# CVEs published 2024-05-28

132 CVEs were published on May 28, 2024: 20 critical, 66 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-5437](https://cve.now/CVE-2024-5437.md): SourceCodester Simple Online Bidding System save\_category cross site scripting (CVSS 5.3, SourceCodester Simple Online Bidding System)
- [CVE-2024-36112](https://cve.now/CVE-2024-36112.md): Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects (CVSS 6.3, nautobot)
- [CVE-2023-30314](https://cve.now/CVE-2023-30314.md): An issue discovered in 360 V6G, 360 T5G, 360 T6M, and 360 P1 routers allows attackers to hijack TCP sessions which could lead to a denial of (CVSS 6.5)
- [CVE-2024-23580](https://cve.now/CVE-2024-23580.md): HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs) (CVSS 6.5, HCL Software DRYiCE Optibot Reset Station)
- [CVE-2024-23579](https://cve.now/CVE-2024-23579.md): HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions (CVSS 6.5, HCL Software DRYiCE Optibot Reset Station)
- [CVE-2024-35226](https://cve.now/CVE-2024-35226.md): PHP Code Injection by malicious attribute in extends-tag in Smarty (CVSS 7.3, smarty-php smarty · smarty/smarty)
- [CVE-2024-35511](https://cve.now/CVE-2024-35511.md): phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php. (CVSS 4.7)
- [CVE-2024-35548](https://cve.now/CVE-2024-35548.md): A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blin (CVSS 5.4)
- [CVE-2024-22641](https://cve.now/CVE-2024-22641.md): TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file. (CVSS 7.5)
- [CVE-2024-35240](https://cve.now/CVE-2024-35240.md): Stored Cross-site Scripting on Print Functionality in Umbraco Commerce (CVSS 5.4, Umbraco.Commerce.Issues · Umbraco.Commerce)
- [CVE-2024-35239](https://cve.now/CVE-2024-35239.md): Stored Cross-site Scripting on Components of Umbraco Forms (CVSS 2.7, Umbraco.Forms.Issues · Umbraco.Forms)
- [CVE-2023-30313](https://cve.now/CVE-2023-30313.md): An issue discovered in Wavlink QUANTUM D2G routers allows attackers to hijack TCP sessions which could lead to a denial of service. (CVSS 7.5)
- [CVE-2024-28060](https://cve.now/CVE-2024-28060.md): An issue was discovered in Apiris Kafeo 6.4.4. (CVSS 7.3)
- [CVE-2023-30306](https://cve.now/CVE-2023-30306.md): An issue discovered in Mercury x30g, Mercury YR1800XG routers allows attackers to hijack TCP sessions which could lead to a denial of servic (CVSS 4.3)
- [CVE-2023-30310](https://cve.now/CVE-2023-30310.md): An issue discovered in Comfast Comfast CF-616AC routers allows attackers to hijack TCP sessions which could lead to a denial of service. (CVSS 7.5)
- [CVE-2024-35583](https://cve.now/CVE-2024-35583.md): A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scr (CVSS 6.1)
- [CVE-2024-35581](https://cve.now/CVE-2024-35581.md): A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scr (CVSS 6.1)
- [CVE-2023-30309](https://cve.now/CVE-2023-30309.md): An issue discovered in D-Link DI-7003GV2 routers allows attackers to hijack TCP sessions which could lead to a denial of service. (CVSS 5.7)
- [CVE-2024-35582](https://cve.now/CVE-2024-35582.md): A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scr (CVSS 6.1)
- [CVE-2023-30308](https://cve.now/CVE-2023-30308.md): An issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hijack TCP sessions whic (CVSS 6.5)
- [CVE-2024-28061](https://cve.now/CVE-2024-28061.md): An issue was discovered in Apiris Kafeo 6.4.4. (CVSS 6.3)
- [CVE-2024-35510](https://cve.now/CVE-2024-35510.md): An arbitrary file upload vulnerability in /dede/file\_manage\_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via u (CVSS 9.8)
- [CVE-2023-30307](https://cve.now/CVE-2023-30307.md): An issue discovered in TP-LINK TL-R473GP-AC, TP-LINK XDR6020, TP-LINK TL-R479GP-AC, TP-LINK TL-R4239G, TP-LINK TL-WAR1200L, and TP-LINK TL-R (CVSS 5.3)
- [CVE-2022-45171](https://cve.now/CVE-2022-45171.md): An issue was discovered in LIVEBOX Collaboration vDesk through v018. (CVSS 8.8)
- [CVE-2023-46694](https://cve.now/CVE-2023-46694.md): Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. (CVSS 8.1)
- [CVE-2023-30305](https://cve.now/CVE-2023-30305.md): An issue discovered in Linksys E5600 routers allows attackers to hijack TCP sessions which could lead to a denial of service. (CVSS 7.5)
- [CVE-2023-30311](https://cve.now/CVE-2023-30311.md): An issue discovered in H3C Magic R365 and H3C Magic R100 routers allows attackers to hijack TCP sessions which could lead to a denial of ser (CVSS 7.5)
- [CVE-2024-33450](https://cve.now/CVE-2024-33450.md): SQL Injection in Finereport v.8.0 allows a remote attacker to obtain sensitive information (CVSS 7.5)
- [CVE-2024-36107](https://cve.now/CVE-2024-36107.md): Information disclosure in minio (CVSS 5.3, minio · github.com/minio/minio)
- [CVE-2024-5434](https://cve.now/CVE-2024-5434.md): Weak Encoding for Password vulnerability in Campbell Scientific CSI Web Server and RTMC (CVSS 6.9, Campbell Scientific CSI Web Server and RTMC)
- [CVE-2024-36109](https://cve.now/CVE-2024-36109.md): Cross-site Scripting with Markdown rendering in CoCalc (CVSS 7.6, sagemathinc cocalc)
- [CVE-2024-5433](https://cve.now/CVE-2024-5433.md): Path Traversal in Campbell Scientific CSI Web Server and RTMC (CVSS 5.3, Campbell Scientific CSI Web Server and RTMC)
- [CVE-2024-36110](https://cve.now/CVE-2024-36110.md): Cross-site scripting in ansibleguy-webui (CVSS 8.2, ansibleguy webui · ansibleguy-webui)
- [CVE-2024-24919](https://cve.now/CVE-2024-24919.md): Information disclosure (CVSS 8.6, KEV, checkpoint Check Point Quantum Gateway, Spark Gateway and C…)
- [CVE-2023-43850](https://cve.now/CVE-2023-43850.md): Improper input validation in the user management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated us (CVSS 6.5)
- [CVE-2023-43849](https://cve.now/CVE-2023-43849.md): Incorrect access control in firmware upgrade function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users (CVSS 6.5)
- [CVE-2023-43848](https://cve.now/CVE-2023-43848.md): Incorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated (CVSS 8.0)
- [CVE-2023-43847](https://cve.now/CVE-2023-43847.md): Incorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated user (CVSS 5.3)
- [CVE-2023-43846](https://cve.now/CVE-2023-43846.md): Incorrect access control in logs management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote attackers to get the (CVSS 5.3)
- [CVE-2023-43845](https://cve.now/CVE-2023-43845.md): Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged telnet account. (CVSS 9.8)
- [CVE-2023-43844](https://cve.now/CVE-2023-43844.md): Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account. (CVSS 8.0)
- [CVE-2023-43843](https://cve.now/CVE-2023-43843.md): Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated (CVSS 7.3)
- [CVE-2023-43842](https://cve.now/CVE-2023-43842.md): Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated (CVSS 7.3)
- [CVE-2024-33402](https://cve.now/CVE-2024-33402.md): A SQL injection vulnerability in /model/approve\_petty\_cash.php in campcodes Complete Web-Based School Management System 1.0 allows attacker (CVSS 8.1)
- [CVE-2024-35344](https://cve.now/CVE-2024-35344.md): Certain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. (CVSS 9.9)
- [CVE-2024-35341](https://cve.now/CVE-2024-35341.md): Certain Anpviz products allow unauthenticated users to download the running configuration of the device via a HTTP GET request to /ConfigFil (CVSS 7.5)
- [CVE-2024-35342](https://cve.now/CVE-2024-35342.md): Certain Anpviz products allow unauthenticated users to modify or disable camera related settings such as microphone volume, speaker volume, (CVSS 4.6)
- [CVE-2024-35343](https://cve.now/CVE-2024-35343.md): Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the / (CVSS 9.8)
- [CVE-2024-30165](https://cve.now/CVE-2024-30165.md): Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands w (CVSS 7.1)
- [CVE-2024-30164](https://cve.now/CVE-2024-30164.md): Amazon AWS Client VPN has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissio (CVSS 6.7)
- [CVE-2024-35563](https://cve.now/CVE-2024-35563.md): CDG-Server-V5.6.2.126.139 and earlier was discovered to contain a SQL injection vulnerability via the permissionId parameter in CDGTempPermi (CVSS 9.8)
- [CVE-2024-26024](https://cve.now/CVE-2024-26024.md): SUBNET Substation Server Reliance on Insufficiently Trustworthy Component (CVSS 8.4, SUBNET Substation Server)
- [CVE-2024-34854](https://cve.now/CVE-2024-34854.md): F-logic DataCube3 v1.0 is vulnerable to File Upload via \`/admin/transceiver\_schedule.php.\` (CVSS 9.8)
- [CVE-2024-34852](https://cve.now/CVE-2024-34852.md): F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/trans (CVSS 6.3)
- [CVE-2024-35401](https://cve.now/CVE-2024-35401.md): TOTOLINK CP900L v4.1.5cu.798\_B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadF (CVSS 5.9)
- [CVE-2024-35403](https://cve.now/CVE-2024-35403.md): TOTOLINK CP900L v4.1.5cu.798\_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setIpPortFilterRule (CVSS 2.7)
- [CVE-2024-30212](https://cve.now/CVE-2024-30212.md): Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command (CVSS 7.0, Microchip MPLAB® Harmony 3 Core Module)
- [CVE-2024-22590](https://cve.now/CVE-2024-22590.md): The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. (CVSS 9.1)
- [CVE-2024-36472](https://cve.now/CVE-2024-36472.md): In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided b (CVSS 6.5)
- [CVE-2024-33808](https://cve.now/CVE-2024-33808.md): A SQL injection vulnerability in /model/get\_timetable.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to (CVSS 9.8)
- [CVE-2024-33807](https://cve.now/CVE-2024-33807.md): A SQL injection vulnerability in /model/get\_teacher\_timetable.php in campcodes Complete Web-Based School Management System 1.0 allows an att (CVSS 5.4)
- [CVE-2024-33806](https://cve.now/CVE-2024-33806.md): A SQL injection vulnerability in /model/get\_grade.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to exe (CVSS 9.8)
- [CVE-2024-33805](https://cve.now/CVE-2024-33805.md): A SQL injection vulnerability in /model/get\_student.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to e (CVSS 9.8)
- [CVE-2024-33804](https://cve.now/CVE-2024-33804.md): A SQL injection vulnerability in /model/get\_subject.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to e (CVSS 6.3)
- [CVE-2024-33803](https://cve.now/CVE-2024-33803.md): A SQL injection vulnerability in /model/get\_exam.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to exec (CVSS 5.4)
- [CVE-2024-33802](https://cve.now/CVE-2024-33802.md): A SQL injection vulnerability in /model/get\_student\_subject.php in campcodes Complete Web-Based School Management System 1.0 allows an attac (CVSS 6.5)
- [CVE-2024-33801](https://cve.now/CVE-2024-33801.md): A SQL injection vulnerability in /model/get\_subject\_routing.php in campcodes Complete Web-Based School Management System 1.0 allows an attac (CVSS 9.8)
- [CVE-2024-33800](https://cve.now/CVE-2024-33800.md): A SQL injection vulnerability in /model/get\_student1.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to (CVSS 9.8)
- [CVE-2024-33799](https://cve.now/CVE-2024-33799.md): A SQL injection vulnerability in /model/get\_teacher.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to e (CVSS 9.8)
- [CVE-2024-35621](https://cve.now/CVE-2024-35621.md): A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts (CVSS 4.8, getformwork/formwork)
- [CVE-2024-24851](https://cve.now/CVE-2024-24851.md): A heap-based buffer overflow vulnerability exists in the Programming Software Connection FiBurn functionality of AutomationDirect P3-550E 1. (CVSS 7.5, AutomationDirect P3-550E)
- [CVE-2024-24947](https://cve.now/CVE-2024-24947.md): A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1 (CVSS 8.2, AutomationDirect P3-550E)
- [CVE-2024-24946](https://cve.now/CVE-2024-24946.md): A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1 (CVSS 8.2, AutomationDirect P3-550E)
- [CVE-2024-24959](https://cve.now/CVE-2024-24959.md): Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3 (CVSS 8.2, AutomationDirect P3-550E)
- [CVE-2024-24958](https://cve.now/CVE-2024-24958.md): Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3 (CVSS 8.2, AutomationDirect P3-550E)
- [CVE-2024-24957](https://cve.now/CVE-2024-24957.md): Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3 (CVSS 8.2, AutomationDirect P3-550E)
- [CVE-2024-24956](https://cve.now/CVE-2024-24956.md): Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3 (CVSS 8.2, AutomationDirect P3-550E)
- [CVE-2024-24955](https://cve.now/CVE-2024-24955.md): Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3 (CVSS 8.2, AutomationDirect P3-550E)
- [CVE-2024-24954](https://cve.now/CVE-2024-24954.md): Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3 (CVSS 8.2, AutomationDirect P3-550E)
- [CVE-2024-24963](https://cve.now/CVE-2024-24963.md): A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-55 (CVSS 9.8, AutomationDirect P3-550E)
- [CVE-2024-24962](https://cve.now/CVE-2024-24962.md): A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-55 (CVSS 9.8, AutomationDirect P3-550E)
- [CVE-2024-22187](https://cve.now/CVE-2024-22187.md): A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect P (CVSS 9.1, AutomationDirect P3-550E)
- [CVE-2024-23315](https://cve.now/CVE-2024-23315.md): A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550E (CVSS 7.5, AutomationDirect P3-550E)
- [CVE-2024-21785](https://cve.now/CVE-2024-21785.md): A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E 1.2.10.9. (CVSS 9.8, AutomationDirect P3-550E)
- [CVE-2024-23601](https://cve.now/CVE-2024-23601.md): A code injection vulnerability exists in the scan\_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. (CVSS 9.8, AutomationDirect P3-550E)
- [CVE-2024-35324](https://cve.now/CVE-2024-35324.md): Douchat 4.0.5 suffers from an arbitrary file upload vulnerability via Public/Plugins/webuploader/server/preview.php. (CVSS 9.8)
- [CVE-2024-33849](https://cve.now/CVE-2024-33849.md): ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key. (CVSS 6.5)
- [CVE-2024-35400](https://cve.now/CVE-2024-35400.md): TOTOLINK CP900L v4.1.5cu.798\_B20221228 was discovered to contain a stack overflow via the desc parameter in the function SetPortForwardRules (CVSS 5.3)
- [CVE-2024-5274](https://cve.now/CVE-2024-5274.md): Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.3, KEV, Google Chrome)
- [CVE-2024-35399](https://cve.now/CVE-2024-35399.md): TOTOLINK CP900L v4.1.5cu.798\_B20221228 was discovered to contain a stack overflow via the password parameter in the function loginAuth (CVSS 8.8)
- [CVE-2024-4429](https://cve.now/CVE-2024-4429.md): Cross Site Request Forgery vulnerability in iManager (CVSS 5.4, OpenText iManager)
- [CVE-2024-3969](https://cve.now/CVE-2024-3969.md): XML External Entity injection vulnerability in iManager (CVSS 7.8, OpenText iManager)
- [CVE-2024-35398](https://cve.now/CVE-2024-35398.md): TOTOLINK CP900L v4.1.5cu.798\_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setMacFilterRules. (CVSS 9.8)
- [CVE-2024-35397](https://cve.now/CVE-2024-35397.md): TOTOLINK CP900L v4.1.5cu.798\_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the (CVSS 8.8)
- [CVE-2024-2451](https://cve.now/CVE-2024-2451.md): Improper fingerprint validation in the TeamViewer Client (CVSS 6.4, TeamViewer Remote)
- [CVE-2023-35953](https://cve.now/CVE-2023-35953.md): Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0. (CVSS 7.8, libigl)
- [CVE-2023-35952](https://cve.now/CVE-2023-35952.md): Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0. (CVSS 7.8, libigl)
- [CVE-2023-35951](https://cve.now/CVE-2023-35951.md): Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0. (CVSS 7.8, libigl)
- [CVE-2023-35950](https://cve.now/CVE-2023-35950.md): Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0. (CVSS 7.8, libigl)
- [CVE-2023-35949](https://cve.now/CVE-2023-35949.md): Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0. (CVSS 7.8, libigl)
- [CVE-2023-49600](https://cve.now/CVE-2023-49600.md): An out-of-bounds write vulnerability exists in the PlyFile ply\_cast\_ascii functionality of libigl v2.5.0. (CVSS 8.1, libigl)
- [CVE-2024-23951](https://cve.now/CVE-2024-23951.md): Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. (CVSS 8.8, libigl)
- [CVE-2024-23950](https://cve.now/CVE-2024-23950.md): Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. (CVSS 8.8, libigl)
- [CVE-2024-23949](https://cve.now/CVE-2024-23949.md): Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. (CVSS 8.8, libigl)
- [CVE-2024-23948](https://cve.now/CVE-2024-23948.md): Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. (CVSS 8.8, libigl)
- [CVE-2024-23947](https://cve.now/CVE-2024-23947.md): Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. (CVSS 8.8, libigl)
- [CVE-2024-24584](https://cve.now/CVE-2024-24584.md): Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. (CVSS 4.3, libigl)
- [CVE-2024-24583](https://cve.now/CVE-2024-24583.md): Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0. (CVSS 4.3, libigl)
- [CVE-2024-24686](https://cve.now/CVE-2024-24686.md): Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. (CVSS 7.8, libigl)
- [CVE-2024-24685](https://cve.now/CVE-2024-24685.md): Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. (CVSS 7.8, libigl)
- [CVE-2024-24684](https://cve.now/CVE-2024-24684.md): Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. (CVSS 7.8, libigl)
- [CVE-2024-22181](https://cve.now/CVE-2024-22181.md): An out-of-bounds write vulnerability exists in the readNODE functionality of libigl v2.5.0. (CVSS 7.8, libigl)
- [CVE-2024-29072](https://cve.now/CVE-2024-29072.md): A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. (CVSS 8.2, Foxit Reader)
- [CVE-2024-5428](https://cve.now/CVE-2024-5428.md): SourceCodester Simple Online Bidding System HTTP POST Request save\_product cross-site request forgery (CVSS 6.9, SourceCodester Simple Online Bidding System)
- [CVE-2024-3657](https://cve.now/CVE-2024-3657.md): 389-ds-base: potential denial of service via specially crafted kerberos as-req request (CVSS 7.5, Red Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5)
- [CVE-2024-5415](https://cve.now/CVE-2024-5415.md): Cross-Site Scripting (XSS) vulnerability on PhpMyBackupPro (CVSS 7.1, PhpMyBackupPro)
- [CVE-2024-5414](https://cve.now/CVE-2024-5414.md): Cross-Site Scripting (XSS) vulnerability on PhpMyBackupPro (CVSS 7.1, PhpMyBackupPro)
- [CVE-2024-5413](https://cve.now/CVE-2024-5413.md): Cross-Site Scripting (XSS) vulnerability on PhpMyBackupPro (CVSS 7.1, PhpMyBackupPro)
- [CVE-2023-37411](https://cve.now/CVE-2023-37411.md): IBM Aspera Faspex cross-site scripting (CVSS 4.8, IBM Aspera Faspex)
- [CVE-2024-2199](https://cve.now/CVE-2024-2199.md): 389-ds-base: malformed userpassword may cause crash at do\_modify in slapd/modify.c (CVSS 5.7, 389-ds-base · Red Hat Directory Server 11.5 E4S for RHEL +4)
- [CVE-2024-28793](https://cve.now/CVE-2024-28793.md): IBM Engineering Workflow Management cross-site scripting (CVSS 4.9, IBM Engineering Workflow Management)
- [CVE-2024-5411](https://cve.now/CVE-2024-5411.md): Command Injection (CVSS 8.7, ORing IAP-420)
- [CVE-2024-5410](https://cve.now/CVE-2024-5410.md): Stored Cross-Site Scripting (CVSS 8.3, ORing IAP-420)
- [CVE-2023-52712](https://cve.now/CVE-2023-52712.md): Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. (CVSS 7.8, Huawei CurieM-WFG9B)
- [CVE-2023-52711](https://cve.now/CVE-2023-52711.md): Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. (CVSS 7.8, Huawei CurieM-WFG9B)
- [CVE-2023-52710](https://cve.now/CVE-2023-52710.md): Huawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26), As the communication buffer size hasn’t been properly validated to be of the expected si (CVSS 7.8, Huawei CurieM-WFG9B)
- [CVE-2023-52548](https://cve.now/CVE-2023-52548.md): Huawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26) Arbitrary Memory Corruption in SMI Handler of ThisiServicesSmm SMM module. (CVSS 7.8, Huawei CurieM-WFG9B)
- [CVE-2023-52547](https://cve.now/CVE-2023-52547.md): Huawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26. (CVSS 7.8, Huawei CurieM-WFG9B)
- [CVE-2022-48681](https://cve.now/CVE-2022-48681.md): Some Huawei smart speakers have a memory overflow vulnerability. (CVSS 7.2, Huawei EGRT-00)
- [CVE-2024-28886](https://cve.now/CVE-2024-28886.md): OS command injection vulnerability exists in UTAU versions prior to v0.4.19. (CVSS 8.4, ameya/ayame UTAU)
- [CVE-2024-32944](https://cve.now/CVE-2024-32944.md): Path traversal vulnerability exists in UTAU versions prior to v0.4.19. (CVSS 3.3, ameya/ayame UTAU)
- [CVE-2023-30312](https://cve.now/CVE-2023-30312.md): An issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.