# CVEs published 2024-05-27

56 CVEs were published on May 27, 2024: 3 critical, 16 high. Days are UTC.

- [CVE-2024-29078](https://cve.now/CVE-2024-29078.md): Incorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unauthe (CVSS 7.5, esMind MosP kintai kanri)
- [CVE-2024-28880](https://cve.now/CVE-2024-28880.md): Path traversal vulnerability in MosP kintai kanri V4.6.6 and earlier allows a remote attacker who can log in to the product to obtain sensit (CVSS 6.5, esMind MosP kintai kanri)
- [CVE-2024-36428](https://cve.now/CVE-2024-36428.md): OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection. (CVSS 8.1)
- [CVE-2024-29415](https://cve.now/CVE-2024-29415.md): The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, (CVSS 8.1, ip)
- [CVE-2024-34923](https://cve.now/CVE-2024-34923.md): In Avocent DSR2030 Appliance firmware 03.04.00.07 before 03.07.01.23, and SVIP1020 Appliance firmware 01.06.00.03 before 01.07.00.00, there (CVSS 6.1)
- [CVE-2024-35182](https://cve.now/CVE-2024-35182.md): GHSL-2024-014 Meshery SQL Injection vulnerability (CVSS 5.9, meshery · github.com/layer5io/meshery)
- [CVE-2024-35181](https://cve.now/CVE-2024-35181.md): GHSL-2024-013 Meshery SQL Injection vulnerability (CVSS 5.9, meshery · github.com/layer5io/meshery)
- [CVE-2024-36037](https://cve.now/CVE-2024-36037.md): Insufficient Access Control Vulnerability (CVSS 5.5, ManageEngine ADAudit Plus)
- [CVE-2024-36036](https://cve.now/CVE-2024-36036.md): Insufficient Access Control Vulnerability (CVSS 4.2, ManageEngine ADAudit Plus)
- [CVE-2024-27310](https://cve.now/CVE-2024-27310.md): DOS Vulnerability (CVSS 5.3, ManageEngine ADSelfService Plus)
- [CVE-2024-36105](https://cve.now/CVE-2024-36105.md): dbt allows Binding to an Unrestricted IP Address via socketsocket (CVSS 5.3, dbt-labs dbt-core · dbt-core)
- [CVE-2024-35238](https://cve.now/CVE-2024-35238.md): Denial of service of Minder Server from maliciously crafted GitHub attestations (CVSS 5.3, stacklok minder · github.com/stacklok/minder)
- [CVE-2024-35237](https://cve.now/CVE-2024-35237.md): MIT IdentiBot User-Kerberos Mapping Publicly Available (CVSS 7.5, ZelnickB mit-identibot)
- [CVE-2024-35236](https://cve.now/CVE-2024-35236.md): Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks (CVSS 4.8, advplyr audiobookshelf)
- [CVE-2024-35231](https://cve.now/CVE-2024-35231.md): rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler\_runs" parameter (CVSS 8.6, rack-contrib)
- [CVE-2022-4969](https://cve.now/CVE-2022-4969.md): bwoodsend rockhopper Binary Parser ragged\_array.c count\_rows buffer overflow (CVSS 4.8, bwoodsend rockhopper · rockhopper)
- [CVE-2024-35229](https://cve.now/CVE-2024-35229.md): ZKsync Era evaluation order of Yul function arguments (CVSS 5.3, matter-labs era-compiler-solidity)
- [CVE-2024-35219](https://cve.now/CVE-2024-35219.md): OpenAPI Generator Online - Arbitrary File Read/Delete (CVSS 8.3, OpenAPITools openapi-generator · org.openapitools:openapi-g…)
- [CVE-2024-32978](https://cve.now/CVE-2024-32978.md): Kaminari Insecure File Permissions Vulnerability (CVSS 6.6, kaminari)
- [CVE-2024-0851](https://cve.now/CVE-2024-0851.md): SQLi in Grup Arge Energy and Control Systems's Smartpower (CVSS 10.0, Grup Arge Energy and Control Systems Smartpower)
- [CVE-2024-34477](https://cve.now/CVE-2024-34477.md): configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because (CVSS 7.8)
- [CVE-2024-5409](https://cve.now/CVE-2024-5409.md): Cross-site Scripting vulnerability in RhinOS from SaltOS (CVSS 7.1, SaltOS RhinOS)
- [CVE-2024-5408](https://cve.now/CVE-2024-5408.md): Cross-site Scripting vulnerability in RhinOS from SaltOS (CVSS 7.1, SaltOS RhinOS)
- [CVE-2024-5407](https://cve.now/CVE-2024-5407.md): Code Injection vulnerability in RhinOS from SaltOS (CVSS 10.0, SaltOS RhinOS)
- [CVE-2024-5406](https://cve.now/CVE-2024-5406.md): Multiple vulnerabilities in WinNMP from Wtriple (CVSS 6.3, Wtriple WinNMP)
- [CVE-2024-5405](https://cve.now/CVE-2024-5405.md): Multiple vulnerabilities in WinNMP from Wtriple (CVSS 6.3, Wtriple WinNMP)
- [CVE-2023-6349](https://cve.now/CVE-2023-6349.md): Heap overflow in libvpx (CVSS 5.7, Chromium libvpx)
- [CVE-2024-36383](https://cve.now/CVE-2024-36383.md): An issue was discovered in Logpoint SAML Authentication before 6.0.3. (CVSS 5.3)
- [CVE-2024-5035](https://cve.now/CVE-2024-5035.md): TP-Link Archer C5400X - RFTest Unauthenticated Command Injection (CVSS 8.8, TP-Link Archer C4500X)
- [CVE-2024-27314](https://cve.now/CVE-2024-27314.md): Stored XSS Vulnerability (CVSS 2.4, ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, Suppor…)
- [CVE-2024-26289](https://cve.now/CVE-2024-26289.md): Remote Code Inclusion Vulnerability in Multiple PMB Versions (CVSS 9.8, PMB Services PMB)
- [CVE-2024-5403](https://cve.now/CVE-2024-5403.md): ASKEY 5G NR Small Cell - Command Injection (CVSS 7.2, ASKEY 5G NR Small Cell)
- [CVE-2024-3933](https://cve.now/CVE-2024-3933.md): Eclipse Open J9 With -Xgc:concurrentScavenge on IBM Z, could write/read outside of a buffer (CVSS 5.3, Eclipse Foundation Open J9)
- [CVE-2024-4535](https://cve.now/CVE-2024-4535.md): KKProgressbar2 Free \<= 1.1.4.2 - Progress Bar Deletion via CSRF (CVSS 8.8, KKProgressbar2 Free)
- [CVE-2024-4534](https://cve.now/CVE-2024-4534.md): KKProgressbar2 Free \<= 1.1.4.2 - Stored XSS via CSRF (CVSS 6.1, KKProgressbar2 Free)
- [CVE-2024-4533](https://cve.now/CVE-2024-4533.md): KKProgressbar2 Free \<= 1.1.4.2 - Admin+ SQL Injection (CVSS 6.5, KKProgressbar2 Free)
- [CVE-2024-4532](https://cve.now/CVE-2024-4532.md): Business Card \<= 1.0.0 - Arbitrary Card Deletion via CSRF (CVSS 6.4, Business Card)
- [CVE-2024-4531](https://cve.now/CVE-2024-4531.md): Business Card \<= 1.0.0 - Card Edit via CSRF (CVSS 7.1, Business Card)
- [CVE-2024-4530](https://cve.now/CVE-2024-4530.md): Business Card \<= 1.0.0 - Category Edit via CSRF (CVSS 6.3, Business Card)
- [CVE-2024-4529](https://cve.now/CVE-2024-4529.md): Business Card \<= 1.0.0 - Category Deletion via CSRF (CVSS 5.0, Business Card)
- [CVE-2024-3939](https://cve.now/CVE-2024-3939.md): Ditty \< 3.1.36 - Author+ Stored XSS (CVSS 5.4, Ditty)
- [CVE-2024-5400](https://cve.now/CVE-2024-5400.md): Openfind Mail2000 - OS Command Injection (CVSS 8.8, Openfind Mail2000)
- [CVE-2024-35297](https://cve.now/CVE-2024-35297.md): Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5. (CVSS 4.7, aviplugins.com WP Booking)
- [CVE-2024-35291](https://cve.now/CVE-2024-35291.md): Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. (CVSS 6.1, Chris Younger Splunk Config Explorer)
- [CVE-2024-36384](https://cve.now/CVE-2024-36384.md): Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages. (CVSS 6.1)
- [CVE-2024-5399](https://cve.now/CVE-2024-5399.md): Openfind Mail2000 - OS Command Injection (CVSS 7.2, Openfind Mail2000)
- [CVE-2024-5397](https://cve.now/CVE-2024-5397.md): itsourcecode Online Student Enrollment System instructorSubjects.php sql injection (CVSS 5.3, itsourcecode Online Student Enrollment System)
- [CVE-2024-5396](https://cve.now/CVE-2024-5396.md): itsourcecode Online Student Enrollment System newfaculty.php sql injection (CVSS 5.3, itsourcecode Online Student Enrollment System)
- [CVE-2024-5395](https://cve.now/CVE-2024-5395.md): itsourcecode Online Student Enrollment System listofinstructor.php sql injection (CVSS 5.3, itsourcecode Online Student Enrollment System)
- [CVE-2024-5394](https://cve.now/CVE-2024-5394.md): itsourcecode Online Student Enrollment System newDept.php sql injection (CVSS 5.3, itsourcecode Online Student Enrollment System)
- [CVE-2024-5393](https://cve.now/CVE-2024-5393.md): itsourcecode Online Student Enrollment System listofcourse.php sql injection (CVSS 5.3, itsourcecode Online Student Enrollment System)
- [CVE-2024-5392](https://cve.now/CVE-2024-5392.md): itsourcecode Online Student Enrollment System editSubject.php sql injection (CVSS 5.3, itsourcecode Online Student Enrollment System)
- [CVE-2024-5391](https://cve.now/CVE-2024-5391.md): itsourcecode Online Student Enrollment System listofsubject.php sql injection (CVSS 5.3, itsourcecode Online Student Enrollment System)
- [CVE-2024-5390](https://cve.now/CVE-2024-5390.md): itsourcecode Online Student Enrollment System listofstudent.php sql injection (CVSS 5.3, itsourcecode Online Student Enrollment System)
- [CVE-2024-5385](https://cve.now/CVE-2024-5385.md): oretnom23 Online Car Wash Booking System cross site scripting (CVSS 5.1, oretnom23 Online Car Wash Booking System)
- [CVE-2024-36426](https://cve.now/CVE-2024-36426.md): In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.