CVEs published April 8, 2024
119 CVEs were published on April 8, 2024: 11 critical, 42 high.
- Published
- 119
- Critical
- 11
- High
- 42
- Medium
- 59
- Low
- 5
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 23
- Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- 11
- SourceCodester Prison Management System
- 7
- Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000
- 6
- SourceCodester Laundry Management System
- 5
- Netentsec NS-ASG Application Security Gateway
- 4
- Open-Xchange OX App Suite
- 4
- wpb-show-core
- 3
- nvidia ChatRTX
- 2
- SendPress Newsletters
- 2
Critical 11
- CVE-2024-31224GPT Academic: Pickle deserializing cookies may pose RCE riskbinary-husky gpt_academic
- CVE-2024-26811ksmbd: validate payload size in ipc responseLinux
- CVE-2023-52538Vulnerability of package name verification being bypassed in the HwIms module.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-43216AbrhilSoft Employee's Portal before v5.6.2 was discovered to contain a SQL injection vulnerability in the login page.
- CVE-2024-22949JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /chart/annotations/CategoryLineAnnotation.
- CVE-2024-23078JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compa
- CVE-2024-23086Apfloat v1.10.1 was discovered to contain a stack overflow via the component org.apfloat.internal.DoubleModMath::modPow(double.
- CVE-2024-27488Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sen
- CVE-2024-31022An issue was discovered in CandyCMS version 1.0.0, allows remote attackers to execute arbitrary code via the install.php component.
- CVE-2024-31807TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in th
- CVE-2024-31815In TOTOLINK EX200 V4.0.3c.7314_B20191204, an attacker can obtain the configuration file without authorization through /cgi-bin/ExportSetting
High 42
- CVE-2024-0082CVEnvidia ChatRTX
- CVE-2023-7164BackWPup < 4.0.4 - Unauthenticated Backup DownloadBackWPup
- CVE-2024-31442Redon-Hub has incorrect permissions on all admin related commandsRedon-Tech Redon-Hub
- CVE-2024-2834OpenText ArcSight Management Center and ArcSight Platform Stored XSSOpenText ArcSight Management Center · OpenText ArcSight Pla…
- CVE-2024-3439SourceCodester Prison Management System login.php sql injectionSourceCodester Prison Management System
- CVE-2024-3438SourceCodester Prison Management System login.php sql injectionSourceCodester Prison Management System
- CVE-2024-27897Input verification vulnerability in the call module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-27896Input verification vulnerability in the log module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-27895Vulnerability of permission control in the window module.Huawei HarmonyOS
- CVE-2023-52386Out-of-bounds write vulnerability in the RSMC module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52553Race condition vulnerability in the Wi-Fi module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52552Input verification vulnerability in the power module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52550Vulnerability of data verification errors in the kernel module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52549Vulnerability of data verification errors in the kernel module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52546Vulnerability of package name verification being bypassed in the Calendar app.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52545Vulnerability of undefined permissions in the Calendar app.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52359Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52541Authentication vulnerability in the API for app pre-loading.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52540Vulnerability of improper authentication in the Iaware module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52539Permission verification vulnerability in the Settings module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52537Vulnerability of package name verification being bypassed in the HwIms module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52388Permission control vulnerability in the clock module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52351In ril service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-52342In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling.Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000
- CVE-2023-52341In Plaintext COUNTER CHECK message accepted before AS security activation, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000
- CVE-2024-28744The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earliFURUNO SYSTEMS Co. ACERA 9010-08 · FURUNO SYSTEMS Co. ACERA…
- CVE-2024-23084Apfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(double
- CVE-2024-23085Apfloat v1.10.1 was discovered to contain a NullPointerException via the component org.apfloat.internal.DoubleScramble::scramble(double[], i
- CVE-2024-24279An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated
- CVE-2024-26574Insecure Permissions vulnerability in Wondershare Filmora v.13.0.51 allows a local attacker to execute arbitrary code via a crafted script t
- CVE-2024-27630Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input
- CVE-2024-27632An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.
- CVE-2024-28066In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).
- CVE-2024-28270An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/res
- CVE-2024-28732An issue was discovered in OFPMatch in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) ryu
- CVE-2024-31808TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in
- CVE-2024-31809TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in th
- CVE-2024-31811TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the langType parameter in th
- CVE-2024-31813TOTOLINK EX200 V4.0.3c.7646_B20201211 does not contain an authentication mechanism by default.
- CVE-2024-31814TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function.
- CVE-2024-31816In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getEasyWiz
- CVE-2024-31817In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStat
Medium, low and unrated 66
- CVE-2024-23584HCL BigFix Asset Discovery is affected by a security vulnerabilityHCL Software BigFix Enterprise Suite Asset Discovery
- CVE-2024-0083CVEnvidia ChatRTX
- CVE-2024-3466SourceCodester Laundry Management System Pengeluaran.php laporan_filter sql injectionSourceCodester Laundry Management System
- CVE-2024-3465SourceCodester Laundry Management System Transaki.php laporan_filter sql injectionSourceCodester Laundry Management System
- CVE-2024-3464SourceCodester Laundry Management System Pelanggan.php laporan_filter sql injectionSourceCodester Laundry Management System
- CVE-2024-3463SourceCodester Laundry Management System edit cross site scriptingSourceCodester Laundry Management System
- CVE-2024-3458Netentsec NS-ASG Application Security Gateway add_ikev2.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-3457Netentsec NS-ASG Application Security Gateway config_ISCGroupNoCache.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-3456Netentsec NS-ASG Application Security Gateway config_Anticrack.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-31447Shopware has Improper Session Handling in store-apishopware · shopware/core +1
- CVE-2024-3455Netentsec NS-ASG Application Security Gateway add_postlogin.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-3445SourceCodester Laundry Management System laporan_filter sql injectionSourceCodester Laundry Management System
- CVE-2024-31221Clients removed during unpairing process may regain access if Sunshine was not restartedLizardByte Sunshine
- CVE-2024-3444Wangshen SecGate 3600 ?g=net_pro_keyword_import_save unrestricted uploadWangshen SecGate
- CVE-2024-3443SourceCodester Prison Management System apply_leave.php cross site scriptingSourceCodester Prison Management System
- CVE-2024-3442SourceCodester Prison Management System delete_leave.php sql injectionSourceCodester Prison Management System
- CVE-2024-31205Saleor CSRF bypass in refreshToken mutationsaleor
- CVE-2024-30269DataEase has database configuration information exposure vulnerabilitydataease
- CVE-2024-3441SourceCodester Prison Management System edit-profile.php sql injectionSourceCodester Prison Management System
- CVE-2024-3440SourceCodester Prison Management System edit_profile.php sql injectionSourceCodester Prison Management System
- CVE-2024-2511Unbounded memory growth with session handling in TLSv1.3OpenSSL
- CVE-2014-125111namithjawahar Wp-Insert cross site scriptingnamithjawahar Wp-Insert
- CVE-2011-10006GamerZ WP-PostRatings wp-postratings.php cross site scriptingGamerZ WP-PostRatings
- CVE-2023-52364Vulnerability of input parameters being not strictly verified in the RSMC module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52385Out-of-bounds write vulnerability in the RSMC module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52554Permission control vulnerability in the Bluetooth module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-31375WordPress WP2LEADS plugin <= 3.2.7 - Broken Access Control vulnerabilitySaleswonder Team: Tobias WP2LEADS
- CVE-2023-52551Vulnerability of data verification errors in the kernel module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52544Vulnerability of file path verification being bypassed in the email module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-31357WordPress Ultimate Store Kit Elementor Addons plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityBdThemes Ultimate Store Kit Elementor Addons
- CVE-2023-52543Permission verification vulnerability in the system module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52542Permission verification vulnerability in the system module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-23192RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised Open-Xchange OX App Suite
- CVE-2024-23191Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session.Open-Xchange OX App Suite
- CVE-2024-23190Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session.Open-Xchange OX App Suite
- CVE-2024-23189Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session.Open-Xchange OX App Suite
- CVE-2024-1958WPB Show Core < 2.7 - Reflected XSSwpb-show-core
- CVE-2024-1956WPB Show Core < 2.7 - Reflected XSSwpb-show-core
- CVE-2024-1752Font Farsi <= 1.6.6 - Admin+ Stored XSS in SettingsFont Farsi
- CVE-2024-1589SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Form SettingsSendPress Newsletters
- CVE-2024-1588SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via SettingsSendPress Newsletters
- CVE-2024-1292WPB Show Core < 2.6 - Reflected XSSwpb-show-core
- CVE-2023-52536In faceid service, there is a possible out of bounds read due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-52535In vsp driver, there is a possible missing verification incorrect input.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-52534In ngmm, there is a possible undefined behavior due to incorrect error handling.Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000
- CVE-2023-52533In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling.Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000
- CVE-2024-23658In camera driver, there is a possible use after free due to a logic error.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-52352In Network Adapter Service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-52350In ril service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-52349In ril service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-52348In ril service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-52347In ril service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-52346In modem driver, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-52345In modem driver, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-52344In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling.Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000
- CVE-2023-52343In SecurityCommand message after as security has been actived., there is a possible improper input validation.Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000
- CVE-2024-3437SourceCodester Prison Management System Avatar add-admin.php unrestricted uploadSourceCodester Prison Management System
- CVE-2024-23079JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compa
- CVE-2024-23081ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocal
- CVE-2024-23082ThreeTen Backport v1.6.8 was discovered to contain an integer overflow via the component org.threeten.bp.format.DateTimeFormatter::parse(Cha
- CVE-2024-27631Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/userg
- CVE-2024-28224Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthgithub.com/ollama/ollama · github.com/jmorganca/ollama
- CVE-2024-31047An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the conver
- CVE-2024-31805TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in
- CVE-2024-31806TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which c
- CVE-2024-31812In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExt