CVEs published April 1, 2024
103 CVEs were published on April 1, 2024: 10 critical, 34 high.
- Published
- 103
- Critical
- 10
- High
- 34
- Medium
- 38
- Low
- 19
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Qualcomm Snapdragon
- 16
- PDF-XChange Editor
- 10
- Centreon · centreon/centreon
- 6
- MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…
- 5
- Voltronic Power ViewPower Pro
- 4
- Linux
- 3
- MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…
- 3
- SourceCodester Computer Laboratory Management System
- 3
- Themify
- 3
- dotCMS core
- 2
Critical 10
- CVE-2024-1863Sante PACS Server Token Endpoint SQL Injection Remote Code Execution VulnerabilitySante PACS Server
- CVE-2023-51573Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass VulnerabilityVoltronic Power ViewPower Pro
- CVE-2023-51572Voltronic Power ViewPower Pro getMacAddressByIp Command Injection Remote Code Execution VulnerabilityVoltronic Power ViewPower Pro
- CVE-2023-51570Voltronic Power ViewPower Pro Deserialization of Untrusted Data Remote Code Execution VulnerabilityVoltronic Power ViewPower Pro
- CVE-2024-21473Improper Input Validation in WIN SONQualcomm Snapdragon
- CVE-2024-29433A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying cra
- CVE-2024-30858netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_fire_wall.php.
- CVE-2024-30865netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_user_login.php.
- CVE-2024-30867netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_virtual_site_info.php.
- CVE-2024-30868netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/add_getlogin.php.
High 34
- CVE-2024-27327PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2024-27323PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution VulnerabilityPDF-XChange Editor
- CVE-2024-23119Centreon insertGraphTemplate SQL Injection Remote Code Execution VulnerabilityCentreon · centreon/centreon
- CVE-2024-23118Centreon updateContactHostCommands SQL Injection Remote Code Execution VulnerabilityCentreon · centreon/centreon
- CVE-2024-23117Centreon updateContactServiceCommands SQL Injection Remote Code Execution VulnerabilityCentreon · centreon/centreon
- CVE-2024-23116Centreon updateLCARelation SQL Injection Remote Code Execution VulnerabilityCentreon · centreon/centreon
- CVE-2024-23115Centreon updateGroups SQL Injection Remote Code Execution VulnerabilityCentreon · centreon/centreon
- CVE-2024-1179TP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution VulnerabilityTP-Link Omada ER605
- CVE-2024-0637Centreon updateDirectory SQL Injection Remote Code Execution VulnerabilityCentreon · centreon/centreon
- CVE-2023-51571Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service VulnerabilityVoltronic Power ViewPower Pro
- CVE-2024-25574Delta Electronics DIAEnergie SQL InjectionDelta Electronics DIAEnergie
- CVE-2024-21472Use After Free in KernelQualcomm Snapdragon
- CVE-2024-21470Integer Overflow to Buffer Overflow in Graphics WindowsQualcomm Snapdragon
- CVE-2024-21468Use After Free in KernelQualcomm Snapdragon
- CVE-2024-21463Buffer Copy Without Checking Size of Input in AudioQualcomm Snapdragon
- CVE-2024-21454Integer Overflow to Buffer Overflow in Automotive TelematicsQualcomm Snapdragon
- CVE-2024-21453Improper Input Validation in Automotive TelematicsQualcomm Snapdragon
- CVE-2024-21452Improper Input Validation in Automotive TelematicsQualcomm Snapdragon
- CVE-2023-33115Buffer Over-read in Trusted Execution EnvironmentQualcomm Snapdragon
- CVE-2023-33101Incorrect Type Conversion or Cast in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2023-33100Improper input validation in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2023-33099Improper Input Validation in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2023-33023Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-ApplicationsQualcomm Snapdragon
- CVE-2023-28547Buffer Copy Without Checking Size of Input in SPS ApplicationsQualcomm Snapdragon
- CVE-2023-6154Local privilege escalation in Bitdefender Total Security (VA-11168)Bitdefender Total Security · Bitdefender Internet Securi… +2
- CVE-2024-26654ALSA: sh: aica: reorder cleanup operations to avoid UAF bugsLinux
- CVE-2024-20053In flashc, there is a possible out of bounds write due to an uncaught exception.MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…
- CVE-2024-20040In wlan firmware, there is a possible out of bounds write due to improper input validation.MediaTek MT2713, MT6580, MT6761, MT6762, MT6768, MT6781, MT…
- CVE-2024-20039In modem protocol, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2731, MT2735, MT2737, MT3967, MT6297, MT6298, MT…
- CVE-2024-30859netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupSSLCert.php.
- CVE-2024-30860netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/export_excel_user.php.
- CVE-2024-30862netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/index.php.
- CVE-2024-30870netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/address_interpret.php.
- CVE-2024-30871netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/applyhardware.php.
Medium, low and unrated 59
- CVE-2024-27334Kofax Power PDF JPG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityKofax Power PDF
- CVE-2024-27333Kofax Power PDF GIF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityKofax Power PDF
- CVE-2024-3141Clavister E10/E80 Misc Settings Page MiscSettings cross site scriptingClavister E10 · Clavister E80
- CVE-2024-3140SourceCodester Computer Laboratory Management System cross site scriptingSourceCodester Computer Laboratory Management System
- CVE-2024-3139SourceCodester Computer Laboratory Management System save_users improper authorizationSourceCodester Computer Laboratory Management System
- CVE-2024-3138francoisjacquet RosarioSIS Add Portal Note cross site scriptingfrancoisjacquet RosarioSIS · francoisjacquet/rosariosis
- CVE-2024-27332PDF-XChange Editor JPG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2024-27331PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2024-27330PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2024-27329PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2024-27328PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2024-27326PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2024-27325PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2024-27324PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityPDF-XChange Editor
- CVE-2024-3165Database Credential Exposure in the LogsdotCMS core
- CVE-2024-3164In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accedotCMS core
- CVE-2024-3135Cross-Site Request Forgery (CSRF) Vulnerability in mudler/localaimudler/localai · github.com/go-skynet/LocalAI
- CVE-2024-28232Username Enumeration in CasaOS via bypass of CVE-2024-24766IceWhaleTech CasaOS-UserService · github.com/IceWhaleTech/C…
- CVE-2024-3131SourceCodester Computer Laboratory Management System sql injectionSourceCodester Computer Laboratory Management System
- CVE-2024-3129SourceCodester Image Accordion Gallery App add-image.php unrestricted uploadSourceCodester Image Accordion Gallery App
- CVE-2023-43515Buffer copy without checking size of input (Classic buffer overflow) in HLOSQualcomm Snapdragon
- CVE-2023-33111Improper Validation of Array Index in AudioQualcomm Snapdragon
- CVE-2024-26655Fix memory leak in posix_clock_open()Linux
- CVE-2024-3128Replify-Messenger Backup File androidmanifest.xml backupReplify-Messenger
- CVE-2024-31099WordPress Phlox Core Elements plugin <= 2.15.7 - Broken Access Control vulnerabilityAverta Shortcodes and extra features for Phlox theme
- CVE-2024-3125Zebra ZTC GK420d Alert Setup Page settings cross site scriptingZebra ZTC GK420d
- CVE-2024-3124fridgecow smartalarm Backup File androidmanifest.xml backupfridgecow smartalarm
- CVE-2022-4966sequentech admin-console Election Description cross site scriptingsequentech admin-console
- CVE-2024-3130 Insecure Data Storage leading to sensitive Information disclosure.CoolKIt eWeLink APP
- CVE-2024-26653usb: misc: ljca: Fix double free in error handling pathLinux
- CVE-2016-15038NUUO NVRmini 2 deletefile.php path traversalNUUO NVRmini
- CVE-2024-2278WooCommerce Product Filter < 1.4.4 - Admin+ Stored XSSThemify
- CVE-2024-2263WooCommerce Product Filter < 1.4.4 - Reflected XSSThemify
- CVE-2024-2262WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRFThemify
- CVE-2024-1526Hubbub Lite < 1.33.1 - Unauthenticated Password Protected Posts AccessHubbub Lite
- CVE-2024-20055In imgsys, there is a possible information disclosure due to a missing bounds check.MediaTek MT2713, MT8168, MT8173, MT8175, MT8188, MT8195, MT…
- CVE-2024-20054In gnss, there is a possible escalation of privilege due to a missing bounds check.MediaTek MT2735, MT2737, MT6762, MT6765, MT6769, MT6833, MT…
- CVE-2024-20052In flashc, there is a possible information disclosure due to an uncaught exception.MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…
- CVE-2024-20051In flashc, there is a possible system crash due to an uncaught exception.MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…
- CVE-2024-20050In flashc, there is a possible information disclosure due to an uncaught exception.MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…
- CVE-2024-20049In flashc, there is a possible information disclosure due to an uncaught exception.MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…
- CVE-2024-20048In flashc, there is a possible information disclosure due to an uncaught exception.MediaTek MT2713, MT6781, MT6789, MT6835, MT6855, MT6879, MT…
- CVE-2024-20047In battery, there is a possible out of bounds read due to an integer overflow.MediaTek MT6739, MT6768, MT6781, MT6833, MT6853, MT6877, MT…
- CVE-2024-20046In battery, there is a possible escalation of privilege due to an integer overflow.MediaTek MT6761, MT6765, MT6768, MT6789, MT6833, MT6855, MT…
- CVE-2024-20045In audio, there is a possible out of bounds read due to an incorrect calculation of buffer size.MediaTek MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, M…
- CVE-2024-20044In da, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…
- CVE-2024-20043In da, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…
- CVE-2024-20042In da, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…
- CVE-2024-20041In da, there is a possible out of bounds read due to a missing bounds check.MediaTek MT2713, MT6781, MT6789, MT6835, MT6855, MT6879, MT…
- CVE-2024-28895'Yahoo! JAPAN' App for Android v2.3.1 to v3.161.1 and 'Yahoo! JAPAN' App for iOS v3.2.2 to v4.109.0 contain a cross-site scripting vulnerabiLY 'Yahoo! JAPAN' App for Android · LY 'Yahoo! JAPAN' App f…
- CVE-2023-48906Stack Overflow vulnerability in Btstack 1.6 and earlier allows attackers to cause a denial of service via crafted input to the char_for_nibb
- CVE-2024-25080WebMail in Axigen 10.x before 10.3.3.62 allows XSS via the image attachment viewer.
- CVE-2024-29435An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.
- CVE-2024-30861netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/configguide/ipsec_guide_1.php.
- CVE-2024-30863netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/history.php.
- CVE-2024-30864netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupTimePolicy.php.
- CVE-2024-30866netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/menu.php.
- CVE-2024-30872netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /include/authrp.php.
- CVE-2024-31033JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key.