# CVEs published 2024-04-15

219 CVEs were published on April 15, 2024: 11 critical, 51 high. Days are UTC.

- [CVE-2024-27794](https://cve.now/CVE-2024-27794.md): Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly… (CVSS 4.3, Claris FileMaker Server)
- [CVE-2024-2424](https://cve.now/CVE-2024-2424.md): Rockwell Automation Input/Output Device Vulnerable to Major Nonrecoverable Fault (CVSS 7.5, Rockwell Automation 5015-AENFTXT)
- [CVE-2024-3493](https://cve.now/CVE-2024-3493.md): Rockwell Automation ControlLogix and GaurdLogix Vulnerable to Major Nonrecoverable Fault Due to Invalid Header Value (CVSS 8.6, Rockwell Automation ControlLogix · Rockwell Automation G… +2)
- [CVE-2024-23558](https://cve.now/CVE-2024-23558.md): HCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logout (CVSS 6.3, HCL Software DevOps Deploy / Launch)
- [CVE-2024-23561](https://cve.now/CVE-2024-23561.md): HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability (CVSS 4.3, HCL Software DevOps Deploy / Launch)
- [CVE-2024-32036](https://cve.now/CVE-2024-32036.md): SixLabors.ImageSharp vulnerable to data leakage (CVSS 5.3, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2024-32035](https://cve.now/CVE-2024-32035.md): Memory Allocation with Excessive Size Value in SixLabors.ImageSharp (CVSS 5.3, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2024-31990](https://cve.now/CVE-2024-31990.md): Argo CD' API server does not enforce project sourceNamespaces (CVSS 4.8, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2024-3804](https://cve.now/CVE-2024-3804.md): Vesystem Cloud Desktop fileupload2.php unrestricted upload (CVSS 6.3, Vesystem Cloud Desktop)
- [CVE-2024-23560](https://cve.now/CVE-2024-23560.md): HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type (CVSS 4.4, HCL Software DevOps Deploy / Launch)
- [CVE-2024-3803](https://cve.now/CVE-2024-3803.md): Vesystem Cloud Desktop fileupload.php unrestricted upload (CVSS 6.3, Vesystem Cloud Desktop)
- [CVE-2024-23594](https://cve.now/CVE-2024-23594.md): A buffer overflow vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8… (CVSS 6.4, Lenovo Windows 7 and 8 PC Preloads)
- [CVE-2024-23593](https://cve.now/CVE-2024-23593.md): A vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from… (CVSS 6.7, Lenovo Windows 7 and 8 PC Preloads)
- [CVE-2024-31219](https://cve.now/CVE-2024-31219.md): Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page (CVSS 4.3, discourse-reactions)
- [CVE-2024-2659](https://cve.now/CVE-2024-2659.md): A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to… (CVSS 7.2, Lenovo SMM, SMM2, FPC)
- [CVE-2023-4857](https://cve.now/CVE-2023-4857.md): An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI… (CVSS 7.5, Lenovo SMM, SMM2, FPC)
- [CVE-2023-4856](https://cve.now/CVE-2023-4856.md): A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a… (CVSS 8.8, Lenovo SMM, SMM2, FPC)
- [CVE-2023-4855](https://cve.now/CVE-2023-4855.md): A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to… (CVSS 7.2, Lenovo SMM, SMM2, FPC)
- [CVE-2023-48710](https://cve.now/CVE-2023-48710.md): iTop limit pages/exec.php script to PHP files (CVSS 9.8, Combodo iTop)
- [CVE-2023-48709](https://cve.now/CVE-2023-48709.md): iTop vulnerable to potential formula injection in Excel/CSV export file (CVSS 8.0, Combodo iTop)
- [CVE-2023-47626](https://cve.now/CVE-2023-47626.md): iTop vulnerable to XSS vulnerability in authent-token (CVSS 8.8, Combodo iTop)
- [CVE-2023-47622](https://cve.now/CVE-2023-47622.md): iTop vulnerable to XSS vulnerability in dashlet refresh (CVSS 8.8, Combodo iTop)
- [CVE-2023-47123](https://cve.now/CVE-2023-47123.md): iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget (CVSS 8.7, Combodo iTop)
- [CVE-2024-23559](https://cve.now/CVE-2024-23559.md): HCL DevOps Deploy / Launch is generating an obsolete HTTP header (CVSS 6.1, HCL Software DevOps Deploy / Launch)
- [CVE-2023-45808](https://cve.now/CVE-2023-45808.md): iTop missing silo check on extkey in console and portal (CVSS 4.1, Combodo iTop)
- [CVE-2023-44396](https://cve.now/CVE-2023-44396.md): iTop vulnerable to XSS in dashlet modifications ajax endpoints (CVSS 6.8, Combodo iTop)
- [CVE-2023-43790](https://cve.now/CVE-2023-43790.md): iTop vulnerable to XSS in friendlyname in object details (CVSS 5.7, Combodo iTop)
- [CVE-2023-38511](https://cve.now/CVE-2023-38511.md): iTop Dashboard editor vulnerable dashboard config file parameter (CVSS 5.0, Combodo iTop)
- [CVE-2024-3797](https://cve.now/CVE-2024-3797.md): SourceCodester QR Code Bookmark System sql injection (CVSS 6.3, SourceCodester QR Code Bookmark System)
- [CVE-2024-3796](https://cve.now/CVE-2024-3796.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3795](https://cve.now/CVE-2024-3795.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3794](https://cve.now/CVE-2024-3794.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3793](https://cve.now/CVE-2024-3793.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3792](https://cve.now/CVE-2024-3792.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3791](https://cve.now/CVE-2024-3791.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3790](https://cve.now/CVE-2024-3790.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3789](https://cve.now/CVE-2024-3789.md): Uncontrolled Resource Consumption vulnerability in WBSAirback (CVSS 6.5, WBSAirback White Bear Solutions)
- [CVE-2024-3788](https://cve.now/CVE-2024-3788.md): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (CVSS 6.6, WBSAirback White Bear Solutions)
- [CVE-2024-3787](https://cve.now/CVE-2024-3787.md): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (CVSS 6.6, WBSAirback White Bear Solutions)
- [CVE-2024-3786](https://cve.now/CVE-2024-3786.md): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (CVSS 6.6, WBSAirback White Bear Solutions)
- [CVE-2024-3785](https://cve.now/CVE-2024-3785.md): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (CVSS 6.6, WBSAirback White Bear Solutions)
- [CVE-2024-3784](https://cve.now/CVE-2024-3784.md): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (CVSS 6.6, WBSAirback White Bear Solutions)
- [CVE-2024-3783](https://cve.now/CVE-2024-3783.md): Path Traversal vulnerability in WBSAirback (CVSS 7.7, WBSAirback White Bear Solutions)
- [CVE-2024-3782](https://cve.now/CVE-2024-3782.md): Cross-Site Request Forgery (CSRF) vulnerability in WBSAirback (CVSS 8.8, WBSAirback White Bear Solutions)
- [CVE-2024-3781](https://cve.now/CVE-2024-3781.md): OS Command Injection vulnerability in WBSAirback (CVSS 9.1, WBSAirback White Bear Solutions)
- [CVE-2024-24898](https://cve.now/CVE-2024-24898.md): Information Leakage in kernel (CVSS 6.0, openEuler kernel)
- [CVE-2024-24891](https://cve.now/CVE-2024-24891.md): Information Leakage in kernel (CVSS 6.0, openEuler kernel)
- [CVE-2024-3780](https://cve.now/CVE-2024-3780.md): Information exposure vulnerability on Technicolor CGA2121 (CVSS 7.8, Technicolor CGA2121)
- [CVE-2024-26023](https://cve.now/CVE-2024-26023.md): OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands. (CVSS 4.2, BUFFALO WCR-1166DS · BUFFALO WSR-1166DHP +5)
- [CVE-2024-23486](https://cve.now/CVE-2024-23486.md): Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker… (CVSS 9.8, BUFFALO WSR-2533DHP · BUFFALO WSR-2533DHPL +2)
- [CVE-2024-28957](https://cve.now/CVE-2024-28957.md): Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series. (CVSS 5.3, DMG MORI Digital Co., LTD. and NEXT Co. Cente TCP/IPv4 · DM…)
- [CVE-2024-28894](https://cve.now/CVE-2024-28894.md): Out-of-bounds read vulnerability caused by improper checking of the option length values in IPv6 headers exists in Cente middleware TCP/IP… (CVSS 5.3, DMG MORI Digital Co., LTD. and NEXT Co. Cente IPv6)
- [CVE-2024-23911](https://cve.now/CVE-2024-23911.md): Out-of-bounds read vulnerability caused by improper checking of the option length values in IPv6 NDP packets exists in Cente middleware… (CVSS 7.5, DMG MORI Digital Co., LTD. and NEXT Co. Cente IPv6)
- [CVE-2024-30220](https://cve.now/CVE-2024-30220.md): Command injection vulnerability in PLANEX COMMUNICATIONS wireless LAN routers allows a network-adjacent unauthenticated attacker to… (CVSS 8.8, PLANEX COMMUNICATIONS MZK-MF300N · PLANEX COMMUNICATIONS MZ…)
- [CVE-2024-30219](https://cve.now/CVE-2024-30219.md): Active debug code vulnerability exists in PLANEX COMMUNICATIONS wireless LAN routers. (CVSS 6.8, PLANEX COMMUNICATIONS MZK-MF300N · PLANEX COMMUNICATIONS MZ…)
- [CVE-2024-29219](https://cve.now/CVE-2024-29219.md): Out-of-bounds read vulnerability exists in KV STUDIO Ver.11.64 and earlier and KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12… (CVSS 7.8, KEYENCE KV STUDIO · KEYENCE KV REPLAY VIEWER +1)
- [CVE-2024-29218](https://cve.now/CVE-2024-29218.md): Out-of-bounds write vulnerability exists in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12… (CVSS 8.8, KEYENCE KV STUDIO · KEYENCE KV REPLAY VIEWER +1)
- [CVE-2024-32129](https://cve.now/CVE-2024-32129.md): WordPress Freshdesk (official) plugin \<= 2.3.6 - Open Redirection vulnerability (CVSS 4.7, Freshworks Freshdesk)
- [CVE-2024-28099](https://cve.now/CVE-2024-28099.md): VT STUDIO Ver.8.32 and earlier contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. (CVSS 7.8, KEYENCE VT STUDIO)
- [CVE-2024-30546](https://cve.now/CVE-2024-30546.md): WordPress Login With Ajax plugin \<= 4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Pixelite Login With Ajax)
- [CVE-2024-31373](https://cve.now/CVE-2024-31373.md): WordPress E2Pdf plugin \<= 1.20.27 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, e2pdf)
- [CVE-2024-31374](https://cve.now/CVE-2024-31374.md): WordPress AppPresser plugin \<= 4.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Scott Bolinger AppPresser)
- [CVE-2024-31376](https://cve.now/CVE-2024-31376.md): WordPress Dashboard To-Do List plugin \<= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Andrew Dashboard To-Do List)
- [CVE-2024-31378](https://cve.now/CVE-2024-31378.md): WordPress MailChimp Forms by MailMunch plugin \<= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, MailChimp Forms by MailMunch)
- [CVE-2024-31379](https://cve.now/CVE-2024-31379.md): WordPress Smash Balloon Social Post Feed plugin \<= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Smash Balloon Social Post Feed)
- [CVE-2024-31381](https://cve.now/CVE-2024-31381.md): WordPress Spotlight Social Feeds plugin \<= 1.6.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, RebelCode Spotlight Social Media Feeds)
- [CVE-2024-31382](https://cve.now/CVE-2024-31382.md): WordPress Blocksy theme \<= 2.0.22 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, creativethemeshq Blocksy)
- [CVE-2024-31383](https://cve.now/CVE-2024-31383.md): WordPress PopularFX theme \<= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Pagelayer PopularFX)
- [CVE-2024-31384](https://cve.now/CVE-2024-31384.md): WordPress Spa and Salon theme \<= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rara Theme Spa and Salon)
- [CVE-2024-31385](https://cve.now/CVE-2024-31385.md): WordPress ReDi Restaurant Reservation plugin \<= 24.0128 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Reservation Diary ReDi Restaurant Reservation)
- [CVE-2024-31388](https://cve.now/CVE-2024-31388.md): WordPress Tablesome plugin \<= 1.0.25 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Pauple Table & Contact Form 7 Database – Tablesome)
- [CVE-2024-31389](https://cve.now/CVE-2024-31389.md): WordPress MihanPanel plugin \< 12.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Ertano MihanPanel)
- [CVE-2024-31421](https://cve.now/CVE-2024-31421.md): WordPress Popup by Supsystic plugin \<= 1.10.27 - Broken Access Control vulnerability (CVSS 4.3, Popup by Supsystic)
- [CVE-2024-22439](https://cve.now/CVE-2024-22439.md): Certain HPE FlexNetwork and FlexFabric Switches, Remote Authentication Bypass (CVSS 6.9, Hewlett Packard Enterprise HPE FlexNetwork and FlexFabric p…)
- [CVE-2024-31422](https://cve.now/CVE-2024-31422.md): WordPress Favicon by RealFaviconGenerator plugin \<= 1.3.29 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Philippe Bernard Favicon)
- [CVE-2024-31424](https://cve.now/CVE-2024-31424.md): WordPress Login with Phone Number plugin \<= 1.6.93 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Hamid Alinia Login with phone number)
- [CVE-2024-31425](https://cve.now/CVE-2024-31425.md): WordPress Amelia plugin \<= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, TMS Amelia)
- [CVE-2024-31426](https://cve.now/CVE-2024-31426.md): WordPress Inline Related Posts plugin \<= 3.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Data443 Inline Related Posts)
- [CVE-2024-31427](https://cve.now/CVE-2024-31427.md): WordPress Marker.io plugin \<= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Marker.io)
- [CVE-2024-22438](https://cve.now/CVE-2024-22438.md): HPE OfficeConnect 1820 Network switches, Cross-Site Request Forgery (CSRF) (CVSS 3.5, Hewlett Packard Enterprise HPE OfficeConnect 1820 Network s…)
- [CVE-2024-31428](https://cve.now/CVE-2024-31428.md): WordPress The Conference theme \<= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rara Theme The Conference)
- [CVE-2024-31429](https://cve.now/CVE-2024-31429.md): WordPress Sarada Lite theme \<= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Blossom Themes Sarada Lite)
- [CVE-2024-31431](https://cve.now/CVE-2024-31431.md): WordPress Product Input Fields for WooCommerce plugin \<= 1.7.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tyche Softwares Product Input Fields for WooCommerce)
- [CVE-2024-31432](https://cve.now/CVE-2024-31432.md): WordPress Restrict Content plugin \<= 3.2.8 - Broken Access Control vulnerability (CVSS 5.3, StellarWP Restrict Content)
- [CVE-2024-31433](https://cve.now/CVE-2024-31433.md): WordPress The Events Calendar plugin \<= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, StellarWP The Events Calendar)
- [CVE-2024-31434](https://cve.now/CVE-2024-31434.md): WordPress Newsletter plugin \<= 8.0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Stefano Lissa & The Newsletter Team Newsletter)
- [CVE-2024-31920](https://cve.now/CVE-2024-31920.md): WordPress Currency per Product for WooCommerce plugin \<= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tyche Softwares Currency per Product for WooCommerce)
- [CVE-2024-31921](https://cve.now/CVE-2024-31921.md): WordPress Ultimate Product Catalog plugin \<= 5.2.15 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Etoile Web Design Ultimate Product Catalogue)
- [CVE-2024-31922](https://cve.now/CVE-2024-31922.md): WordPress Hosting Benchmark tool plugin \<= 1.3.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Anton Aleksandrov WordPress Hosting Benchmark tool)
- [CVE-2024-31923](https://cve.now/CVE-2024-31923.md): WordPress Feather Login Page plugin \<= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, PluginOps Feather Login Page)
- [CVE-2024-31933](https://cve.now/CVE-2024-31933.md): WordPress Page Builder: Live Composer plugin \<= 1.5.35 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Live Composer Team Page Builder: Live Composer)
- [CVE-2024-31938](https://cve.now/CVE-2024-31938.md): WordPress NewsXpress theme \<= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Themeinwp NewsXpress)
- [CVE-2024-22437](https://cve.now/CVE-2024-22437.md): HPE MSA SAN Storage VSS Provider and CAPI Proxy Software, Elevation of Privilege (CVSS 7.3, Hewlett Packard Enterprise HPE MSA SAN Storage VSS Provider…)
- [CVE-2024-31940](https://cve.now/CVE-2024-31940.md): WordPress Extra Product Options Builder for WooCommerce plugin \<= 1.2.104 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, RedNao Extra Product Options Builder for WooCommerce)
- [CVE-2024-31941](https://cve.now/CVE-2024-31941.md): WordPress CP Media Player plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, CodePeople CP Media Player)
- [CVE-2024-31942](https://cve.now/CVE-2024-31942.md): WordPress Calendarista Basic Edition plugin \<= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, typps Calendarista Basic Edition)
- [CVE-2024-32084](https://cve.now/CVE-2024-32084.md): WordPress Before And After plugin \<= 3.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Gold Plugins Before And After)
- [CVE-2024-32085](https://cve.now/CVE-2024-32085.md): WordPress Citadela Listing plugin \< 5.20.0 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, AitThemes Citadela Listing)
- [CVE-2024-32088](https://cve.now/CVE-2024-32088.md): WordPress Website Builder plugin \<= 6.15.20 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Coming Soon Page, Under Construction & Maintenance Mode by…)
- [CVE-2024-22435](https://cve.now/CVE-2024-22435.md): HPE NonStop Web ViewPoint Enterprise software, Unauthorized access (CVSS 8.3, Hewlett Packard Enterprise HPE NonStop Web ViewPoint Enterp…)
- [CVE-2024-32089](https://cve.now/CVE-2024-32089.md): WordPress Digital Publications by Supsystic plugin \<= 1.7.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Digital Publications by Supsystic)
- [CVE-2024-32090](https://cve.now/CVE-2024-32090.md): WordPress Church Admin plugin \<= 4.0.27 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, andy\_moyle Church Admin)
- [CVE-2024-32091](https://cve.now/CVE-2024-32091.md): WordPress Sangar Slider plugin \<= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, Tonjoo Sangar Slider)
- [CVE-2024-32092](https://cve.now/CVE-2024-32092.md): WordPress Kimili Flash Embed plugin \<= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Michael Bester Kimili Flash Embed)
- [CVE-2024-32093](https://cve.now/CVE-2024-32093.md): WordPress Novelist plugin \<= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Nose Graze Novelist)
- [CVE-2024-32094](https://cve.now/CVE-2024-32094.md): WordPress Church Content plugin \<= 2.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ChurchThemes Church Content – Sermons, Events and More)
- [CVE-2024-32095](https://cve.now/CVE-2024-32095.md): WordPress MultiParcels Shipping For WooCommerce plugin \< 1.16.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, MultiParcels Shipping For WooCommerce)
- [CVE-2024-32096](https://cve.now/CVE-2024-32096.md): WordPress WP Synchro plugin \<= 1.11.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, DAEV.tech WP Migration Plugin DB & Files – WP Synchro)
- [CVE-2024-32097](https://cve.now/CVE-2024-32097.md): WordPress GEO my WordPress plugin \<= 4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Eyal Fitoussi GEO my WordPress)
- [CVE-2024-32099](https://cve.now/CVE-2024-32099.md): WordPress WP Mail Catcher plugin \<= 2.1.6 - Cross Site Request Forgery vulnerability (CVSS 4.3, James Ward WP Mail Catcher)
- [CVE-2024-32101](https://cve.now/CVE-2024-32101.md): WordPress Email Marketing for WooCommerce plugin \<= 1.14.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Email Marketing for WooCommerce by Omnisend)
- [CVE-2024-32102](https://cve.now/CVE-2024-32102.md): WordPress Crony Cronjob Manager plugin \<= 0.5.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Scott Kingsley Clark Crony Cronjob Manager)
- [CVE-2024-32103](https://cve.now/CVE-2024-32103.md): WordPress Siteimprove plugin \<= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Siteimprove)
- [CVE-2024-32104](https://cve.now/CVE-2024-32104.md): WordPress NextMove Lite plugin \<= 2.18.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, XLPlugins NextMove Lite)
- [CVE-2024-32141](https://cve.now/CVE-2024-32141.md): WordPress Libsyn Publisher Hub plugin \<= 1.4.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Libsyn Publisher Hub)
- [CVE-2024-32433](https://cve.now/CVE-2024-32433.md): WordPress BEAF plugin \<= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Themefic BEAF)
- [CVE-2024-32434](https://cve.now/CVE-2024-32434.md): WordPress Order Delivery Date for WooCommerce plugin \<= 3.20.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tyche Softwares Order Delivery Date for WooCommerce)
- [CVE-2024-32435](https://cve.now/CVE-2024-32435.md): WordPress AffiEasy plugin \<= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, perrinalexandre05 AffiEasy)
- [CVE-2024-32436](https://cve.now/CVE-2024-32436.md): WordPress Gift Cards plugin \<= 4.4.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Codemenschen Gift Vouchers)
- [CVE-2024-32437](https://cve.now/CVE-2024-32437.md): WordPress eCommerce Product Catalog plugin \<= 3.3.28 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, impleCode eCommerce Product Catalog)
- [CVE-2024-32438](https://cve.now/CVE-2024-32438.md): WordPress SEO Booster plugin \<= 3.8.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, cleverplugins.com SEO Booster)
- [CVE-2024-32439](https://cve.now/CVE-2024-32439.md): WordPress WP Client Reports plugin \<= 1.0.22 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, SwitchWP WP Client Reports)
- [CVE-2024-32440](https://cve.now/CVE-2024-32440.md): WordPress Asgaros Forum plugin \<= 2.8.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Thomas Belser Asgaros Forum)
- [CVE-2024-32441](https://cve.now/CVE-2024-32441.md): WordPress Zoho Campaigns plugin \<= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Zoho Campaigns)
- [CVE-2024-32442](https://cve.now/CVE-2024-32442.md): WordPress Zoho Campaigns plugin \<= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Zoho Campaigns)
- [CVE-2024-32443](https://cve.now/CVE-2024-32443.md): WordPress IP2Location Country Blocker plugin \<= 2.34.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Download IP2Location Country Blocker)
- [CVE-2024-32445](https://cve.now/CVE-2024-32445.md): WordPress WebinarIgnition plugin \<= 3.05.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Saleswonder Team: Tobias WebinarIgnition)
- [CVE-2024-32446](https://cve.now/CVE-2024-32446.md): WordPress Wallet System for WooCommerce plugin \<= 2.5.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, WP Swings Wallet System for WooCommerce)
- [CVE-2024-32447](https://cve.now/CVE-2024-32447.md): WordPress AWP Classifieds plugin \<= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, AWP Classifieds Team AWP Classifieds)
- [CVE-2024-3701](https://cve.now/CVE-2024-3701.md): Improper Authentication in com.transsion.kolun.aiservice (CVSS 9.8, TECNO com.transsion.kolun.aiservice)
- [CVE-2024-32448](https://cve.now/CVE-2024-32448.md): WordPress Ads.txt Admin plugin \<= 1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, VideoYield.com Ads.txt Admin)
- [CVE-2024-32449](https://cve.now/CVE-2024-32449.md): WordPress RestroPress plugin \<= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, MagniGenie RestroPress)
- [CVE-2024-32450](https://cve.now/CVE-2024-32450.md): WordPress WpTravelly plugin \<= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, MagePeople Team WpTravelly)
- [CVE-2024-32451](https://cve.now/CVE-2024-32451.md): WordPress Legal Pages plugin \<= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wpWax Legal Pages)
- [CVE-2024-32452](https://cve.now/CVE-2024-32452.md): WordPress Shopping Cart & eCommerce Store plugin \<= 5.5.19 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, WP EasyCart)
- [CVE-2024-30545](https://cve.now/CVE-2024-30545.md): WordPress Social Author Bio plugin \<= 2.4 - Stored XSS via Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Nick Powers Social Author Bio)
- [CVE-2024-31086](https://cve.now/CVE-2024-31086.md): WordPress Change default login logo,url and title plugin \<= 2.0 - CSRF to XSS vulnerability (CVSS 7.1, Venugopal Change default login logo,url and title)
- [CVE-2024-31093](https://cve.now/CVE-2024-31093.md): WordPress Broken Images plugin \<= 0.2 - CSRF to XSS vulnerability (CVSS 7.1, Kaloyan K. Tsvetkov Broken Images)
- [CVE-2024-32082](https://cve.now/CVE-2024-32082.md): WordPress Sync Post With Other Site plugin \<= 1.9.1 - Cross Site Request Forgery (CSRF) to XSS vulnerability (CVSS 7.1, Kamlesh Parmar Sync Post With Other Site)
- [CVE-2024-3505](https://cve.now/CVE-2024-3505.md): JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege users (CVSS 4.3, JFrog Artifactory Self-Hosted)
- [CVE-2024-32087](https://cve.now/CVE-2024-32087.md): WordPress Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More plugin \<= 3.5.7 - Auth. SQL Injection (SQLi)… (CVSS 7.6, ExportFeed.com Product Feed on WooCommerce for Google)
- [CVE-2024-32098](https://cve.now/CVE-2024-32098.md): WordPress Advanced Page Visit Counter plugin \<= 8.0.6 - Auth. SQL Injection (SQLi) vulnerability (CVSS 7.6, Advanced Page Visit Counter)
- [CVE-2024-32125](https://cve.now/CVE-2024-32125.md): WordPress BA Book Everything plugin \<= 1.6.4 - Auth. SQL Injection vulnerability (CVSS 8.5, Booking Algorithms BA Book Everything)
- [CVE-2024-32127](https://cve.now/CVE-2024-32127.md): WordPress Find Duplicates plugin \<= 1.4.6 - Auth. SQL Injection vulnerability (CVSS 8.5, Markus Seyer Find Duplicates)
- [CVE-2024-32128](https://cve.now/CVE-2024-32128.md): WordPress Realtyna Organic IDX plugin + WPL Real Estate plugin \<= 4.14.4 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, Realtyna Organic IDX plugin)
- [CVE-2024-32132](https://cve.now/CVE-2024-32132.md): WordPress CBX Bookmark & Favorite plugin \<= 1.7.20 - SQL Injection vulnerability (CVSS 7.6, Codeboxr Team CBX Bookmark & Favorite)
- [CVE-2024-32134](https://cve.now/CVE-2024-32134.md): WordPress Forms to Zapier plugin \<= 1.1.12 - Auth. SQL Injection vulnerability (CVSS 7.6, Nasirahmed Forms to Zapier, Integromat, IFTTT, Workato, Aut…)
- [CVE-2024-32135](https://cve.now/CVE-2024-32135.md): WordPress Disable Comments | WPZest plugin \<= 1.51 - SQL Injection vulnerability (CVSS 7.6, Disable Comments | WPZest)
- [CVE-2024-32136](https://cve.now/CVE-2024-32136.md): WordPress BWL Advanced FAQ Manager plugin \<= 2.0.3 - Auth. SQL Injection vulnerability (CVSS 7.6, Xenioushk BWL Advanced FAQ Manager)
- [CVE-2024-32137](https://cve.now/CVE-2024-32137.md): WordPress User Activity Log Pro plugin \<= 2.3.4 - Auth. SQL Injection vulnerability (CVSS 8.5, Solwin User Activity Log Pro)
- [CVE-2024-32139](https://cve.now/CVE-2024-32139.md): WordPress Podlove Podcast Publisher plugin \<= 4.0.12 - SQL Injection vulnerability (CVSS 8.5, Podlove Podcast Publisher)
- [CVE-2024-32431](https://cve.now/CVE-2024-32431.md): WordPress Import Users from CSV plugin \<= 1.2 - PHP Object Injection (CVSS 4.4, WP All Import Import Users from CSV)
- [CVE-2024-32430](https://cve.now/CVE-2024-32430.md): WordPress ActiveCampaign plugin \<= 8.1.14 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, ActiveCampaign)
- [CVE-2024-32454](https://cve.now/CVE-2024-32454.md): WordPress Wappointment plugin \<= 2.6.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, Appointment Bookings for Zoom GoogleMeet and more – Wappoin…)
- [CVE-2023-52144](https://cve.now/CVE-2023-52144.md): WordPress Product Feed Manager plugin \<= 7.3.15 - Directory Traversal vulnerability (CVSS 5.5, RexTheme Product Feed Manager)
- [CVE-2024-32079](https://cve.now/CVE-2024-32079.md): WordPress Advanced iFrame plugin \<= 2024.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Michael Dempfle Advanced iFrame)
- [CVE-2024-32133](https://cve.now/CVE-2024-32133.md): WordPress EZ Form Calculator plugin \<= 2.14.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Michael Schuppenies EZ Form Calculator)
- [CVE-2024-32138](https://cve.now/CVE-2024-32138.md): WordPress Short URL plugin \<= 1.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, KaizenCoders Short URL)
- [CVE-2024-32140](https://cve.now/CVE-2024-32140.md): WordPress Libsyn Publisher Hub plugin \<= 1.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Libsyn Publisher Hub)
- [CVE-2024-32145](https://cve.now/CVE-2024-32145.md): WordPress WP Google Analytics Events – No-Code Custom Event Tracking for Google Analytics plugin \<= 2.8.0 - Reflected Cross-Site Scripting… (CVSS 7.1, PineWise WP Google Analytics Events)
- [CVE-2024-32147](https://cve.now/CVE-2024-32147.md): WordPress Contact Form Plugin plugin \<= 1.1.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Form Plugin Team - GhozyLab Easy Contact Form Lite)
- [CVE-2024-32149](https://cve.now/CVE-2024-32149.md): WordPress Jobs for WordPress plugin \<= 2.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BlueGlass Jobs for WordPress)
- [CVE-2024-32428](https://cve.now/CVE-2024-32428.md): WordPress MWW Disclaimer Buttons plugin \<= 3.0.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Moss Web Works MWW Disclaimer Buttons)
- [CVE-2024-32429](https://cve.now/CVE-2024-32429.md): WordPress Remove Footer Credit plugin \<= 1.0.13 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPChill Remove Footer Credit)
- [CVE-2024-32453](https://cve.now/CVE-2024-32453.md): WordPress POEditor plugin \<= 0.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, POEditor)
- [CVE-2024-3771](https://cve.now/CVE-2024-3771.md): PHPGurukul Student Record System edit-subject.php sql injection (CVSS 6.3, PHPGurukul Student Record System)
- [CVE-2024-3770](https://cve.now/CVE-2024-3770.md): PHPGurukul Student Record System sql injection (CVSS 6.3, PHPGurukul Student Record System)
- [CVE-2024-2858](https://cve.now/CVE-2024-2858.md): Simple Buttons Creator \<= 1.04 - Aribtrary Button Deletion via CSRF (CVSS 4.8, Simple Buttons Creator)
- [CVE-2024-2857](https://cve.now/CVE-2024-2857.md): Simple Buttons Creator \<= 1.04 - Unauthenticated Stored XSS (CVSS 6.1, Simple Buttons Creator)
- [CVE-2024-2836](https://cve.now/CVE-2024-2836.md): Super Socializer \< 7.13.64 - Editor+ Stored XSS (CVSS 4.8, Social Share, Social Login and Social Comments Plugin)
- [CVE-2024-2739](https://cve.now/CVE-2024-2739.md): Advance Search \<= 1.1.6 - Shortcode Deletion via CSRF (CVSS 8.7, Advanced Search)
- [CVE-2024-1849](https://cve.now/CVE-2024-1849.md): WP Customer Reviews \< 3.7.1 - Malicious Redirect via HTTP-EQUIV Injection (CVSS 5.4, WP Customer Reviews)
- [CVE-2024-1846](https://cve.now/CVE-2024-1846.md): Responsive Tabs \< 4.0.7 - Contributor+ Stored XSS (CVSS 5.4, Responsive Tabs)
- [CVE-2024-1755](https://cve.now/CVE-2024-1755.md): NPS computy \<= 2.7.5 - Results Deletion via CSRF (CVSS 8.8, NPS computy)
- [CVE-2024-1754](https://cve.now/CVE-2024-1754.md): NPS computy \<= 2.7.5 - Admin+ Stored XSS (CVSS 4.7, NPS computy)
- [CVE-2024-1746](https://cve.now/CVE-2024-1746.md): Testimonial Slider \< 2.3.8 - Admin+ Stored XSS (CVSS 5.4, Testimonial Slider)
- [CVE-2024-1712](https://cve.now/CVE-2024-1712.md): Carousel Slider \< 2.2.7 - Editor+ Stored XSS (CVSS 4.7, Carousel Slider)
- [CVE-2024-1660](https://cve.now/CVE-2024-1660.md): Top Bar \< 3.0.5 - Admin+ Stored XSS (CVSS 4.8, Top Bar)
- [CVE-2024-1310](https://cve.now/CVE-2024-1310.md): WooCommerce \< 8.6 - Contributor+ Private/Draft Products Access (CVSS 4.9, WooCommerce)
- [CVE-2024-1307](https://cve.now/CVE-2024-1307.md): Smart Forms \< 2.6.94 - Subscriber+ Edit Entries via Broken Access Control (CVSS 6.5, Smart Forms)
- [CVE-2024-1306](https://cve.now/CVE-2024-1306.md): Smart Forms \< 2.6.94 - Edit Entries via CSRF (CVSS 5.4, Smart Forms)
- [CVE-2024-1204](https://cve.now/CVE-2024-1204.md): Meta Box \< 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure (CVSS 4.3, Meta Box)
- [CVE-2024-0902](https://cve.now/CVE-2024-0902.md): Fancy Product Designer \< 6.1.81 - Admin+ Cross Site Scripting via Product Title (CVSS 4.3, Fancy Product Designer)
- [CVE-2024-0399](https://cve.now/CVE-2024-0399.md): WooCommerce Customers Manager \< 29.7 - Subscriber+ SQL Injection (CVSS 8.1, WooCommerce Customers Manager)
- [CVE-2023-7201](https://cve.now/CVE-2023-7201.md): Everest Backup \< 2.2.5 - Admin+ Arbitrary File Upload (CVSS 6.5, Everest Backup)
- [CVE-2023-6067](https://cve.now/CVE-2023-6067.md): WP User Profile Avatar \<= 1.0.1 - Contributor+ Stored XSS (CVSS 5.4, WP User Profile Avatar)
- [CVE-2024-1655](https://cve.now/CVE-2024-1655.md): ASUS WiFi Router - OS Command Injection (CVSS 8.8, ASUS ExpertWiFi EBM63 · ASUS ExpertWiFi EBM68 +1)
- [CVE-2024-3769](https://cve.now/CVE-2024-3769.md): PHPGurukul Student Record System login.php sql injection (CVSS 7.3, PHPGurukul Student Record System)
- [CVE-2024-3778](https://cve.now/CVE-2024-3778.md): Ai3 QbiBot - Unrestricted File Upload (CVSS 7.2, Ai3 QbiBot)
- [CVE-2024-3768](https://cve.now/CVE-2024-3768.md): PHPGurukul/itsourcecode News Portal search.php sql injection (CVSS 5.3, PHPGurukul News Portal · itsourcecode News Portal)
- [CVE-2024-3777](https://cve.now/CVE-2024-3777.md): Ai3 QbiBot - Broken Access Control (CVSS 9.8, Ai3 QbiBot)
- [CVE-2024-3767](https://cve.now/CVE-2024-3767.md): PHPGurukul News Portal edit-post.php sql injection (CVSS 5.3, PHPGurukul News Portal)
- [CVE-2024-3776](https://cve.now/CVE-2024-3776.md): Netvision airPASS - Reflected XSS (CVSS 6.1, Netvision airPASS)
- [CVE-2024-3775](https://cve.now/CVE-2024-3775.md): aEnrich Technology a+HRD - Argument Injection (CVSS 5.3, aEnrich Technology a+HRD)
- [CVE-2024-3774](https://cve.now/CVE-2024-3774.md): aEnrich Technology a+HRD - Exposure of Sensitive Data (CVSS 5.3, aEnrich Technology a+HRD)
- [CVE-2024-3772](https://cve.now/CVE-2024-3772.md): Regular expression denial of service in Pydantic \< 2.4.0 (CVSS 5.9, Pydantic)
- [CVE-2020-22539](https://cve.now/CVE-2020-22539.md): An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitrary code via… (CVSS 7.2)
- [CVE-2020-22540](https://cve.now/CVE-2020-22540.md): Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive… (CVSS 5.4)
- [CVE-2023-33806](https://cve.now/CVE-2023-33806.md): Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary… (CVSS 7.8)
- [CVE-2023-45503](https://cve.now/CVE-2023-45503.md): SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service… (CVSS 5.3)
- [CVE-2024-22014](https://cve.now/CVE-2024-22014.md): An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via… (CVSS 8.8)
- [CVE-2024-24485](https://cve.now/CVE-2024-24485.md): An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive information via the GET… (CVSS 7.5)
- [CVE-2024-24486](https://cve.now/CVE-2024-24486.md): An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to edit device settings via the SAVE EEP\_DATA… (CVSS 9.1)
- [CVE-2024-24487](https://cve.now/CVE-2024-24487.md): An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP… (CVSS 6.8)
- [CVE-2024-28056](https://cve.now/CVE-2024-28056.md): Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. (CVSS 9.8, @aws-amplify/cli)
- [CVE-2024-28556](https://cve.now/CVE-2024-28556.md): SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate… (CVSS 9.8)
- [CVE-2024-28557](https://cve.now/CVE-2024-28557.md): SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate… (CVSS 9.8)
- [CVE-2024-28558](https://cve.now/CVE-2024-28558.md): SQL Injection vulnerability in sourcecodester Petrol pump management software v1.0, allows remote attackers to execute arbitrary code… (CVSS 8.8)
- [CVE-2024-30567](https://cve.now/CVE-2024-30567.md): An issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to execute arbitrary code via the Network… (CVSS 6.3)
- [CVE-2024-30656](https://cve.now/CVE-2024-30656.md): An issue in Fireboltt Dream Wristphone BSW202\_FB\_AAC\_v2.0\_20240110-20240110-1956 allows attackers to cause a Denial of Service (DoS) via a… (CVSS 5.1)
- [CVE-2024-30840](https://cve.now/CVE-2024-30840.md): A Stack Overflow vulnerability in Tenda AC15 v15.03.05.18 allows attackers to cause a denial of service via the LISTEN parameter in the… (CVSS 6.5)
- [CVE-2024-31497](https://cve.now/CVE-2024-31497.md): In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a… (CVSS 5.9)
- [CVE-2024-31648](https://cve.now/CVE-2024-31648.md): Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts or HTML via a… (CVSS 6.1)
- [CVE-2024-31649](https://cve.now/CVE-2024-31649.md): A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML… (CVSS 5.4)
- [CVE-2024-31650](https://cve.now/CVE-2024-31650.md): A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML… (CVSS 9.6)
- [CVE-2024-31651](https://cve.now/CVE-2024-31651.md): A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML… (CVSS 6.1)
- [CVE-2024-31652](https://cve.now/CVE-2024-31652.md): A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML… (CVSS 6.1)
- [CVE-2024-32488](https://cve.now/CVE-2024-32488.md): In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the… (CVSS 7.8)
- [CVE-2024-32489](https://cve.now/CVE-2024-32489.md): TCPDF before 6.7.4 mishandles calls that use HTML syntax. (CVSS 6.1, tecnickcom/tcpdf)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2024-04-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.