CVEs published April 10, 2024
217 CVEs were published on April 10, 2024: 30 critical, 61 high. Browse them by severity, product and exploitation status.
- Published
- 217
- Critical
- 30
- High
- 61
- Medium
- 86
- Low
- 18
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 66
Most affected products
- Linux
- 39
- Adobe Experience Manager
- 12
- Campcodes Church Management System
- 9
- Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- 7
- Campcodes Complete Online Student Management System
- 6
- lunary-ai/lunary
- 5
- mintplex-labs/anything-llm
- 5
- boldthemes Bold Page Builder
- 4
- IBM Security Verify Access Appliance
- 4
- parisneo/lollms-webui
- 4
Critical 30
- CVE-2024-31997XWiki Platform remote code execution from account through UIExtension parametersxwiki-platform · org.xwiki.platform:xwiki-platform-uiextens…
- CVE-2024-31996XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code executionxwiki-commons · org.xwiki.commons:xwiki-commons-velocity
- CVE-2024-31988XWiki Platform CSRF remote code execution through the realtime HTML Converter APIxwiki-platform · org.xwiki.platform:xwiki-platform-realtime…
- CVE-2024-31987XWiki Platform remote code execution from account via custom skins supportxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2024-31986XWiki Platform CSRF remote code execution through scheduler job's document referencexwiki-platform · org.xwiki.platform:xwiki-platform-schedule…
- CVE-2024-31984XWiki Platform: Remote code execution through space title and Solr space facetxwiki-platform · org.xwiki.platform:xwiki-platform-search-s…
- CVE-2024-31983XWiki Platform: Remote code execution from edit in multilingual wikis via translationsxwiki-platform · org.xwiki.platform:xwiki-platform-localiza…
- CVE-2024-31982XWiki Platform: Remote code execution as guest via DatabaseSearchxwiki-platform · org.xwiki.platform:xwiki-platform-search-ui
- CVE-2024-31981XWiki Platform: Privilege escalation (PR) from user registration through PDFClassxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2024-31465XWiki Platform: Remote code execution from account via SearchSuggestSourceSheetxwiki-platform · org.xwiki.platform:xwiki-platform-search-ui
- CVE-2021-47215net/mlx5e: kTLS, Fix crash in RX resync flowLinux
- CVE-2024-31461Plane Server-Side Request Forgery (SSRF) Vulnerabilitymakeplane plane
- CVE-2024-31214Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code executiontraccar
- CVE-2024-2195Remote Code Execution in aimhubio/aimaimhubio/aim · aim
- CVE-2024-2029Command Injection in mudler/localaimudler/localai · github.com/go-skynet/LocalAI
- CVE-2024-1740Incorrect Authorization in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-1741Improper Authorization in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-1520OS Command Injection in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-1511Path Traversal Vulnerability in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-2221Path Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrantqdrant/qdrant
- CVE-2024-1600Local File Inclusion in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-1643Unauthorized Organization Access in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-3098Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_indexrun-llama/llama_index · llama-index-core
- CVE-2024-2952Server-Side Template Injection in BerriAI/litellmberriai/litellm · litellm
- CVE-2024-3025Path Traversal in mintplex-labs/anything-llmmintplex-labs/anything-llm
Show all 30 entriesShow fewer entries
- CVE-2024-3566Command injection vulnerability in programing languages on Microsoft Windows operating system.Node.js · Go Programming Language GoLang +1
- CVE-2024-20758Adobe Commerce | Improper Input Validation (CWE-20)Adobe Commerce · magento/community-edition +1
- CVE-2024-23080Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale).
- CVE-2024-29500An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a…
- CVE-2024-31819An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the…wwbn/avideo
High 61
- CVE-2024-31999@fastify/secure-session: Reuse of destroyed secure session cookiefastify-secure-session · @fastify/secure-session
- CVE-2021-47219scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()Linux
- CVE-2021-47209sched/fair: Prevent dead task groups from regaining cfs_rq'sLinux
- CVE-2021-47203scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()Linux
- CVE-2021-47201iavf: free q_vectors before queues in iavf_disable_vfLinux
- CVE-2021-47200drm/prime: Fix use after free in mmap with drm_gem_ttm_mmapLinux
- CVE-2021-47197net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()Linux
- CVE-2021-47196RDMA/core: Set send and receive CQ before forwarding to the driverLinux
- CVE-2021-47194cfg80211: call cfg80211_stop_ap when switch from P2P_GO typeLinux
- CVE-2021-47191scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()Linux
- CVE-2021-47189btrfs: fix memory ordering between normal and ordered work functionsLinux
- CVE-2021-47188scsi: ufs: core: Improve SCSI abort handlingLinux
- CVE-2021-47184i40e: Fix NULL ptr dereference on VSI filter syncLinux
- CVE-2021-47183scsi: lpfc: Fix link down processing to address NULL pointer dereferenceLinux
- CVE-2024-3516Heap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption…Google Chrome
- CVE-2024-3157Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU…Google Chrome
- CVE-2024-2196CSRF Vulnerability in aimhubio/aimaimhubio/aim · aim
- CVE-2024-1902Session Reuse Vulnerability in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-2217Improper Access Control in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-1602Stored XSS leading to RCE in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-3283Privilege Escalation via Mass Assignment in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-3569Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-1728Local File Inclusion in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2024-1625IDOR Vulnerability in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-3385PAN-OS: Firewall Denial of Service (DoS) when GTP Security is DisabledPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
Show all 61 entriesShow fewer entries
- CVE-2024-3384PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM PacketsPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2024-3383PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2024-3382PAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted PacketsPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2024-31299WordPress ReDi Restaurant Reservation plugin <= 24.0128 - Cross Site Request Forgery (CSRF) to XSS vulnerabilityReservation Diary ReDi Restaurant Reservation
- CVE-2024-31355WordPress Slideshow Gallery LITE plugin <= 1.7.8 - Auth. SQL Injection vulnerabilityTribulant Slideshow Gallery
- CVE-2024-31356WordPress User Activity Log plugin <= 1.8 - Auth. SQL Injection vulnerabilitySolwin Infotech User Activity Log
- CVE-2024-31343WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10.1 - Arbitrary File Download vulnerabilitySonaar Music MP3 Audio Player for Music, Radio & Podcast by…
- CVE-2024-31240WordPress WP Poll Maker plugin <= 3.1 - Auth. Arbitrary File Deletion vulnerabilityInfoTheme WP Poll Maker
- CVE-2024-31297WordPress Wholesale For WooCommerce plugin <= 2.3.1 - Unauthenticated Arbitrary Post/Page vulnerabilityWPExperts Wholesale For WooCommerce
- CVE-2024-31873IBM Security Verify Access Appliance information disclosureIBM Security Verify Access Appliance
- CVE-2024-31358WordPress 5 Stars Rating Funnel plugin <= 1.2.67 - Arbitrary Content Deletion vulnerabilitySaleswonder Team: Tobias 5 Stars Rating Funnel
- CVE-2024-0218DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1Nozomi Networks Guardian
- CVE-2024-31871IBM Security Verify Access Appliance improper certificate validationIBM Security Verify Access Appliance
- CVE-2024-31872IBM Security Verify Access Appliance missing certificate validationIBM Security Verify Access Appliance
- CVE-2023-6916Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2024-31259WordPress SearchIQ plugin <= 4.5 - Sensitive Data Exposure via Log File vulnerabilitySearchIQ
- CVE-2024-24809Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Typetraccar
- CVE-2024-31492An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below…Fortinet FortiClientMac
- CVE-2024-20772Adobe Media Encoder 2024 AI file parsing Stack based buffer overflowAdobe Media Encoder
- CVE-2024-31309Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attackApache Software Foundation Apache Traffic Server
- CVE-2024-20759Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · magento/community-edition +1
- CVE-2024-26815net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX checkLinux
- CVE-2023-2794Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_deliver() functionofono
- CVE-2024-2243Csmock: command injection vulnerability in csmock-plugin-snykcsmock
- CVE-2024-22450Dell Alienware Command Center, versions prior to 6.2.7.0, contain an uncontrolled search path element vulnerability.Dell Alienware Command Center
- CVE-2024-3020Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for…shapedplugin Carousel, Slider, Photo Gallery with Lightbox,…
- CVE-2024-3535Campcodes Church Management System index.php sql injectionCampcodes Church Management System
- CVE-2024-3534Campcodes Church Management System login.php sql injectionCampcodes Church Management System
- CVE-2023-6236Eap: oidc app attempting to access the second tenant, the user should be prompted to logRed Hat JBoss Enterprise Application Platform · org.wildfly…
- CVE-2023-52070JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method.
- CVE-2024-23076JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java.
- CVE-2024-23077JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java.
- CVE-2024-26362HTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML…
- CVE-2024-27474Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2024-29269An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter.
- CVE-2024-29504Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted…summernote
Medium, low and unrated 126
- CVE-2024-3612SourceCodester Warehouse Management System barang.php cross site scriptingSourceCodester Warehouse Management System
- CVE-2024-29903Cosign vulnerable to machine-wide denial of service via malicious artifactssigstore cosign · github.com/sigstore/cosign +1
- CVE-2024-29902Cosign vulnerable to system-wide denial of service via malicious attachmentssigstore cosign · github.com/sigstore/cosign +1
- CVE-2024-32001SpiceDB: LookupSubjects may return partial results if a specific kind of relation is usedauthzed spicedb · github.com/authzed/spicedb
- CVE-2024-31995zcap has incomplete expiration checks in capability chains.digitalbazaar zcap · @digitalbazaar/zcap
- CVE-2024-1481Freeipa: specially crafted http requests potentially lead to denial of servicefreeipa · Red Hat Enterprise Linux
- CVE-2024-31985XWiki Platform CSRF in the job schedulerxwiki-platform · org.xwiki.platform:xwiki-platform-schedule…
- CVE-2024-31939WordPress Import any XML or CSV File to WordPress plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) vulnerabilitySoflyy Import any XML or CSV File to WordPress
- CVE-2024-31430Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR and WOLF WordPress pluginsrealmag777 WOLF – WordPress Posts Bulk Editor and Manager P…
- CVE-2021-47218selinux: fix NULL-pointer dereference when hashtab allocation failsLinux
- CVE-2021-47217x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup failsLinux
- CVE-2021-47216scsi: advansys: Fix kernel pointer leakLinux
- CVE-2021-47214hugetlb, userfaultfd: fix reservation restore on userfaultfd errorLinux
- CVE-2021-47212net/mlx5: Update error handler for UCTX and UMEMLinux
- CVE-2021-47211ALSA: usb-audio: fix null pointer dereference on pointer cs_descLinux
- CVE-2021-47210usb: typec: tipd: Remove WARN_ON in tps6598x_block_readLinux
- CVE-2021-47207ALSA: gus: fix null pointer dereference on pointer blockLinux
- CVE-2021-47206usb: host: ohci-tmio: check return value after calling platform_get_resource()Linux
- CVE-2021-47205clk: sunxi-ng: Unregister clocks/resets when unbindingLinux
- CVE-2021-47204net: dpaa2-eth: fix use-after-free in dpaa2_eth_removeLinux
- CVE-2021-47202thermal: Fix NULL pointer dereferences in of_thermal_ functionsLinux
- CVE-2021-47199net/mlx5e: CT, Fix multiple allocations and memleak of mod actsLinux
- CVE-2021-47198scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routineLinux
- CVE-2021-47195spi: fix use-after-free of the add_lock mutexLinux
- CVE-2021-47193scsi: pm80xx: Fix memory leak during rmmodLinux
Show all 126 entriesShow fewer entries
- CVE-2021-47192scsi: core: sysfs: Fix hang when device state is set via sysfsLinux
- CVE-2021-47190perf bpf: Avoid memory leak from perf_env__insert_btf()Linux
- CVE-2021-47187arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residencyLinux
- CVE-2021-47186tipc: check for null after calling kmemdupLinux
- CVE-2021-47185tty: tty_buffer: Fix the softlockup issue in flush_to_ldiscLinux
- CVE-2021-47182scsi: core: Fix scsi_mode_sense() buffer length handlingLinux
- CVE-2021-47181usb: musb: tusb6010: check return value after calling platform_get_resource()Linux
- CVE-2024-31386Multiple WordPress themes affected by Cross-Site Request Forgery vulnerabilityHidekazu Ishikawa X-T9 · Hidekazu Ishikawa Lightning +13
- CVE-2024-3515Use after free in Dawn in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2024-31464XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deletedxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2024-31242WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary Email Sending vulnerabilityBricksforge
- CVE-2024-31230WordPress ShortPixel Adaptive Images plugin <= 3.8.2 - Broken Access Control vulnerabilityShortPixel Adaptive Images
- CVE-2024-31943WordPress USPS Shipping for WooCommerce plugin <= 1.9.2 - Cross Site Request Forgery (CSRF) vulnerabilityOctolize USPS Shipping for WooCommerce – Live Rates
- CVE-2024-31944WordPress WooCommerce UPS Shipping plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerabilityOctolize WooCommerce UPS Shipping – Live Rates and Access P…
- CVE-2024-3570Stored XSS leading to Admin Account Takeover in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-3101Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-3568Arbitrary Code Execution via Deserialization in huggingface/transformershuggingface/transformers · transformers
- CVE-2024-3388PAN-OS: User Impersonation in GlobalProtect SSL VPNPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2024-3387PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information DisclosurePalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2024-3386PAN-OS: Predefined Decryption Exclusions Does Not Work as IntendedPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2024-31342WordPress Gallery Exporter plugin <= 1.3 - Arbitrary File Download vulnerabilityWPcloudgallery WordPress Gallery Exporter
- CVE-2024-31287WordPress Media Library Folders plugin <= 8.1.8 - Directory Traversal vulnerabilityMax Foundry Media Library Folders
- CVE-2024-31874IBM Security Verify Access Appliance denial of serviceIBM Security Verify Access Appliance
- CVE-2024-31245WordPress ConvertKit plugin <= 2.4.5 - Email Disclosure in Log File vulnerabilityConvertKit
- CVE-2024-31247WordPress FG Drupal to WordPress plugin <= 3.70.3 - Sensitive Data Exposure via Log File vulnerabilityFrédéric GILLES FG Drupal to WordPress
- CVE-2024-31249WordPress Subscribe To Comments Reloaded plugin <= 220725 - Sensitive Data Exposure vulnerabilityWPKube Subscribe To Comments Reloaded
- CVE-2024-31254WordPress WordPress Backup & Migration plugin <= 1.4.7 - Sensitive Data Exposure via Log File vulnerabilityWebToffee WordPress Backup & Migration
- CVE-2024-31278WordPress Premium Addons for Elementor plugin <= 4.10.22 - Sensitive Data Exposure vulnerabilityLeap13 Premium Addons for Elementor
- CVE-2024-31298WordPress User Spam Remover plugin <= 1.0 - Sensitive Data Exposure via Log File vulnerabilityJoel Hardi User Spam Remover
- CVE-2024-31302WordPress Contact Form Email plugin <= 1.3.44 - Sensitive Data Exposure vulnerabilityCodePeople Contact Form Email
- CVE-2024-31353WordPress Slideshow Gallery LITE plugin <= 1.7.8 - Sensitive Data Exposure vulnerabilityTribulant Slideshow Gallery
- CVE-2024-31253WordPress WP OAuth Server (OAuth Authentication) plugin <= 4.3.3 - Open Redirection vulnerabilityWP OAuth Server OAuth Server
- CVE-2024-31282WordPress App Builder plugin <= 3.8.7 - Open Redirection vulnerabilityAppcheap.io App Builder
- CVE-2024-3567Qemu-kvm: net: assertion failure in update_sctp_checksum()net · Red Hat Enterprise Linux
- CVE-2024-3448Improper Access Control Leads to Server-Side Request Forgery in MauticMautic
- CVE-2024-2731Improper Access Control Issues Lead to Sensitive Data Exposure in MauticMautic
- CVE-2024-2730Predictable Page Indexing Might Lead to Sensitive Data Exposure in MauticMautic
- CVE-2024-26816x86, relocs: Ignore relocations in .notes sectionLinux
- CVE-2024-31924WordPress EWWW Image Optimizer plugin <= 7.2.3 - Cross Site Request Forgery (CSRF) vulnerabilitynosilver4u EWWW Image Optimizer
- CVE-2024-20766Adobe Indesign 2024 TIF File Parsing Out-Of-Bound Read Information Disclosure VulnerabiityAdobe InDesign Desktop
- CVE-2024-20770Adobe Photoshop 2024 TIF File parsing Out-Of-Bound ReadAdobe Photoshop Desktop
- CVE-2024-20737Adobe After Effect 2024 RGB File parsing Memory Corruption VulnerabilityAdobe After Effects
- CVE-2024-26097Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-26087Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-20779Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-20780Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-26046Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-26084Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-26076Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-26122Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-26047Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-26079Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-20778Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-26098Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-1780BizCalendar Web <= 1.1.0.25 - Reflected Cross-Site Scripting via 'tab'setriosoft BizCalendar Web
- CVE-2024-22448Dell BIOS contains an Out-of-Bounds Write vulnerability.Dell CPG BIOS
- CVE-2024-0159Dell Alienware Command Center, versions 5.5.52.0 and prior, contain improper access control vulnerability, leading to Denial of Service on…Dell Alienware Command Center
- CVE-2024-3542Campcodes Church Management System add_visitor.php cross site scriptingCampcodes Church Management System
- CVE-2024-3210Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5…properfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2024-2655Elementor Addons by Livemesh <= 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display NameLivemesh Addons by Elementor
- CVE-2024-2539Elementor Addons by Livemesh <= 8.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget _id attributeLivemesh Addons by Elementor
- CVE-2024-3541Campcodes Church Management System admin_user.php cross site scriptingCampcodes Church Management System
- CVE-2024-3540Campcodes Church Management System add_sundaysch.php sql injectionCampcodes Church Management System
- CVE-2024-3539Campcodes Church Management System addgiving.php sql injectionCampcodes Church Management System
- CVE-2024-2428The Ultimate Video Player For WordPress < 2.2.3 - Contributor+ Stored XSSThe Ultimate Video Player For WordPress
- CVE-2023-6385WordPress Ping Optimizer <= 2.35.1.3.0 - Log Clearing via CSRFWordPress Ping Optimizer
- CVE-2024-21507Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in…mysql2
- CVE-2024-21509Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper…mysql2
- CVE-2024-3538Campcodes Church Management System addTithes.php sql injectionCampcodes Church Management System
- CVE-2024-1042WP Radio – Worldwide Online Radio Stations Directory for WordPress <= 3.1.9 - Missing Authorization via multiple AJAX actionsprinceahmed WP Radio – Worldwide Online Radio Stations Dire…
- CVE-2024-3235Essential Grid <= 3.1.1 - Unauthenticated Private Post DisclosureThemePunch Essential Grid Gallery WordPress Plugin
- CVE-2024-2736Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tagsboldthemes Bold Page Builder
- CVE-2024-2735Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via "Price List" Elementboldthemes Bold Page Builder
- CVE-2024-2734Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI Featuresboldthemes Bold Page Builder
- CVE-2024-1041WP Radio – Worldwide Online Radio Stations Directory for WordPress <= 3.1.9 - Authenticated(Subscriber+) Stored Cross-Site Scripting via…princeahmed WP Radio – Worldwide Online Radio Stations Dire…
- CVE-2024-3537Campcodes Church Management System admin_user.php sql injectionCampcodes Church Management System
- CVE-2024-2733Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Elementboldthemes Bold Page Builder
- CVE-2024-2666Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-3536Campcodes Church Management System delete_log.php sql injectionCampcodes Church Management System
- CVE-2024-2664Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) Stored Cross-Site Scriptingleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-2665Premium Addons for Elementor <= 4.10.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Buttonleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-3533Campcodes Complete Online Student Management System academic_year_view.php cross site scriptingCampcodes Complete Online Student Management System
- CVE-2024-3532Campcodes Complete Online Student Management System attendance_view.php cross site scriptingCampcodes Complete Online Student Management System
- CVE-2024-3531Campcodes Complete Online Student Management System courses_view.php cross site scriptingCampcodes Complete Online Student Management System
- CVE-2023-50347Insecure SQL Interface affects HCL DRYiCE MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2024-3530Campcodes Complete Online Student Management System Marks_view.php cross site scriptingCampcodes Complete Online Student Management System
- CVE-2024-3529Campcodes Complete Online Student Management System students_view.php cross site scriptingCampcodes Complete Online Student Management System
- CVE-2024-3528Campcodes Complete Online Student Management System units_view.php cross site scriptingCampcodes Complete Online Student Management System
- CVE-2024-3526Campcodes Online Event Management System index.php cross site scriptingCampcodes Online Event Management System
- CVE-2023-40148PingFederate Server Side Request Forgery vulnerabilityPing Identity PingFederate
- CVE-2024-3525Campcodes Online Event Management System index.php cross site scriptingCampcodes Online Event Management System
- CVE-2024-23083Time4J Base v5.9.3 was discovered to contain a NullPointerException via the component…
- CVE-2024-23734Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for…
- CVE-2024-23735Cross Site Scripting (XSS) vulnerability in in the S/MIME certificate upload functionality of the User Profile pages in savignano S/Notify…
- CVE-2024-27476Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.
- CVE-2024-27477In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing…
- CVE-2024-28344An Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1.
- CVE-2024-28345An issue discovered in Sipwise C5 NGCP Dashboard below mr11.5.1 allows a low privileged user to access the Journal endpoint by directly…
- CVE-2024-29296A user enumeration vulnerability was found in Portainer CE 2.19.4.github.com/portainer/portainer
- CVE-2024-29460An issue in PX4 Autopilot v.1.14.0 allows an attacker to manipulate the flight path allowing for crashes of the drone via the home point…
- CVE-2024-29502An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths.