CVEs published April 9, 2024
387 CVEs were published on April 9, 2024: 14 critical, 179 high. 1 is now in CISA KEV.
- Published
- 387
- Critical
- 14
- High
- 179
- Medium
- 189
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 184
Most affected products
- Microsoft Windows
- 64
- Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- 18
- Microsoft Windows Server
- 17
- Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…
- 10
- Apache Software Foundation Apache Zeppelin · org.apache.zep…
- 9
- Fortinet FortiSandbox
- 6
- Microsoft Defender for IoT
- 6
- Microsoft SQL Server 2022 for · Microsoft SQL Server +2
- 6
- Microsoft Windows Server 2022, 23H2 Edition
- 6
- thehappymonster Happy Addons for Elementor
- 6
Critical 14
- CVE-2024-3120Stack-Buffer Overflow in 'Content-Length' and 'Warning' Header Processing in sngrepirontec sngrep
- CVE-2024-3119Stack-Buffer Overflow in 'Call-ID' and 'X-Call-ID' SIP Header Processing in sngrepirontec sngrep
- CVE-2024-3136MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via templatestylemix MasterStudy LMS WordPress Plugin – for Online Cour…
- CVE-2024-1813Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fieldspresstigers Simple Job Board
- CVE-2024-2804Network Summary <= 2.0.11 - Unauthenticated SQL Injectionjokr Network Summary
- CVE-2024-24576Rusts's `std::process::Command` did not properly escape arguments of batch files on Windowsrust-lang rust
- CVE-2024-29990Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege VulnerabilityMicrosoft Azure Kubernetes Service
- CVE-2024-31866Apache Zeppelin: Interpreter download command does not escape malicious code injectionApache Software Foundation Apache Zeppelin · org.apache.zep…
- CVE-2024-31864Apache Zeppelin: Remote code execution by adding malicious JDBC connection stringApache Software Foundation Apache Zeppelin · org.apache.zep…
- CVE-2023-45590An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 throFortinet FortiClientLinux
- CVE-2023-6320Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpointLG webOS
- CVE-2023-6319Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager serviceLG webOS
- CVE-2023-6318Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload serviceLG webOS
- CVE-2023-1083Welotec: improper access control in TK500v1 router seriesWelotec TK515L · Welotec TK515L-W +5
High 179
- CVE-2024-3313SUBNET PowerSYSTEM Server and Substation Server Reliance on Insufficiently Trustworthy ComponentSUBNET Solutions PowerSYSTEM Server · SUBNET Solutions Subs…
- CVE-2024-3446Qemu: virtio: dma reentrancy issue leads to double free vulnerabilityRed Hat Enterprise Linux
- CVE-2024-0952WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via idwedevs ERP: Complete HR, Accounting & CRM Suite with WooCom…
- CVE-2024-2341Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Subscriber+) SQL Injectioncroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2023-6999Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Executionsc0ttkclark Pods – Custom Content Types and Fields
- CVE-2024-1812Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_urlwpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2024-2501Hubbub Lite – Fast, Reliable Social Network Sharing Buttons <= 1.33.1 - PHP Object Injectionnerdpressteam Hubbub Lite – Fast, free social sharing and f…
- CVE-2024-2344Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entryThemeFusion Avada | Website Builder For WordPress & WooComm…
- CVE-2024-1792CMB2 <= 2.10.1 - Authenticated (Contributor+) PHP Object Injectionjtsternberg CMB2
- CVE-2023-6964Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF)stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-1893Easy Property Listings <= 3.5.2 - Authenticated(Contributor+) SQL Injection via Shortcodemervb1 Easy Property Listings
- CVE-2024-1934WP Compress – Image Optimizer <= 6.11.08 - Missing Authorization to Unauthenticated CDN Modificationaresit WP Compress – Instant Performance & Speed Optimizati…
- CVE-2024-2693Link Whisper Free <= 0.7.1 - Authenticated (Contributor+) PHP Object Injectionlinkwhspr Link Whisper Free
- CVE-2023-7046WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score <= 7.0 - Sensitive Information Exposure via insufficiently protected filesgowebsmarty WP Encryption – One Click Free SSL Certificate…
- CVE-2024-1991RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalationmetagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2024-1990RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcodemetagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2024-1315Classified Listing <= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_accounttechlabpro1 Classified Listing – AI-Powered Classified ads…
- CVE-2024-1308WooCommerce Cloak Affiliate Links <= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modificationdatafeedrcom Cloak Affiliate Links for WooCommerce
- CVE-2024-2018WP Activity Log Premium <= 4.6.4 - Authenticated (Subscriber+) SQL Injectionwpwhitesecurity WP Activity Log Premium
- CVE-2024-2125EnvíaloSimple: Email Marketing y Newsletters <= 2.3 - Cross-Site Request Forgery to Arbitrary File Uploaddattateccom EnvíaloSimple: Email Marketing y Newsletters
- CVE-2024-1794Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Uploadwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2023-6967Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcodesc0ttkclark Pods – Custom Content Types and Fields
- CVE-2024-1974HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversaldevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2024-1774Customily Product Personalizer <= 1.23.3 - Unauthenticated Stored Cross-Site ScriptingCustomily Product Personalizer
- CVE-2024-2342Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcodecroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2024-1852WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scriptingcbutlerjr WP-Members Membership Plugin
- CVE-2024-31457gin-vue-admin background arbitrary code coverage vulnerabilityflipped-aurora gin-vue-admin · github.com/flipped-aurora/gi…
- CVE-2024-25115RedisBloom heap buffer overflow in CF.LOADCHUNK commandRedisBloom
- CVE-2024-22423yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windowsyt-dlp
- CVE-2024-29993Azure CycleCloud Elevation of Privilege VulnerabilityMicrosoft Azure CycleCloud
- CVE-2024-29989Azure Monitor Agent Elevation of Privilege VulnerabilityMicrosoft Azure Monitor
- CVE-2024-29985Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-29984Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-29983Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-29982Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-20670Outlook for Windows Spoofing VulnerabilityMicrosoft Outlook for Windows
- CVE-2024-29062Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-29061Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-29054Microsoft Defender for IoT Elevation of Privilege VulnerabilityMicrosoft Defender for IoT
- CVE-2024-29055Microsoft Defender for IoT Elevation of Privilege VulnerabilityMicrosoft Defender for IoT
- CVE-2024-29053Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft Defender for IoT
- CVE-2024-29052Windows Storage Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-29048Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-29046Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-29044Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-28944Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-28943Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft ODBC Driver 17 for SQL… +5
- CVE-2024-28941Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft ODBC Driver 17 for SQL… +5
- CVE-2024-28940Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-28938Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +7
- CVE-2024-28937Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft ODBC Driver 17 for SQL… +6
- CVE-2024-28935Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft ODBC Driver 17 for SQL… +6
- CVE-2024-28934Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +7
- CVE-2024-28933Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft Visual Studio · Microsoft SQL Server +6
- CVE-2024-28930Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft ODBC Driver 17 for SQL… +6
- CVE-2024-28927Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-28926Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +2
- CVE-2024-28907Microsoft Brokering File System Elevation of Privilege VulnerabilityMicrosoft Windows Server 2022, 23H2 Edition
- CVE-2024-28904Microsoft Brokering File System Elevation of Privilege VulnerabilityMicrosoft Windows Server 2022, 23H2 Edition
- CVE-2024-28925Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-26257Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC f…
- CVE-2024-26240Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-26239Windows Telephony Server Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26230Windows Telephony Server Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26228Windows Cryptographic Services Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-26216Windows File Server Resource Management Service Elevation of Privilege VulnerabilityMicrosoft Windows Server
- CVE-2024-26215DHCP Server Service Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-26214Microsoft WDAC SQL Server ODBC Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-26213Microsoft Brokering File System Elevation of Privilege VulnerabilityMicrosoft Windows Server 2022, 23H2 Edition
- CVE-2024-26212DHCP Server Service Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-26211Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26208Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-26245Windows SMB Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26244Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-26242Windows Telephony Server Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26237Windows Defender Credential Guard Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26236Windows Update Stack Elevation of Privilege VulnerabilityMicrosoft Windows Server 2022, 23H2 Edition
- CVE-2024-26235Windows Update Stack Elevation of Privilege VulnerabilityMicrosoft Windows Server 2022, 23H2 Edition
- CVE-2024-26229Windows CSC Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26210Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-26248Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26243Windows USB Print Driver Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-26241Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26233Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-26231Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-26227Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-26224Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-26223Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-26222Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-26221Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-26219HTTP.sys Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-26218Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26202DHCP Server Service Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-26195DHCP Server Service Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-26194Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-26189Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-26180Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-26175Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-21447Windows Authentication Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-21324Microsoft Defender for IoT Elevation of Privilege VulnerabilityMicrosoft Defender for IoT
- CVE-2024-21323Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft Defender for IoT
- CVE-2024-21322Microsoft Defender for IoT Remote Code Execution VulnerabilityMicrosoft Defender for IoT
- CVE-2024-20693Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-20678Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-29988SmartScreen Prompt Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-29066Windows Distributed File System (DFS) Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-29063Azure AI Search Information Disclosure VulnerabilityMicrosoft Azure AI Search
- CVE-2024-29050Windows Cryptographic Services Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-29047Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-29045Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-29043Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +6
- CVE-2024-28945Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-28942Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +2
- CVE-2024-28939Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-28936Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +7
- CVE-2024-28932Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +7
- CVE-2024-28931Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +7
- CVE-2024-28929Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft ODBC Driver 17 for SQL… +6
- CVE-2024-28915Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-28914Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +2
- CVE-2024-28913Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-28912Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +2
- CVE-2024-28911Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-28910Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-28909Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +2
- CVE-2024-28908Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-28906Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server +2
- CVE-2024-28905Microsoft Brokering File System Elevation of Privilege VulnerabilityMicrosoft Windows Server 2022, 23H2 Edition
- CVE-2024-28896Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-28920Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-26232Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-26158Microsoft Install Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26205Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-26200Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-26179Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-26256Libarchive Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-26254Microsoft Virtual Machine Bus (VMBus) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-21409.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio · Microsoft PowerShell +4
- CVE-2024-20689Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows Server
- CVE-2024-20688Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows Server
- CVE-2024-29905DIRAC: Unauthorized users can read proxy contents during generationDIRACGrid DIRAC · dirac
- CVE-2024-28235Contao possible cookie sharing with external domains while checking protected pages for broken linkscontao · contao/core-bundle
- CVE-2024-3281A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices.HP Poly CCX devices
- CVE-2024-21755A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 thFortinet FortiSandbox
- CVE-2024-21756A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 thFortinet FortiSandbox
- CVE-2023-41677A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 thrFortinet FortiOS · Fortinet FortiProxy
- CVE-2024-23671A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3,Fortinet FortiSandbox
- CVE-2023-49074A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point
- CVE-2023-49134A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access PointTp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…
- CVE-2023-49133A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access PointTp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…
- CVE-2023-48724A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point
- CVE-2023-49913A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO GiTp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…
- CVE-2023-49912A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO GiTp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…
- CVE-2023-49911A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO GiTp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…
- CVE-2023-49910A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO GiTp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…
- CVE-2023-49909A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO GiTp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…
- CVE-2023-49908A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO GiTp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…
- CVE-2023-49907A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO GiTp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…
- CVE-2023-49906A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO GiTp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…
- CVE-2023-6317PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interactionLG WebOS
- CVE-2024-2224Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)Bitdefender GravityZone Control Center · Bitdefender End… +1
- CVE-2024-2223 Incorrect Regular Expression in GravityZone Update Server (VA-11465)Bitdefender GravityZone Control Center · Bitdefender End… +1
- CVE-2024-3046In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unautheEclipse Foundation Kura · org.eclipse.kura:org.eclipse.kura…
- CVE-2024-31370WordPress CodeisAwesome AIKit plugin <= 4.14.1 - SQL Injection vulnerabilityCodeIsAwesome AIKit
- CVE-2024-31978A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP2).Siemens SINEC NMS
- CVE-2024-30191A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-Siemens SCALANCE W1748-1 M12 · Siemens SCALANCE W1788-1… +25
- CVE-2024-26275A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All vSiemens JT2Go · Siemens Parasolid +1
- CVE-2023-1082Welotec: Command injection vulnerability in TK500v1 router seriesWelotec TK515L · Welotec TK515L-W +5
- CVE-2024-31367WordPress Soledad theme <= 8.4.2 - Authenticated Broken Access Control vulnerabilityPenciDesign Soledad
- CVE-2024-31366WordPress Post Type Builder (PTB) plugin <= 2.0.8 - Auth. Arbitrary Post/Page Creation vulnerabilityThemify Post Type Builder
- CVE-2024-31365WordPress Post Type Builder (PTB) plugin < 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityThemify Post Type Builder
- CVE-2024-1233Eap: wildfly-elytron has a ssrf security issuewildfly · Red Hat JBoss Enterprise Application Platform +1
- CVE-2024-27983An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 fNodeJS Node
- CVE-2024-2975A race condition was identified through which privilege escalation was possible in certain configurations.Octopus Deploy Octopus Server
- CVE-2024-27901Directory Traversal vulnerability in SAP Asset AccountingSAP_SE SAP Asset Accounting
- CVE-2024-27899Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management EngineSAP_SE SAP NetWeaver AS Java User Management Engine
- CVE-2024-25646Information Disclosure vulnerability in SAP BusinessObjects Web IntelligenceSAP_SE SAP BusinessObjects Web Intelligence
- CVE-2024-24245An issue in Canimaan Software LTD ClamXAV v3.1.2 through v3.6.1 and fixed in v.3.6.2 allows a local attacker to escalate privileges via the
- CVE-2024-31507Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "request" parameter in admin/fetch_gendercs.php.
Medium, low and unrated 194
- CVE-2024-3524Campcodes Online Event Management System process.php cross site scriptingCampcodes Online Event Management System
- CVE-2024-3523Campcodes Online Event Management System index.php sql injectionCampcodes Online Event Management System
- CVE-2024-3522Campcodes Online Event Management System process.php sql injectionCampcodes Online Event Management System
- CVE-2024-3521Byzoro Smart S80 Management Platform userattestation.php unrestricted uploadByzoro Smart S80 Management Platform
- CVE-2022-4965Invitation Code Content Restriction Plugin from CreativeMinds <= 1.5.4 - Reflected Cross-Site ScriptingInvitation Code Content Restriction Plugin from CreativeMin…
- CVE-2023-6694Beaver Themer <= 1.4.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeBeaver Builder Beaver Themer
- CVE-2024-1412Memberpress <= 1.11.24 - Reflected Cross-Site Scripting via message and errorMemberpress
- CVE-2023-6695Beaver Themer <= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcodeBeaver Builder Beaver Themer
- CVE-2024-3545Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and DDevolutions Server · Devolutions Remote Desktop Manager
- CVE-2024-2311Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeThemeFusion Avada | Website Builder For WordPress & WooComm…
- CVE-2024-2138JetWidgets For Elementor <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Box Widgetjetmonsters JetWidgets For Elementor
- CVE-2024-2306Revslider <= 6.6.20 - Authenticated (Author+) Stored Cross-Site ScriptingRevolution Slider Slider Revolution
- CVE-2024-1352Classified Listing – Classified ads & Business Directory Plugin <= 3.0.4 - Missing Authorizationtechlabpro1 Classified Listing – AI-Powered Classified ads…
- CVE-2024-1498Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widgetthehappymonster Happy Addons for Elementor
- CVE-2024-3267Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcodeboldthemes Bold Page Builder
- CVE-2024-2347Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Namebrainstormforce Astra
- CVE-2024-2787Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tagthehappymonster Happy Addons for Elementor
- CVE-2024-2093VK All in One Expansion Unit <= 9.95.0.1 - Information Exposurekurudrive VK All in One Expansion Unit
- CVE-2024-3213Relevanssi – A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option UpdateRelevanssi Premium · comesio Relevanssi – A Better Search
- CVE-2024-1984Graphene <= 2.9.2 - Missing Authorizationsilverks Graphene
- CVE-2024-2081FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scriptingfooplugins Gallery by FooGallery
- CVE-2024-1458Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text WidgetLivemesh Addons by Elementor
- CVE-2024-2456Ecwid Ecommerce Shopping Cart <= 6.12.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEcwid by Lightspeed Ecommerce Shopping Cart
- CVE-2024-2792Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widgetwpvibes Addon Elements for Elementor
- CVE-2024-2039Stackable – Page Builder Gutenberg Blocks <= 3.12.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Posts Blockbfintal Stackable – Page Builder Gutenberg Blocks
- CVE-2024-1461Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members WidgetLivemesh Addons by Elementor
- CVE-2024-2946ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widgetdevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2024-2327Global Elementor Buttons <= 1.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via button linktausworks Global Elementor Buttons
- CVE-2023-6486Spectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSSbrainstormforce Spectra Gutenberg Blocks – Website Builder…
- CVE-2024-3208Sydney Toolbox <= 1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallerysmub Sydney Toolbox
- CVE-2024-2654File Manager <= 7.2.5 - Authenticated (Administrator+) Directory Traversalmndpsingh287 File Manager
- CVE-2024-2117Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widgetelemntor Elementor Website Builder – more than just a page…
- CVE-2023-6965Pods - Custom Content Types and Fields - Missing Authorizationsc0ttkclark Pods – Custom Content Types and Fields
- CVE-2024-2504Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributessoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2024-0873Watu Quiz <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingprasunsen Watu Quiz
- CVE-2024-1424GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-1587Newsmatic <= 1.3.4 - Unauthenticated Information Exposure via newsmatic_filter_posts_load_tab_contentblazethemes Newsmatic
- CVE-2024-2222Advanced Classifieds & Directory Pro <= 3.0.0 - Missing Authorization to Arbitrary Attachment Deletionpluginsware Advanced Classifieds & Directory Pro
- CVE-2024-2789Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendythehappymonster Happy Addons for Elementor
- CVE-2024-2623Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-2325Link Library <= 7.6.6 - Reflected Cross-Site Scriptingjackdewey Link Library
- CVE-2024-1999Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widgetstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-1387Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposurethehappymonster Happy Addons for Elementor
- CVE-2024-2287Knight Lab Timeline <= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcodenuknightlab Knight Lab Timeline
- CVE-2024-2348Gum Elementor Addon <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widgetcelomitan Gum Addon for Elementor
- CVE-2024-0872Watu Quiz <= 3.4.1 - Sensitive Information Disclosureprasunsen Watu Quiz
- CVE-2024-2305Cards for Beaver Builder <= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard linkpratikchaskar Cards for Beaver Builder
- CVE-2024-1463LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scriptingthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-3167Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingoceanwp Ocean Extra
- CVE-2024-2289PowerPack Lite for Beaver Builder <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via element linkideaboxcreations PowerPack Lite for Beaver Builder
- CVE-2024-2507JetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URLjetmonsters JetWidgets For Elementor
- CVE-2024-2847WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodenickboss Iptanus File Upload
- CVE-2024-2335Elements Plus! <= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget linkscssigniterteam Elements Plus!
- CVE-2024-2871Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcodedglingren Media Library Assistant
- CVE-2024-3214Relevanssi – A Better Search <= 4.22.1 - Unauthenticated Second Order CSV InjectionRelevanssi Premium · comesio Relevanssi – A Better Search
- CVE-2024-0598Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settingsstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-1465Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Carousel WidgetLivemesh Addons by Elementor
- CVE-2024-2340Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory ListingThemeFusion Avada | Website Builder For WordPress & WooComm…
- CVE-2024-2026Passster <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcodewpchill Passster – Password Protect Pages and Content
- CVE-2024-2343Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_actionThemeFusion Avada | Website Builder For WordPress & WooComm…
- CVE-2024-1790Ajax Load More <= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File Readdcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…
- CVE-2024-2536Rank Math SEO with AI SEO Tools <= 1.0.214 - Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributesrankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…
- CVE-2024-0899s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 230815 - Information Exposureclavaque s2Member – Excellent for All Kinds of Memberships,…
- CVE-2024-1464Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Slider WidgetLivemesh Addons by Elementor
- CVE-2024-2974Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposurewpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-2183Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading WidgetWPZOOM Addons for Beaver Builder
- CVE-2024-3244EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2024-3097WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosuresmub Photo Gallery, Sliders, Proofing and Themes – NextGEN…
- CVE-2024-2543Plugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editormbis Permalink Manager Lite
- CVE-2024-2186Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members WidgetWPZOOM Addons for Beaver Builder
- CVE-2024-2457Modal Window – create popup modal window <= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcodewpcalc Modal Window – create popup modal window
- CVE-2024-2788Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tagthehappymonster Happy Addons for Elementor
- CVE-2024-2650Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-2783GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcoderubengc GamiPress – Gamification plugin to reward points, a…
- CVE-2024-2738Permalink Manager Lite and Permalink Manager Pro <= 2.4.3.1 - Reflected Cross-Site Scriptingmbis Permalink Manager Lite · mbis Permalink Manager Pro
- CVE-2024-0588Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgerystrangerstudios Paid Memberships Pro – Content Restriction,…
- CVE-2024-1948Getwid – Gutenberg Blocks <= 2.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Contentjetmonsters Getwid – Gutenberg Blocks
- CVE-2024-1571WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embedbrechtvds WP Recipe Maker
- CVE-2024-2181Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button WidgetWPZOOM Addons for Beaver Builder
- CVE-2023-6799WP Reset <= 2.0 - Sensitive Information Exposure due to Insufficient Randomnesswebfactory WP Reset
- CVE-2024-2027Real Media Library: Media Library Folder & File Manager <= 4.22.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingdevowl Real Media Library: Media Library Folder & File Mana…
- CVE-2024-2334Template Kit – Import <= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template uploadenvato Template Kit – Import
- CVE-2024-1466Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Multislider WidgetLivemesh Addons by Elementor
- CVE-2024-2198Contact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_addressContact Form by BestWebSoft – Advanced WP Contact Form Buil…
- CVE-2024-0626WooCommerce Clover Payment Gateway <= 1.3.1 - Missing Authorization via callback_handlerelbanyaoui Clover Payment Gateway by Zaytech for WooCommerce
- CVE-2024-2112Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information ExposureForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2024-0662The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 dcolorlibplugins FancyBox for WordPress
- CVE-2024-2436Lightweight Accordion <= 1.5.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcodesomeguy9 Lightweight Accordion
- CVE-2023-6777WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Servicewpgmaps WP Go Maps
- CVE-2024-2165SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scriptingrainbowgeek SEOPress – On-site SEO & Analytics
- CVE-2024-2786Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tagthehappymonster Happy Addons for Elementor
- CVE-2024-1850AI Post Generator | AutoWriter <= 3.3 - Missing Authorizationkekotron AI Post Generator | AutoWriter
- CVE-2024-2336Popup Maker – Popup for opt-ins, lead gen, & more <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingdanieliser Popup Maker – Boost Sales, Conversions, Optins,…
- CVE-2024-0826Qi Addons For Elementor <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingqodeinteractive Qi Addons For Elementor
- CVE-2024-2513WP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attributeninjateam WP Chat App
- CVE-2024-1960ShopLentor <= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Linkdevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2024-2423UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcodestiofansisland UsersWP – Front-end login form, User Registr…
- CVE-2024-2261Event Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosurestellarwp Event Tickets and Registration
- CVE-2024-2845BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…
- CVE-2023-6993Custom post types, Custom Fields & more <= 5.0.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingtotalpressorg Custom post types, Custom Fields & more
- CVE-2024-2200Contact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_subjectContact Form by BestWebSoft – Advanced WP Contact Form Buil…
- CVE-2024-3266Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attributeboldthemes Bold Page Builder
- CVE-2024-2226Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemeisle Otter Blocks – Gutenberg Blocks, Page Builder for…
- CVE-2024-1904MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_postsstylemix MasterStudy LMS WordPress Plugin – for Online Cour…
- CVE-2024-1637360 Javascript Viewer <= 1.7.12 - Missing Authorization to Plugin Settings Updatejtermaat 360 Javascript Viewer
- CVE-2024-3053Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcodewpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2024-3064Elementor Addons, Widgets and Enhancements – Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingstaxwp Stax Addons for Elementor
- CVE-2024-2492PowerPack Addons for Elementor <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widgetideaboxcreations PowerPack Addons for Elementor
- CVE-2024-0376Premium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widgetleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-1641Accordion <= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplicationpickplugins Accordions
- CVE-2024-1289LearnPress <= 4.2.6.3 - Insecure Direct Object Referencethimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-2033Video Conferencing with Zoom <= 4.4.5 - Sensitive Information Exposurej_3rk Video Conferencing with Zoom
- CVE-2024-2302Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposuresmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2024-2185Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box WidgetWPZOOM Addons for Beaver Builder
- CVE-2024-2187Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials WidgetWPZOOM Addons for Beaver Builder
- CVE-2024-2918Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM Devolutions Server
- CVE-2024-25116Specially crafted CF.RESERVE command can lead to denial-of-serviceRedisBloom
- CVE-2024-31454PsiTransfer file integrity violation vulnerabilitypsi-4ward psitransfer · psitransfer
- CVE-2024-27242Zoom Desktop Client for Linux - Cross Site ScriptingZoom Video Communications Zoom Desktop Client for Linux
- CVE-2024-27247Zoom Desktop Client for macOS - Improper Privilege ManagementZoom Video Communications Zoom Desktop Client for macOS
- CVE-2024-24694Zoom Desktop Client for Windows - Improper Privilege ManagementZoom Video Communications Zoom Desktop Client for Windows
- CVE-2024-31453PsiTransfer vulnerable to violation of the integrity of file distributionpsi-4ward psitransfer · psitransfer
- CVE-2024-29992Azure Identity Library for .NET Information Disclosure VulnerabilityMicrosoft Azure Identity Library for .NET · Azure.Identity
- CVE-2024-29056Windows Authentication Elevation of Privilege VulnerabilityMicrosoft Windows Server
- CVE-2024-28917Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege VulnerabilityMicrosoft Azure Arc Extension
- CVE-2024-28900Windows Remote Access Connection Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-28897Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-28924Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-26251Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Server
- CVE-2024-26226Windows Distributed File System (DFS) Information Disclosure VulnerabilityMicrosoft Windows Server
- CVE-2024-26217Windows Remote Access Connection Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-26207Windows Remote Access Connection Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-26234Proxy Driver Spoofing VulnerabilityMicrosoft Windows
- CVE-2024-26220Windows Mobile Hotspot Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-26209Microsoft Local Security Authority Subsystem Service Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-26183Windows Kerberos Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-26171Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-26168Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-26193Azure Migrate Remote Code Execution VulnerabilityMicrosoft Azure Migrate
- CVE-2024-20665BitLocker Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-20685Azure Private 5G Core Denial of Service VulnerabilityMicrosoft Azure Private 5G Core
- CVE-2024-29064Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-28903Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-28902Windows Remote Access Connection Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-28901Windows Remote Access Connection Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-28898Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-28923Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-28919Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-28921Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-28922Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-26172Windows DWM Core Library Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-26255Windows Remote Access Connection Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-26253Windows rndismp6.sys Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-26252Windows rndismp6.sys Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-26250Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-21424Azure Compute Gallery Elevation of Privilege VulnerabilityMicrosoft Azure Compute Gallery
- CVE-2024-20669Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-31455Minder GetRepositoryByName data leakstacklok minder · github.com/stacklok/minder
- CVE-2024-30262Contao's remember-me tokens will not be cleared after a password changecontao · contao/core-bundle
- CVE-2024-31867Apache Zeppelin: LDAP search filter query Injection VulnerabilityApache Software Foundation Apache Zeppelin · org.apache.zep…
- CVE-2024-31868Apache Zeppelin: XSS vulnerability in the helium moduleApache Software Foundation Apache Zeppelin · org.apache.zep…
- CVE-2024-31865Apache Zeppelin: Cron arbitrary user impersonation with improper privilegesApache Software Foundation Apache Zeppelin · org.apache.zep…
- CVE-2023-48784A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all veFortinet FortiOS
- CVE-2023-47542A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 Fortinet FortiManager
- CVE-2023-47540An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 tFortinet FortiSandbox
- CVE-2024-31487A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4,Fortinet FortiSandbox
- CVE-2023-47541An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2Fortinet FortiSandbox
- CVE-2024-23662An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 thFortinet FortiOS
- CVE-2024-28234Contao has insufficient BBCode sanitizercontao · contao/comments-bundle
- CVE-2024-28191Contao may have unencoded insert tags in the frontendcontao · contao/core-bundle
- CVE-2024-28190Contao core bundle vulnerable to cross site scripting in the file managercontao · contao/core-bundle
- CVE-2024-31863Apache Zeppelin: Replacing other users notebook, bypassing any permissionsApache Software Foundation Apache Zeppelin · org.apache.zep…
- CVE-2024-31862Apache Zeppelin: Denial of service with invalid notebook nameApache Software Foundation Apache Zeppelin · org.apache.zep…
- CVE-2022-47894Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXEApache Software Foundation Apache Zeppelin SAP · org.apache…
- CVE-2021-28656Apache Zeppelin: CSRF vulnerability in the Credentials pageApache Software Foundation Apache Zeppelin · org.apache.zep…
- CVE-2024-31860Apache Zeppelin: Path traversal vulnerabilityApache Software Foundation Apache Zeppelin · org.apache.zep…
- CVE-2024-30190A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-Siemens SCALANCE W1748-1 M12 · Siemens SCALANCE W1788-1… +25
- CVE-2024-30189A vulnerability has been identified in SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) (All versions), SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0) (Siemens SCALANCE W721-1 RJ45 · Siemens SCALANCE W722-1… +16
- CVE-2024-26277A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All vSiemens JT2Go · Siemens Parasolid +1
- CVE-2024-26276A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All vSiemens JT2Go · Siemens Parasolid +1
- CVE-2023-50821A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC04), SIMATIC WinCC Runtime Professional V17 (All versioSiemens SIMATIC PCS 7 · Siemens SIMATIC WinCC Runtime Pr… +1
- CVE-2024-31369WordPress Soledad theme <= 8.4.2 - Cross Site Request Forgery (CSRF) vulnerabilityPenciDesign Soledad
- CVE-2024-31368WordPress Soledad theme <= 8.4.2 - Unauthenticated Broken Access Control vulnerabilityPenciDesign Soledad
- CVE-2024-1664Responsive Gallery Grid < 2.3.11 - Admin+ Stored XSSResponsive Gallery Grid
- CVE-2024-30218Denial of service (DOS) vulnerability in SAP NetWeaver AS ABAP and ABAP PlatformSAP_SE SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2024-30217Missing Authorization check in SAP S/4 HANA (Cash Management)SAP_SE SAP S/4 HANA
- CVE-2024-30216Missing Authorization check in SAP S/4 HANA (Cash Management)SAP_SE SAP S/4 HANA
- CVE-2024-30215Cross-Site Scripting (XSS) vulnerability in SAP Business ConnectorSAP_SE SAP Business Connector
- CVE-2024-30214Cross-Site Scripting (XSS) vulnerability in SAP Business ConnectorSAP_SE SAP Business Connector
- CVE-2024-28167Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data)SAP_SE SAP Group Reporting Data Collection
- CVE-2024-27898Server-Side Request Forgery in SAP NetWeaverSAP_SE SAP NetWeaver
- CVE-2024-27665Unifiedtransform v2.X is vulnerable to Stored Cross-Site Scripting (XSS) via file upload feature in Syllabus module.
- CVE-2024-31506Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "id" parameter in admin/admin_cs.php.
- CVE-2024-31544A stored cross-site scripting (XSS) vulnerability in Computer Laboratory Management System v1.0 allows attackers to execute arbitrary JavaSc