CVEs published April 2, 2024
172 CVEs were published on April 2, 2024: 8 critical, 59 high.
- Published
- 172
- Critical
- 8
- High
- 59
- Medium
- 62
- Low
- 22
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 31
Most affected products
- Linux
- 35
- Foxit PDF Reader
- 33
- OpenHarmony
- 10
- Samsung Mobile Devices
- 8
- DJI Mavic 3 Pro · DJI Mavic +2
- 7
- DedeCMS
- 6
- c-blosc2
- 2
- DJI Mini 3 Pro
- 2
- VMware SD-WAN Edge
- 2
- Xpdf
- 2
Critical 8
- CVE-2024-2389Flowmon Unauthenticated Command Injection VulnerabilityProgress Software Flowmon
- CVE-2024-26665tunnels: fix out of bounds access when building IPv6 PMTU errorLinux
- CVE-2024-27602Alldata V0.4.6 is vulnerable to Incorrect Access Control.
- CVE-2024-27604Alldata V0.4.6 is vulnerable to Command execution vulnerability.
- CVE-2024-29276An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDes
- CVE-2024-29432Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas.
- CVE-2024-30620Tenda AX1803 v1.0.0.1 contains a stack overflow via the serviceName parameter in the function fromAdvSetMacMtuWan.
- CVE-2024-31002Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4 BitReader::ReadCach
High 59
- CVE-2024-3204c-blosc2 ndlz4x4.c ndlz4_decompress heap-based overflowc-blosc2
- CVE-2024-3203c-blosc2 ndlz8x8.c ndlz8_decompress heap-based overflowc-blosc2
- CVE-2024-30371Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30367Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30365Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30362Foxit PDF Reader PDF File Parsing Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30361Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30360Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30359Foxit PDF Reader AcroForm 3D Out-Of-Bounds Read Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30358Foxit PDF Reader AcroForm User-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30357Foxit PDF Reader AcroForm Annotation Type Confusion Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30355Foxit PDF Reader AcroForm Out-Of-Bounds Write Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30354Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30353Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30352Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30351Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30349Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30348Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30346Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30345Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30344Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30343Foxit PDF Reader Annotation Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30342Foxit PDF Reader Annotation Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30341Foxit PDF Reader Doc Object Out-Of-Bounds Read Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30339Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30338Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30337Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-30336Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-31105WordPress Tax Rate Upload plugin <= 2.4.5 - CSRF leading to Cross Site Scripting (XSS) vulnerabilityAdam Bowen Tax Rate Upload
- CVE-2024-31109WordPress Woocommerce Social Media Share Buttons plugin <= 1.3.0 - CSRF to Cross Site Scripting (XSS) vulnerabilityToastie Studio Woocommerce Social Media Share Buttons
- CVE-2024-22248VMware SD-WAN Orchestrator contains an open redirect vulnerability.VMware SD-WAN Orchestrator
- CVE-2024-22246VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.VMware SD-WAN Edge
- CVE-2024-30248Piccolo Admin's raw SVG loading may lead to complete data compromise from admin pagepiccolo-orm piccolo_admin · piccolo-admin
- CVE-2024-29949There is a command injection vulnerability in some Hikvision NVRs.Hikvision DS-7604NI-K1 / · Hikvision DS-76xxNI-Mx +10
- CVE-2023-52636libceph: just wait for more data to be available on the socketLinux
- CVE-2024-26672drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'Linux
- CVE-2024-28226Fs has an improper input validation vulnerabilityOpenHarmony
- CVE-2024-22092Bundlemanager has an authentication bypass vulnerabilityOpenHarmony
- CVE-2024-26666wifi: mac80211: fix RCU use in TDLS fast-xmitLinux
- CVE-2024-26664hwmon: (coretemp) Fix out-of-bounds memory accessLinux
- CVE-2024-26663tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()Linux
- CVE-2024-26660drm/amd/display: Implement bounds check for stream encoder creation in DCN301Linux
- CVE-2024-26659xhci: handle isoc Babble and Buffer Overrun events properlyLinux
- CVE-2024-26656drm/amdgpu: fix use-after-free bugLinux
- CVE-2024-20849Out-of-bound Write vulnerability in chunk parsing implementation of libsdffextractor prior to SMR Apr-2023 Release 1 allows local attackers Samsung Mobile Devices
- CVE-2024-20845Out-of-bounds write vulnerability while releasing memory in libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to execute arSamsung Mobile Devices
- CVE-2024-20844Out-of-bounds write vulnerability while parsing remaining codewords in libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker toSamsung Mobile Devices
- CVE-2024-3137Improper Privilege Management in uvdesk/community-skeletonuvdesk/community-skeleton · uvdesk/core-framework
- CVE-2024-25187Server Side Request Forgery (SSRF) vulnerability in 71cms v1.0.0, allows remote unauthenticated attackers to obtain sensitive information vi
- CVE-2024-27605Alldata V0.4.6 is vulnerable to Insecure Permissions.
- CVE-2024-28287A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious site
- CVE-2024-29434An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file.
- CVE-2024-29514File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP fi
- CVE-2024-30807An issue was discovered in Bento4 v1.6.0-641-2-g1529b83.
- CVE-2024-30809An issue was discovered in Bento4 v1.6.0-641-2-g1529b83.
- CVE-2024-30965DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php.
- CVE-2024-31003Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4_MemoryByteStream::W
- CVE-2024-31004An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4_StsdAtom::AP4_StsdAtom,m
- CVE-2024-31005An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cpp,AP4_MdhdAtom::AP4_MdhdAtom,m
Medium, low and unrated 105
- CVE-2024-3218Shibang Communications IP Network Intercom Broadcasting System busyscreenshotpush.php path traversalShibang Communications IP Network Intercom Broadcasting Sys…
- CVE-2024-3248Stack overflow in Xpdf 4.05 due to object loop in attachmentsXpdf
- CVE-2024-3209UPX bele.h get_ne64 heap-based overflowUPX
- CVE-2024-3247Stack overflow in Xpdf 4.05 due to object loop in PDF object streamXpdf
- CVE-2024-3207ermig1979 Simd SimdMemoryStream.h ReadUnsigned heap-based overflowermig1979 Simd
- CVE-2024-3202codelyfe Stupid Simple CMS Login Page excessive authenticationcodelyfe Stupid Simple CMS
- CVE-2024-30370RARLAB WinRAR Mark-Of-The-Web Bypass VulnerabilityRARLAB WinRAR
- CVE-2024-30364Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityFoxit PDF Reader
- CVE-2024-30363Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityFoxit PDF Reader
- CVE-2024-30356Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure VulnerabilityFoxit PDF Reader
- CVE-2024-30350Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityFoxit PDF Reader
- CVE-2024-30347Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityFoxit PDF Reader
- CVE-2024-30340Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityFoxit PDF Reader
- CVE-2024-29834Apache Pulsar: Improper Authorization For Namespace and Topic Management EndpointsApache Software Foundation Apache Pulsar · org.apache.pulsa…
- CVE-2024-30531WordPress Nelio Content plugin <= 3.2.0 - Server Side Request Forgery (SSRF) vulnerabilityNelio Software Nelio Content
- CVE-2024-30532WordPress Builderall Builder for WordPress plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerabilityBuilderall Team Builderall Builder for WordPress
- CVE-2024-24888WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.25 - Server Side Request Forgery (SSRF) vulnerabilityStellarWP Gutenberg Blocks by Kadence Blocks
- CVE-2024-30335Foxit PDF Reader AcroForm Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityFoxit PDF Reader
- CVE-2024-3151Bdtask Multi-Store Inventory Management System Stock Movement Page cross-site request forgeryBdtask Multi-Store Inventory Management System
- CVE-2024-2435Stored XSS in Timeline ViewTemporal OSS ui-server · github.com/temporalio/ui-server +1
- CVE-2024-22247VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.VMware SD-WAN Edge
- CVE-2023-50313IBM WebSphere Application Server information disclosureIBM WebSphere Application Server
- CVE-2024-29948There is an out-of-bounds read vulnerability in some Hikvision NVRs.Hikvision DS-7604NXI-K1/4P
- CVE-2024-29947There is a NULL dereference pointer vulnerability in some Hikvision NVRs.Hikvision DS-7604NI-K1 /
- CVE-2023-51456A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attackDJI Mavic 3 Pro · DJI Mavic +2
- CVE-2023-51455A Improper Validation of Array Index issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow DJI Mavic 3 Pro · DJI Mavic +2
- CVE-2023-51454A Out-of-bounds Write issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to DJI Mavic 3 Pro · DJI Mavic +2
- CVE-2023-51453A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attackDJI Mavic 3 Pro · DJI Mavic +2
- CVE-2023-51452A Improper Input Validation issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attackDJI Mavic 3 Pro · DJI Mavic +2
- CVE-2023-6951A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to deriveDJI Mavic 3 Pro · DJI Mavic +2
- CVE-2023-6950An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a DJI Mini 3 Pro
- CVE-2023-6949A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 DJI Mini 3 Pro
- CVE-2023-6948A Buffer Copy without Checking Size of Input issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 coulDJI Mavic 3 Pro · DJI Mavic +2
- CVE-2024-2745Rapid7 InsightVM Sensitive Information Exposure via URLRapid7 InsightVM
- CVE-2024-1946Genesis Blocks <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Contentstudiopress Genesis Blocks
- CVE-2024-1807Product Sort and Display for WooCommerce <= 2.4.1 - Missing Authorizationa3rev Product Sort and Display for WooCommerce
- CVE-2024-1732Sharkdropship for AliExpress Dropshipping and Affiliate <= 2.2.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletiondjamio1988 Sharkdropship & affiliate for AliExpress
- CVE-2024-2931WPFront User Role Editor <= 3.2.1.11184 - Limited Information Exposuresyammohanm WPFront User Role Editor
- CVE-2024-20799Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-1300Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni supportio.vertx:vertx-core · Red Hat CEQ +22
- CVE-2024-26684net: stmmac: xgmac: fix handling of DPP safety error for DMA channelsLinux
- CVE-2024-26683wifi: cfg80211: detect stuck ECSA element in probe respLinux
- CVE-2024-26682wifi: mac80211: improve CSA/ECSA connection refusalLinux
- CVE-2024-26681netdevsim: avoid potential loop in nsim_dev_trap_report_work()Linux
- CVE-2024-26680net: atlantic: Fix DMA mapping for PTP hwts ringLinux
- CVE-2024-26679inet: read sk->sk_family once in inet_recv_error()Linux
- CVE-2024-26678x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat sectionLinux
- CVE-2024-26677rxrpc: Fix delayed ACKs to not set the reference serial numberLinux
- CVE-2024-26676af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.Linux
- CVE-2024-26675ppp_async: limit MRU to 64KLinux
- CVE-2024-26674x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixupsLinux
- CVE-2024-26673netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectationsLinux
- CVE-2024-26671blk-mq: fix IO hang from sbitmap wakeup raceLinux
- CVE-2023-52635PM / devfreq: Synchronize devfreq_monitor_[start/stop]Linux
- CVE-2023-52634drm/amd/display: Fix disable_otg_wa logicLinux
- CVE-2023-52633um: time-travel: fix time corruptionLinux
- CVE-2023-52632drm/amdkfd: Fix lock dependency warning with srcuLinux
- CVE-2024-2925Beaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Buttonbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2024-2839Colibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scriptingextendthemes Colibri Page Builder
- CVE-2024-26670arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOADLinux
- CVE-2024-26669net/sched: flower: Fix chain template offloadLinux
- CVE-2024-26668netfilter: nft_limit: reject configurations that cause integer overflowLinux
- CVE-2024-29086Arkcompiler runtime has a stack overflow svulnerabilityOpenHarmony
- CVE-2024-28951Arkcompiler runtime has a use after free vulnerabilityOpenHarmony
- CVE-2024-24581Arkcompiler runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2024-29074Telephony has an improper input validation vulnerabilityOpenHarmony
- CVE-2024-22180Camera has a use after free vulnerabilityOpenHarmony
- CVE-2024-22098AVSession has a use after free vulnerabilityOpenHarmony
- CVE-2024-22177Audio has an improper preservation of permissions vulnerabilityOpenHarmony
- CVE-2024-21834Arkui has a type confusion vulnerabilityOpenHarmony
- CVE-2024-26667drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanupLinux
- CVE-2024-26662drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'Linux
- CVE-2024-26661drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'Linux
- CVE-2024-26658bcachefs: grab s_umount only if snapshottingLinux
- CVE-2023-52631fs/ntfs3: Fix an NULL dereference bugLinux
- CVE-2024-26657drm/sched: fix null-ptr-deref in init entityLinux
- CVE-2024-1504SecuPress Free — WordPress Security <= 2.2.5.1 - Cross-Site Request Forgery to Banned IP AddressSecuPress with Simple SSL – Simple and Performant Security
- CVE-2024-2924Creative Addons for Elementor <= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scriptingechoplugins Creative Addons for Elementor
- CVE-2024-2791Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgetsroxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2024-1274My Calendar < 3.4.24 - Authenticated Stored XSSMy Calendar
- CVE-2024-2369Page Builder Gutenberg Blocks < 3.1.7 - Contributor+ Stored XSSPage Builder Gutenberg Blocks
- CVE-2024-20854Improper handling of insufficient privileges vulnerability in Samsung Camera prior to versions 12.1.0.31 in Android 12, 13.1.02.07 in AndroiSamsung Mobile Samsung Camera
- CVE-2024-20853Improper verification of intent by broadcast receiver vulnerability in ThemeStore prior to 5.3.05.2 allows local attackers to write arbitrarSamsung Mobile ThemeStore
- CVE-2024-20852Improper verification of intent by broadcast receiver vulnerability in SmartThings prior to version 1.8.13.22 allows local attackers to acceSamsung Mobile SmartThings
- CVE-2024-20851Improper access control vulnerability in Samsung Data Store prior to version 5.3.00.4 allows local attackers to launch arbitrary activity wiSamsung Mobile Samsung Data Store
- CVE-2024-20850Use of Implicit Intent for Sensitive Communication in Samsung Pay prior to version 5.4.99 allows local attackers to access information of SaSamsung Mobile Samsung Pay
- CVE-2024-20848Improper Input Validation vulnerability in text parsing implementation of libsdffextractor prior to SMR Apr-2024 Release 1 allows local attaSamsung Mobile Devices
- CVE-2024-20847Improper Access Control vulnerability in StorageManagerService prior to SMR Apr-2024 Release 1 allows local attackers to read sdcard informaSamsung Mobile Devices
- CVE-2024-20846Out-of-bounds write vulnerability while decoding hcr of libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to execute arbitrSamsung Mobile Devices
- CVE-2024-20843Out-of-bound write vulnerability in command parsing implementation of libIfaaCa prior to SMR Apr-2024 Release 1 allows local privileged attaSamsung Mobile Devices
- CVE-2024-20842Improper Input Validation vulnerability in handling apdu of libsec-ril prior to SMR Apr-2024 Release 1 allows local privileged attackers to Samsung Mobile Devices
- CVE-2024-3160Intelbras HDCVI 1016 HTTP GET Request cap.js information disclosureIntelbras MHDX · Intelbras HDCVI
- CVE-2024-3148DedeCMS makehtml_archives_action.php sql injectionDedeCMS
- CVE-2024-3147DedeCMS makehtml_map.php cross-site request forgeryDedeCMS
- CVE-2024-3146DedeCMS makehtml_rss_action.php cross-site request forgeryDedeCMS
- CVE-2024-3145DedeCMS makehtml_js_action.php cross-site request forgeryDedeCMS
- CVE-2024-3144DedeCMS makehtml_spec.php cross-site request forgeryDedeCMS
- CVE-2024-3143DedeCMS member_rank.php cross-site request forgeryDedeCMS
- CVE-2024-3142Clavister E10/E80 Setting cross-site request forgeryClavister E10 · Clavister E80
- CVE-2024-22780Cross Site Scripting vulnerability in CA17 TeamsACS v.1.0.1 allows a remote attacker to execute arbitrary code via a crafted script to the egithub.com/ca17/teamsacs
- CVE-2024-25075An issue was discovered in Softing uaToolkit Embedded before 1.41.1.
- CVE-2024-30621Tenda AX1803 v1.0.0.1 contains a stack overflow via the serverName parameter in the function fromAdvSetMacMtuWan.
- CVE-2024-30806An issue was discovered in Bento4 v1.6.0-641-2-g1529b83.
- CVE-2024-30808An issue was discovered in Bento4 v1.6.0-641-2-g1529b83.
- CVE-2024-30946DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/co_do.php.