CVEs published April 6, 2024
39 CVEs were published on April 6, 2024: 1 critical, 15 high.
- Published
- 39
- Critical
- 1
- High
- 15
- Medium
- 17
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- SourceCodester Online Library System
- 7
- Google Chrome
- 3
- SourceCodester Human Resource Information System
- 3
- bdthemes Element Pack – Widgets, Templates & Addons for Ele…
- 2
- SourceCodester Computer Laboratory Management System
- 2
- Apache Software Foundation Apache NimBLE
- 1
- archiver · Red Hat OpenShift Container Platform +3
- 1
- BoldGrid Easy SEO – Simple and Effective SEO
- 1
- code-projects Car Rental
- 1
- codesupplyco Powerkit – Supercharge your WordPress Site
- 1
Critical 1
High 15
- CVE-2024-3413SourceCodester Human Resource Information System login_process.php sql injectionSourceCodester Human Resource Information System
- CVE-2024-3159Out of bounds memory access in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to perform arbitrary read/write via a cGoogle Chrome
- CVE-2024-3158Use after free in Bookmarks in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2024-3156Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds mGoogle Chrome
- CVE-2024-24746Apache NimBLE: Denial of service in NimBLE Bluetooth stackApache Software Foundation Apache NimBLE
- CVE-2024-22328IBM Maximo Application Suite information disclosureIBM Maximo Application Suite
- CVE-2024-3376SourceCodester Computer Laboratory Management System config.php redirectSourceCodester Computer Laboratory Management System
- CVE-2024-3363SourceCodester Online Library System index.php sql injectionSourceCodester Online Library System
- CVE-2024-3362SourceCodester Online Library System controller.php sql injectionSourceCodester Online Library System
- CVE-2024-3361SourceCodester Online Library System deweydecimal.php sql injectionSourceCodester Online Library System
- CVE-2024-3360SourceCodester Online Library System index.php sql injectionSourceCodester Online Library System
- CVE-2024-3359SourceCodester Online Library System login.php sql injectionSourceCodester Online Library System
- CVE-2024-1385WP-Stateless – Google Cloud Storage <= 3.4.0 - Missing Authorization to Limited Arbitrary Options Updateusability_dynamics WP-Stateless – Google Cloud Storage
- CVE-2024-27620An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request to the API.
- CVE-2024-28741Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php co
Medium, low and unrated 23
- CVE-2024-3415SourceCodester Human Resource Information System addbranches_process.php cross site scriptingSourceCodester Human Resource Information System
- CVE-2024-3414SourceCodester Human Resource Information System addcorporate_process.php cross site scriptingSourceCodester Human Resource Information System
- CVE-2024-0406Mholt/archiver: path traversal vulnerabilityarchiver · Red Hat OpenShift Container Platform +3
- CVE-2024-3378iboss Secure Web Gateway Login Portal login cross site scriptingiboss Secure Web Gateway
- CVE-2024-3377SourceCodester Computer Laboratory Management System cross site scriptingSourceCodester Computer Laboratory Management System
- CVE-2024-3369code-projects Car Rental add-vehicle.php unrestricted uploadcode-projects Car Rental
- CVE-2024-3366Xuxueli xxl-job Template JdkSerializeTool.java deserialize injectionXuxueli xxl-job · com.xuxueli:xxl-job-core
- CVE-2024-3365SourceCodester Online Library System controller.php cross site scriptingSourceCodester Online Library System
- CVE-2024-3364SourceCodester Online Library System index.php cross site scriptingSourceCodester Online Library System
- CVE-2024-2296Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVGPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2024-2132Ultimate Bootstrap Elements for Elementor <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Widgetg5theme Ultimate Bootstrap Elements for Elementor
- CVE-2024-2458Powerkit – Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcodecodesupplyco Powerkit – Supercharge your WordPress Site
- CVE-2024-0837Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widgetbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-1428Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widgetbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-2949Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode'shapedplugin Carousel, Slider, Photo Gallery with Lightbox,…
- CVE-2024-2471FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fieldsfooplugins Gallery by FooGallery
- CVE-2024-2444Inline Related Posts < 3.5.0 - Admin+ Stored XSSInline Related Posts
- CVE-2024-3358SourceCodester Aplaya Beach Resort Online Reservation System index.php cross site scriptingSourceCodester Aplaya Beach Resort Online Reservation System
- CVE-2024-2950BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.14 - Information ExposureBoldGrid Easy SEO – Simple and Effective SEO
- CVE-2024-3216WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings ResetWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…
- CVE-2024-2656Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV importicegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2024-3245EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Blockwpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2024-1994Image Watermark <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Watermark Modificationdfactory Image Watermark