5). (CVSS 7.8, Siemens Solid Edge)
- [CVE-2024-33490](https://cve.now/CVE-2024-33490.md): A vulnerability has been identified in Solid Edge (All versions \< V224.0 Update 5). (CVSS 7.8, Siemens Solid Edge)
- [CVE-2024-33489](https://cve.now/CVE-2024-33489.md): A vulnerability has been identified in Solid Edge (All versions \< V224.0 Update 5). (CVSS 7.8, Siemens Solid Edge)
- [CVE-2024-32742](https://cve.now/CVE-2024-32742.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V3.0). (CVSS 7.6, Siemens SIMATIC CN)
- [CVE-2024-32741](https://cve.now/CVE-2024-32741.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V3.0). (CVSS 10.0, Siemens SIMATIC CN)
- [CVE-2024-32740](https://cve.now/CVE-2024-32740.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V3.0). (CVSS 9.8, Siemens SIMATIC CN)
- [CVE-2024-32639](https://cve.now/CVE-2024-32639.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions \< V2302.0011). (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-32637](https://cve.now/CVE-2024-32637.md): A vulnerability has been identified in JT2Go (All versions \< V2312.0005), Teamcenter Visualization V14.2 (All versions \< V14.2.0.12), Teamce (CVSS 3.3, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2024-32636](https://cve.now/CVE-2024-32636.md): A vulnerability has been identified in JT2Go (All versions \< V2312.0005), Teamcenter Visualization V14.2 (All versions \< V14.2.0.12), Teamce (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2024-32635](https://cve.now/CVE-2024-32635.md): A vulnerability has been identified in JT2Go (All versions \< V2312.0005), Teamcenter Visualization V14.2 (All versions \< V14.2.0.12), Teamce (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2024-32066](https://cve.now/CVE-2024-32066.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-32065](https://cve.now/CVE-2024-32065.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-32064](https://cve.now/CVE-2024-32064.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-32063](https://cve.now/CVE-2024-32063.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-32062](https://cve.now/CVE-2024-32062.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-32061](https://cve.now/CVE-2024-32061.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-32060](https://cve.now/CVE-2024-32060.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-32059](https://cve.now/CVE-2024-32059.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-32058](https://cve.now/CVE-2024-32058.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-32057](https://cve.now/CVE-2024-32057.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-32055](https://cve.now/CVE-2024-32055.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-31980](https://cve.now/CVE-2024-31980.md): A vulnerability has been identified in Parasolid V35.1 (All versions \< V35.1.256), Parasolid V36.0 (All versions \< V36.0.210), Parasolid V36 (CVSS 7.8, Siemens Parasolid)
- [CVE-2024-31486](https://cve.now/CVE-2024-31486.md): A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions \< V5.30). (CVSS 5.3, Siemens OPUPI0 AMQP/MQTT)
- [CVE-2024-31485](https://cve.now/CVE-2024-31485.md): A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \< V5.30), SICORE Base system (All versions \< V1 (CVSS 7.2, Siemens CPCI85 Central Processing/Communication · Siemens S…)
- [CVE-2024-31484](https://cve.now/CVE-2024-31484.md): A vulnerability has been identified in CPC80 Central Processing/Communication (All versions \< V16.41), CPCI85 Central Processing/Communicati (CVSS 7.8, Siemens CPC80 Central Processing/Communication · Siemens… +4)
- [CVE-2024-30209](https://cve.now/CVE-2024-30209.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions \< V3.0.1.1), SIMATIC RTLS Locating Manage (CVSS 9.6, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2024-30208](https://cve.now/CVE-2024-30208.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions \< V3.0.1.1), SIMATIC RTLS Locating Manage (CVSS 6.3, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2024-30207](https://cve.now/CVE-2024-30207.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions \< V3.0.1.1), SIMATIC RTLS Locating Manage (CVSS 10.0, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2024-30206](https://cve.now/CVE-2024-30206.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions \< V3.0.1.1), SIMATIC RTLS Locating Manage (CVSS 8.8, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2024-27947](https://cve.now/CVE-2024-27947.md): A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \< V5.5). (CVSS 5.3, Siemens RUGGEDCOM CROSSBOW)
- [CVE-2024-27946](https://cve.now/CVE-2024-27946.md): A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \< V5.5). (CVSS 6.5, Siemens RUGGEDCOM CROSSBOW)
- [CVE-2024-27945](https://cve.now/CVE-2024-27945.md): A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \< V5.5). (CVSS 7.2, Siemens RUGGEDCOM CROSSBOW)
- [CVE-2024-27944](https://cve.now/CVE-2024-27944.md): A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \< V5.5). (CVSS 7.2, Siemens RUGGEDCOM CROSSBOW)
- [CVE-2024-27943](https://cve.now/CVE-2024-27943.md): A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \< V5.5). (CVSS 7.2, Siemens RUGGEDCOM CROSSBOW)
- [CVE-2024-27942](https://cve.now/CVE-2024-27942.md): A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \< V5.5). (CVSS 7.5, Siemens RUGGEDCOM CROSSBOW)
- [CVE-2024-27941](https://cve.now/CVE-2024-27941.md): A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \< V5.5). (CVSS 8.8, Siemens RUGGEDCOM CROSSBOW)
- [CVE-2024-27940](https://cve.now/CVE-2024-27940.md): A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \< V5.5). (CVSS 8.8, Siemens RUGGEDCOM CROSSBOW)
- [CVE-2024-27939](https://cve.now/CVE-2024-27939.md): A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \< V5.5). (CVSS 9.8, Siemens RUGGEDCOM CROSSBOW)
- [CVE-2023-46280](https://cve.now/CVE-2023-46280.md): A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions \< V5.0 SP2), (CVSS 6.5, Siemens Security Configuration Tool · Siemens SIMATIC A… +17)
- [CVE-2024-4440](https://cve.now/CVE-2024-4440.md): 140+ Widgets | Best Addons For Elementor – FREE \<= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2024-4860](https://cve.now/CVE-2024-4860.md): The 'WordPress RSS Aggregator' WordPress Plugin, versions \< 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lac (CVSS 5.4, wp-rss-aggregator)
- [CVE-2024-4859](https://cve.now/CVE-2024-4859.md): Solidus \<= 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL. (CVSS 5.7, solidus)
- [CVE-2024-3579](https://cve.now/CVE-2024-3579.md): XSS in Online Shopping System Advanced (CVSS 6.1, Puneeth Reddy Online Shopping System Advanced)
- [CVE-2024-4392](https://cve.now/CVE-2024-4392.md): Jetpack – WP Security, Backup, Speed, & Growth \<= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode (CVSS 6.4, automattic Jetpack – WP Security, Backup, Speed, & Growth)
- [CVE-2024-28137](https://cve.now/CVE-2024-28137.md): PHOENIX CONTACT: privilege escalation due to a TOCTOU vulnerability in the CHARX Series (CVSS 7.8, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-28136](https://cve.now/CVE-2024-28136.md): PHOENIX CONTACT: command injection gains root privileges using the OCPP remote service (CVSS 7.8, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-28135](https://cve.now/CVE-2024-28135.md): PHOENIX CONTACT: command injection vulnerability in the API of the CHARX Series (CVSS 5.0, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-28134](https://cve.now/CVE-2024-28134.md): PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series (CVSS 7.0, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-28133](https://cve.now/CVE-2024-28133.md): PHOENIX CONTACT: Privilege escalation in CHARX Series (CVSS 7.8, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-25969](https://cve.now/CVE-2024-25969.md): Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. (CVSS 6.2, Dell PowerScale OneFS)
- [CVE-2024-25965](https://cve.now/CVE-2024-25965.md): Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. (CVSS 6.1, Dell PowerScale OneFS)
- [CVE-2024-25966](https://cve.now/CVE-2024-25966.md): Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2024-25970](https://cve.now/CVE-2024-25970.md): Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. (CVSS 6.5, Dell PowerScale OneFS)
- [CVE-2024-25967](https://cve.now/CVE-2024-25967.md): Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2024-25968](https://cve.now/CVE-2024-25968.md): Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. (CVSS 5.9, Dell PowerScale OneFS)
- [CVE-2024-3241](https://cve.now/CVE-2024-3241.md): Ultimate Blocks \< 3.1.7 - Contributor+ Stored XSS (CVSS 5.4, Ultimate Blocks)
- [CVE-2024-4144](https://cve.now/CVE-2024-4144.md): Simple Basic Contact Form \<= 20240502 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, wpkube Simple Basic Contact Form)
- [CVE-2024-4445](https://cve.now/CVE-2024-4445.md): WP Compress – Image Optimizer \[All-In-One\] \<= 6.20.01 - Missing Authorization (CVSS 6.5, aresit WP Compress – Instant Performance & Speed Optimizati…)
- [CVE-2024-33006](https://cve.now/CVE-2024-33006.md): File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform (CVSS 9.6, SAP\_SE SAP NetWeaver Application Server ABAP and ABAP Platf…)
- [CVE-2024-33004](https://cve.now/CVE-2024-33004.md): Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices) (CVSS 4.3, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2024-33009](https://cve.now/CVE-2024-33009.md): SQL injection vulnerability in SAP Global Label Management (GLM) (CVSS 4.2, SAP\_SE SAP Global Label Management)
- [CVE-2024-34687](https://cve.now/CVE-2024-34687.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform (CVSS 6.5, SAP\_SE SAP NetWeaver Application server for ABAP and ABAP P…)
- [CVE-2024-4138](https://cve.now/CVE-2024-4138.md): Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules) (CVSS 4.3, SAP\_SE SAP S/4 HANA)
- [CVE-2024-4139](https://cve.now/CVE-2024-4139.md): Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules) (CVSS 4.3, SAP\_SE SAP S/4 HANA)
- [CVE-2024-28165](https://cve.now/CVE-2024-28165.md): Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform (CVSS 8.1, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2024-33002](https://cve.now/CVE-2024-33002.md): Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS) (CVSS 6.1, SAP\_SE SAP S/4HANA)
- [CVE-2024-33000](https://cve.now/CVE-2024-33000.md): Missing Authorization check in SAP Bank Account Management (CVSS 3.5, SAP\_SE SAP Bank Account Management)
- [CVE-2024-33008](https://cve.now/CVE-2024-33008.md): Memory Corruption vulnerability in SAP Replication Server (CVSS 4.9, SAP\_SE SAP Replication Server)
- [CVE-2024-33007](https://cve.now/CVE-2024-33007.md): Client-side script execution vulnerability in SAP UI5(PDFViewer) (CVSS 3.5, SAP\_SE SAPUI5)
- [CVE-2024-32733](https://cve.now/CVE-2024-32733.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform (CVSS 6.1, SAP\_SE SAP NetWeaver Application Server ABAP and ABAP Platf…)
- [CVE-2024-32731](https://cve.now/CVE-2024-32731.md): Missing Authorization check in SAP My Travel Requests (CVSS 5.5, SAP\_SE SAP My Travel Requests)
- [CVE-2024-0870](https://cve.now/CVE-2024-0870.md): YITH WooCommerce Gift Cards \<= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update (CVSS 5.3, yithemes YITH WooCommerce Gift Cards)
- [CVE-2024-4761](https://cve.now/CVE-2024-4761.md): Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a (CVSS 8.3, KEV, Google Chrome)
- [CVE-2023-6812](https://cve.now/CVE-2023-6812.md): WP Compress – Image Optimizer \[All-In-One\] \<= 6.20.01 - Open Redirect via css (CVSS 4.3, aresit WP Compress – Instant Performance & Speed Optimizati…)
- [CVE-2024-4712](https://cve.now/CVE-2024-4712.md): Arbitrary File Creation in PaperCut NG/MF Web Print Image Handler (CVSS 7.8, PaperCut NG, PaperCut MF)
- [CVE-2024-3037](https://cve.now/CVE-2024-3037.md): Arbitrary File Deletion in PaperCut NG/MF Web Print (CVSS 7.8, PaperCut NG, PaperCut MF)
- [CVE-2024-4855](https://cve.now/CVE-2024-4855.md): Use After Free in editcap (CVSS 3.6, Wireshark Foundation editcap)
- [CVE-2024-4854](https://cve.now/CVE-2024-4854.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 6.4, Wireshark Foundation Wireshark)
- [CVE-2024-4853](https://cve.now/CVE-2024-4853.md): Mismatched Memory Management Routines in editcap (CVSS 3.6, Wireshark Foundation editcap)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.