CVEs published April 5, 2024
94 CVEs were published on April 5, 2024: 8 critical, 38 high. 2 are now in CISA KEV.
- Published
- 94
- Critical
- 8
- High
- 38
- Medium
- 36
- Low
- 9
- Unrated
- 3
- Now in CISA KEV
- 2
- Fix available
- 20
Most affected products
- Google Android
- 24
- SourceCodester Aplaya Beach Resort Online Reservation System
- 10
- Lenovo Printers
- 5
- Linux
- 5
- ExtremePacs Extreme XDS
- 2
- Mattermost · github.com/mattermost/mattermost-server +3
- 2
- Mattermost · github.com/mattermost/mattermost/server/v8 +3
- 2
- NVIDIA CUDA Toolkit
- 2
- SourceCodester eLearning System
- 2
- Brocade Fabric OS
- 1
Critical 8
- CVE-2024-29756In afe_callback of q6afe.c, there is a possible out of bounds write due to a buffer overflow.Google Android
- CVE-2024-22004Unchecked length in Trusted Application on Google Nest Wifi Pro, leading to out of bounds readGoogle Nest Wifi Pro
- CVE-2024-31849A path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which cCData Connect
- CVE-2024-31848A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, whicCData API Server
- CVE-2023-48426Chromecast Bootloader & Kernel-level code-execution including compromise of user-dataGoogle Chromecast
- CVE-2024-31218Missing Authentication for Critical Function in Webhood backendwebhood-io webhood
- CVE-2024-27448MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js maildev
- CVE-2024-30849Arbitrary file upload vulnerability in Sourcecodester Complete E-Commerce Site v1.0, allows remote attackers to execute arbitrary code via f
High 38
- CVE-2024-3356SourceCodester Aplaya Beach Resort Online Reservation System sql injectionSourceCodester Aplaya Beach Resort Online Reservation System
- CVE-2024-27912A denial of service vulnerability was reported in some Lenovo Printers that could allow an attacker to cause the device to crash by sending Lenovo Printers
- CVE-2024-27911A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to obtain the administrator password.Lenovo Printers
- CVE-2024-3355SourceCodester Aplaya Beach Resort Online Reservation System sql injectionSourceCodester Aplaya Beach Resort Online Reservation System
- CVE-2024-29757there is a possible permission bypass due to Debug certs being allowlisted.Google Android
- CVE-2024-29753In tmu_set_control_temp_step of tmu.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-29752In tmu_set_tr_num_thresholds of tmu.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-29749In tmu_set_tr_thresholds of tmu.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-29748there is a possible way to bypass due to a logic error in the code.Google Android
- CVE-2024-29746In lpm_req_handler of lpm.c, there is a possible out of bounds write due to improper input validation.Google Android
- CVE-2024-29743In tmu_set_temp_lut of tmu.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-29741In pblS2mpuResume of s2mpu.c, there is a possible mitigation bypass due to a logic error in the code.Google Android
- CVE-2024-29740In tmu_set_table of tmu.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-3354SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injectionSourceCodester Aplaya Beach Resort Online Reservation System
- CVE-2024-3353SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injectionSourceCodester Aplaya Beach Resort Online Reservation System
- CVE-2024-3352SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injectionSourceCodester Aplaya Beach Resort Online Reservation System
- CVE-2024-0081 NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources withouNVIDIA NeMo · nemo-asr
- CVE-2024-3351SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injectionSourceCodester Aplaya Beach Resort Online Reservation System
- CVE-2024-31851A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which coulCData Sync
- CVE-2024-31850A path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running using the embedded Jetty server, which couldCData Arc
- CVE-2024-3350SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injectionSourceCodester Aplaya Beach Resort Online Reservation System
- CVE-2024-3349SourceCodester Aplaya Beach Resort Online Reservation System login.php sql injectionSourceCodester Aplaya Beach Resort Online Reservation System
- CVE-2024-3348SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injectionSourceCodester Aplaya Beach Resort Online Reservation System
- CVE-2024-3347SourceCodester Airline Ticket Reservation System activate_jet_details_form_handler.php sql injectionSourceCodester Airline Ticket Reservation System
- CVE-2024-31220Sunshine vulnerable to remote unauthenticated arbitrary file readLizardByte Sunshine
- CVE-2024-31083Xorg-x11-server: use-after-free in procrenderaddglyphsxorg-x11-server · Red Hat Enterprise Linux 6 Extended Li… +1
- CVE-2023-6523IDOR in ExtremePacs's Extreme XDSExtremePacs Extreme XDS
- CVE-2023-6522Information Disclosure in ExtremePacs's Extreme XDSExtremePacs Extreme XDS
- CVE-2024-26812vfio/pci: Create persistent INTx handlerLinux
- CVE-2024-26810vfio/pci: Lock external INTx masking opsLinux
- CVE-2024-2115LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalationthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-3217WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injectionwpdirectorykit WP Directory Kit
- CVE-2023-52235SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a re
- CVE-2024-22363SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).xlsx
- CVE-2024-29672Directory Traversal vulnerability in zly2006 Reden before v.0.2.514 allows a remote attacker to execute arbitrary code via the DEBUG_RTC_REQ
- CVE-2024-29863A race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 SR2 (12,80.20200) may
- CVE-2024-30891A command injection vulnerability exists in /goform/exeCommand in Tenda AC18 v15.03.05.05, which allows attackers to construct cmdinput para
- CVE-2024-30977An issue in Secnet Security Network Intelligent AC Management System v.1.02.040 allows a local attacker to escalate privileges via the passw
Medium, low and unrated 48
- CVE-2024-3357SourceCodester Aplaya Beach Resort Online Reservation System index.php cross site scriptingSourceCodester Aplaya Beach Resort Online Reservation System
- CVE-2024-27910A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer without authenticatiLenovo Printers
- CVE-2024-27909A denial of service vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in a system reboot.Lenovo Printers
- CVE-2024-27908A buffer overflow vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in denial of service.Lenovo Printers
- CVE-2024-23592An authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with pLenovo Synaptics Fingerprint Readers
- CVE-2023-25494 A potential vulnerability were reported in the BIOS of some Desktop, Smart Edge, and ThinkStation products that could allow a local attackeLenovo Desktop BIOS, Smart Edge BIOS, ThinkStation BIOS
- CVE-2023-25493A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products Lenovo BIOS
- CVE-2023-5912 A potential memory leakage vulnerability was reported in some Lenovo Notebook products that may allow a local attacker with elevated privilLenovo Notebook BIOS
- CVE-2023-4605 A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve systemLenovo XClarity Administrator
- CVE-2024-29783In tmu_get_tr_thresholds, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-29782In tmu_get_tr_num_thresholds of tmu.c, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-29755In tmu_get_pi of tmu.c, there is a possible out of bounds read due to improper input validation.Google Android
- CVE-2024-29754In TMU_IPC_GET_TABLE, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-29751In asn1_ec_pkey_parse_p384 of asn1_common.c, there is a possible OOB Read due to a missing null check.Google Android
- CVE-2024-29750In km_exp_did_inner of kmv.c, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-29747In _dvfs_get_lv of dvfs.c, there is a possible out of bounds read due to a missing null check.Google Android
- CVE-2024-29745there is a possible Information Disclosure due to uninitialized data.Google Android
- CVE-2024-29744In tmu_get_gov_time_windows, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-29742In apply_minlock_constraint of dvfs.c, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-29739In tmu_get_temp_lut of tmu.c, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-29738In gov_init, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-27232In asn1_ec_pkey_parse of asn1_common.c, there is a possible OOB read due to a missing null check.Google Android
- CVE-2024-27231In tmu_get_tr_stats of tmu.c, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-2312GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks afterDebian based GNU GRUB
- CVE-2024-0080 NVIDIA nvTIFF Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a specNVIDIA nvTIFF Library
- CVE-2024-0076 NVIDIA CUDA toolkit for all platforms contains a vulnerability in cuobjdump and nvdisasm where an attacker may cause a crash by tricking a NVIDIA CUDA Toolkit
- CVE-2024-0072 NVIDIA CUDA toolkit for all platforms contains a vulnerability in cuobjdump and nvdisasm where an attacker may cause a crash by tricking a NVIDIA CUDA Toolkit
- CVE-2023-31028 NVIDIA nvJPEG2000 Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a NVIDIA nvJPEG2000 Library
- CVE-2024-3346Byzoro Smart S80 webmailattach.php os command injectionByzoro Smart S80
- CVE-2024-31213InstantCMS Open Redirect vulnerabilityinstantsoft icms2
- CVE-2024-2380XSS in graph renderingCheckmk
- CVE-2024-2499Squelch Tabs and Accordions Shortcodes <= 0.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via accordions ShortcodeSquelch Tabs and Accordions Shortcodes
- CVE-2023-5692WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalinkWordPress Foundation WordPress
- CVE-2024-2447Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of cMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-27437vfio/pci: Disable auto-enable of exclusive INTx IRQLinux
- CVE-2024-26814vfio/fsl-mc: Block calling interrupt handler without triggerLinux
- CVE-2024-26813vfio/platform: Create persistent IRQ handlersLinux
- CVE-2024-29221Invite ID available to team admins even without the "Add Members" permissionMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-28949DoS via a large number of User PreferencesMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-21848Users maintain access to active call after being removed from a channelMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-2509Gutenberg Blocks by Kadence Blocks < 3.2.26 - Contributor+ Stored XSSGutenberg Blocks by Kadence Blocks
- CVE-2023-5973Truncated port nameBrocade Fabric OS
- CVE-2024-3321SourceCodester eLearning System Maintenance Module cross site scriptingSourceCodester eLearning System
- CVE-2024-3320SourceCodester eLearning System cross site scriptingSourceCodester eLearning System
- CVE-2023-49965SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page.
- CVE-2024-26329Chilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG in ChilkatRand::randomBytes function.
- CVE-2024-28065In Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information such as the root password hash.
- CVE-2024-31852LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can some