# CVEs published 2024-04-10

217 CVEs were published on April 10, 2024: 30 critical, 61 high. Days are UTC.

- [CVE-2024-3612](https://cve.now/CVE-2024-3612.md): SourceCodester Warehouse Management System barang.php cross site scripting (CVSS 3.5, SourceCodester Warehouse Management System)
- [CVE-2024-29903](https://cve.now/CVE-2024-29903.md): Cosign vulnerable to machine-wide denial of service via malicious artifacts (CVSS 4.2, sigstore cosign · github.com/sigstore/cosign +1)
- [CVE-2024-29902](https://cve.now/CVE-2024-29902.md): Cosign vulnerable to system-wide denial of service via malicious attachments (CVSS 4.2, sigstore cosign · github.com/sigstore/cosign +1)
- [CVE-2024-32001](https://cve.now/CVE-2024-32001.md): SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used (CVSS 2.2, authzed spicedb · github.com/authzed/spicedb)
- [CVE-2024-31999](https://cve.now/CVE-2024-31999.md): @fastify/secure-session: Reuse of destroyed secure session cookie (CVSS 7.4, fastify-secure-session · @fastify/secure-session)
- [CVE-2024-31995](https://cve.now/CVE-2024-31995.md): zcap has incomplete expiration checks in capability chains. (CVSS 4.3, digitalbazaar zcap · @digitalbazaar/zcap)
- [CVE-2024-31997](https://cve.now/CVE-2024-31997.md): XWiki Platform remote code execution from account through UIExtension parameters (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-uiextens…)
- [CVE-2024-31996](https://cve.now/CVE-2024-31996.md): XWiki Commons missing escaping of \`{\` in Velocity escapetool allows remote code execution (CVSS 10.0, xwiki-commons · org.xwiki.commons:xwiki-commons-velocity)
- [CVE-2024-31988](https://cve.now/CVE-2024-31988.md): XWiki Platform CSRF remote code execution through the realtime HTML Converter API (CVSS 9.7, xwiki-platform · org.xwiki.platform:xwiki-platform-realtime…)
- [CVE-2024-1481](https://cve.now/CVE-2024-1481.md): Freeipa: specially crafted http requests potentially lead to denial of service (CVSS 5.3, freeipa · Red Hat Enterprise Linux)
- [CVE-2024-31987](https://cve.now/CVE-2024-31987.md): XWiki Platform remote code execution from account via custom skins support (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2024-31986](https://cve.now/CVE-2024-31986.md): XWiki Platform CSRF remote code execution through scheduler job's document reference (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-schedule…)
- [CVE-2024-31985](https://cve.now/CVE-2024-31985.md): XWiki Platform CSRF in the job scheduler (CVSS 5.4, xwiki-platform · org.xwiki.platform:xwiki-platform-schedule…)
- [CVE-2024-31984](https://cve.now/CVE-2024-31984.md): XWiki Platform: Remote code execution through space title and Solr space facet (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-search-s…)
- [CVE-2024-31983](https://cve.now/CVE-2024-31983.md): XWiki Platform: Remote code execution from edit in multilingual wikis via translations (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-localiza…)
- [CVE-2024-31982](https://cve.now/CVE-2024-31982.md): XWiki Platform: Remote code execution as guest via DatabaseSearch (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-search-ui)
- [CVE-2024-31981](https://cve.now/CVE-2024-31981.md): XWiki Platform: Privilege escalation (PR) from user registration through PDFClass (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2024-31939](https://cve.now/CVE-2024-31939.md): WordPress Import any XML or CSV File to WordPress plugin \<= 3.7.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Soflyy Import any XML or CSV File to WordPress)
- [CVE-2024-31465](https://cve.now/CVE-2024-31465.md): XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-search-ui)
- [CVE-2024-31430](https://cve.now/CVE-2024-31430.md): Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR and WOLF WordPress plugins (CVSS 4.3, realmag777 WOLF – WordPress Posts Bulk Editor and Manager P…)
- [CVE-2021-47219](https://cve.now/CVE-2021-47219.md): scsi: scsi\_debug: Fix out-of-bound read in resp\_report\_tgtpgs() (CVSS 7.1, Linux)
- [CVE-2021-47218](https://cve.now/CVE-2021-47218.md): selinux: fix NULL-pointer dereference when hashtab allocation fails (no CVSS, Linux)
- [CVE-2021-47217](https://cve.now/CVE-2021-47217.md): x86/hyperv: Fix NULL deref in set\_hv\_tscchange\_cb() if Hyper-V setup fails (no CVSS, Linux)
- [CVE-2021-47216](https://cve.now/CVE-2021-47216.md): scsi: advansys: Fix kernel pointer leak (no CVSS, Linux)
- [CVE-2021-47215](https://cve.now/CVE-2021-47215.md): net/mlx5e: kTLS, Fix crash in RX resync flow (CVSS 9.8, Linux)
- [CVE-2021-47214](https://cve.now/CVE-2021-47214.md): hugetlb, userfaultfd: fix reservation restore on userfaultfd error (no CVSS, Linux)
- [CVE-2021-47212](https://cve.now/CVE-2021-47212.md): net/mlx5: Update error handler for UCTX and UMEM (no CVSS, Linux)
- [CVE-2021-47211](https://cve.now/CVE-2021-47211.md): ALSA: usb-audio: fix null pointer dereference on pointer cs\_desc (no CVSS, Linux)
- [CVE-2021-47210](https://cve.now/CVE-2021-47210.md): usb: typec: tipd: Remove WARN\_ON in tps6598x\_block\_read (no CVSS, Linux)
- [CVE-2021-47209](https://cve.now/CVE-2021-47209.md): sched/fair: Prevent dead task groups from regaining cfs\_rq's (CVSS 7.8, Linux)
- [CVE-2021-47207](https://cve.now/CVE-2021-47207.md): ALSA: gus: fix null pointer dereference on pointer block (no CVSS, Linux)
- [CVE-2021-47206](https://cve.now/CVE-2021-47206.md): usb: host: ohci-tmio: check return value after calling platform\_get\_resource() (no CVSS, Linux)
- [CVE-2021-47205](https://cve.now/CVE-2021-47205.md): clk: sunxi-ng: Unregister clocks/resets when unbinding (no CVSS, Linux)
- [CVE-2021-47204](https://cve.now/CVE-2021-47204.md): net: dpaa2-eth: fix use-after-free in dpaa2\_eth\_remove (no CVSS, Linux)
- [CVE-2021-47203](https://cve.now/CVE-2021-47203.md): scsi: lpfc: Fix list\_add() corruption in lpfc\_drain\_txq() (CVSS 8.8, Linux)
- [CVE-2021-47202](https://cve.now/CVE-2021-47202.md): thermal: Fix NULL pointer dereferences in of\_thermal\_ functions (no CVSS, Linux)
- [CVE-2021-47201](https://cve.now/CVE-2021-47201.md): iavf: free q\_vectors before queues in iavf\_disable\_vf (CVSS 7.8, Linux)
- [CVE-2021-47200](https://cve.now/CVE-2021-47200.md): drm/prime: Fix use after free in mmap with drm\_gem\_ttm\_mmap (CVSS 7.8, Linux)
- [CVE-2021-47199](https://cve.now/CVE-2021-47199.md): net/mlx5e: CT, Fix multiple allocations and memleak of mod acts (no CVSS, Linux)
- [CVE-2021-47198](https://cve.now/CVE-2021-47198.md): scsi: lpfc: Fix use-after-free in lpfc\_unreg\_rpi() routine (no CVSS, Linux)
- [CVE-2021-47197](https://cve.now/CVE-2021-47197.md): net/mlx5e: nullify cq-\>dbg pointer in mlx5\_debug\_cq\_remove() (CVSS 7.8, Linux)
- [CVE-2021-47196](https://cve.now/CVE-2021-47196.md): RDMA/core: Set send and receive CQ before forwarding to the driver (CVSS 7.8, Linux)
- [CVE-2021-47195](https://cve.now/CVE-2021-47195.md): spi: fix use-after-free of the add\_lock mutex (no CVSS, Linux)
- [CVE-2021-47194](https://cve.now/CVE-2021-47194.md): cfg80211: call cfg80211\_stop\_ap when switch from P2P\_GO type (CVSS 7.8, Linux)
- [CVE-2021-47193](https://cve.now/CVE-2021-47193.md): scsi: pm80xx: Fix memory leak during rmmod (no CVSS, Linux)
- [CVE-2021-47192](https://cve.now/CVE-2021-47192.md): scsi: core: sysfs: Fix hang when device state is set via sysfs (CVSS 5.3, Linux)
- [CVE-2021-47191](https://cve.now/CVE-2021-47191.md): scsi: scsi\_debug: Fix out-of-bound read in resp\_readcap16() (CVSS 7.1, Linux)
- [CVE-2021-47190](https://cve.now/CVE-2021-47190.md): perf bpf: Avoid memory leak from perf\_env\_\_insert\_btf() (no CVSS, Linux)
- [CVE-2021-47189](https://cve.now/CVE-2021-47189.md): btrfs: fix memory ordering between normal and ordered work functions (CVSS 7.8, Linux)
- [CVE-2021-47188](https://cve.now/CVE-2021-47188.md): scsi: ufs: core: Improve SCSI abort handling (CVSS 7.8, Linux)
- [CVE-2021-47187](https://cve.now/CVE-2021-47187.md): arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency (no CVSS, Linux)
- [CVE-2021-47186](https://cve.now/CVE-2021-47186.md): tipc: check for null after calling kmemdup (no CVSS, Linux)
- [CVE-2021-47185](https://cve.now/CVE-2021-47185.md): tty: tty\_buffer: Fix the softlockup issue in flush\_to\_ldisc (CVSS 4.4, Linux)
- [CVE-2021-47184](https://cve.now/CVE-2021-47184.md): i40e: Fix NULL ptr dereference on VSI filter sync (CVSS 8.8, Linux)
- [CVE-2021-47183](https://cve.now/CVE-2021-47183.md): scsi: lpfc: Fix link down processing to address NULL pointer dereference (CVSS 8.8, Linux)
- [CVE-2021-47182](https://cve.now/CVE-2021-47182.md): scsi: core: Fix scsi\_mode\_sense() buffer length handling (no CVSS, Linux)
- [CVE-2021-47181](https://cve.now/CVE-2021-47181.md): usb: musb: tusb6010: check return value after calling platform\_get\_resource() (no CVSS, Linux)
- [CVE-2024-31386](https://cve.now/CVE-2024-31386.md): Multiple WordPress themes affected by Cross-Site Request Forgery vulnerability (CVSS 4.3, Hidekazu Ishikawa X-T9 · Hidekazu Ishikawa Lightning +13)
- [CVE-2024-3515](https://cve.now/CVE-2024-3515.md): Use after free in Dawn in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 3.7, Google Chrome)
- [CVE-2024-3516](https://cve.now/CVE-2024-3516.md): Heap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2024-3157](https://cve.now/CVE-2024-3157.md): Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU pr (CVSS 8.1, Google Chrome)
- [CVE-2024-31464](https://cve.now/CVE-2024-31464.md): XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted (CVSS 6.8, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2024-31242](https://cve.now/CVE-2024-31242.md): WordPress Bricksforge plugin \<= 2.0.17 - Unauthenticated Arbitrary Email Sending vulnerability (CVSS 5.3, Bricksforge)
- [CVE-2024-31230](https://cve.now/CVE-2024-31230.md): WordPress ShortPixel Adaptive Images plugin \<= 3.8.2 - Broken Access Control vulnerability (CVSS 5.3, ShortPixel Adaptive Images)
- [CVE-2024-31943](https://cve.now/CVE-2024-31943.md): WordPress USPS Shipping for WooCommerce plugin \<= 1.9.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Octolize USPS Shipping for WooCommerce – Live Rates)
- [CVE-2024-31944](https://cve.now/CVE-2024-31944.md): WordPress WooCommerce UPS Shipping plugin \<= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Octolize WooCommerce UPS Shipping – Live Rates and Access P…)
- [CVE-2024-31461](https://cve.now/CVE-2024-31461.md): Plane Server-Side Request Forgery (SSRF) Vulnerability (CVSS 9.1, makeplane plane)
- [CVE-2024-31214](https://cve.now/CVE-2024-31214.md): Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution (CVSS 9.7, traccar)
- [CVE-2024-3570](https://cve.now/CVE-2024-3570.md): Stored XSS leading to Admin Account Takeover in mintplex-labs/anything-llm (CVSS 0.0, mintplex-labs/anything-llm)
- [CVE-2024-2195](https://cve.now/CVE-2024-2195.md): Remote Code Execution in aimhubio/aim (CVSS 9.8, aimhubio/aim · aim)
- [CVE-2024-2196](https://cve.now/CVE-2024-2196.md): CSRF Vulnerability in aimhubio/aim (CVSS 8.8, aimhubio/aim · aim)
- [CVE-2024-3101](https://cve.now/CVE-2024-3101.md): Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm (CVSS 6.7, mintplex-labs/anything-llm)
- [CVE-2024-2029](https://cve.now/CVE-2024-2029.md): Command Injection in mudler/localai (CVSS 9.8, mudler/localai · github.com/go-skynet/LocalAI)
- [CVE-2024-1902](https://cve.now/CVE-2024-1902.md): Session Reuse Vulnerability in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-1740](https://cve.now/CVE-2024-1740.md): Incorrect Authorization in lunary-ai/lunary (CVSS 9.1, lunary-ai/lunary)
- [CVE-2024-1741](https://cve.now/CVE-2024-1741.md): Improper Authorization in lunary-ai/lunary (CVSS 9.1, lunary-ai/lunary)
- [CVE-2024-2217](https://cve.now/CVE-2024-2217.md): Improper Access Control in gaizhenbiao/chuanhuchatgpt (CVSS 7.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-1602](https://cve.now/CVE-2024-1602.md): Stored XSS leading to RCE in parisneo/lollms-webui (CVSS 8.8, parisneo/lollms-webui)
- [CVE-2024-1520](https://cve.now/CVE-2024-1520.md): OS Command Injection in parisneo/lollms-webui (CVSS 9.8, parisneo/lollms-webui)
- [CVE-2024-1511](https://cve.now/CVE-2024-1511.md): Path Traversal Vulnerability in parisneo/lollms-webui (CVSS 9.8, parisneo/lollms-webui)
- [CVE-2024-3283](https://cve.now/CVE-2024-3283.md): Privilege Escalation via Mass Assignment in mintplex-labs/anything-llm (CVSS 7.2, mintplex-labs/anything-llm)
- [CVE-2024-2221](https://cve.now/CVE-2024-2221.md): Path Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrant (CVSS 9.8, qdrant/qdrant)
- [CVE-2024-1600](https://cve.now/CVE-2024-1600.md): Local File Inclusion in parisneo/lollms-webui (CVSS 9.3, parisneo/lollms-webui)
- [CVE-2024-1643](https://cve.now/CVE-2024-1643.md): Unauthorized Organization Access in lunary-ai/lunary (CVSS 9.1, lunary-ai/lunary)
- [CVE-2024-3569](https://cve.now/CVE-2024-3569.md): Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llm (CVSS 7.5, mintplex-labs/anything-llm)
- [CVE-2024-3098](https://cve.now/CVE-2024-3098.md): Prompt Injection leading to Arbitrary Code Execution in run-llama/llama\_index (CVSS 9.8, run-llama/llama\_index · llama-index-core)
- [CVE-2024-1728](https://cve.now/CVE-2024-1728.md): Local File Inclusion in gradio-app/gradio (CVSS 7.5, gradio-app/gradio · gradio)
- [CVE-2024-3568](https://cve.now/CVE-2024-3568.md): Arbitrary Code Execution via Deserialization in huggingface/transformers (CVSS 3.4, huggingface/transformers · transformers)
- [CVE-2024-1625](https://cve.now/CVE-2024-1625.md): IDOR Vulnerability in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-2952](https://cve.now/CVE-2024-2952.md): Server-Side Template Injection in BerriAI/litellm (CVSS 9.8, berriai/litellm · litellm)
- [CVE-2024-3025](https://cve.now/CVE-2024-3025.md): Path Traversal in mintplex-labs/anything-llm (CVSS 9.9, mintplex-labs/anything-llm)
- [CVE-2024-3388](https://cve.now/CVE-2024-3388.md): PAN-OS: User Impersonation in GlobalProtect SSL VPN (CVSS 4.1, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2024-3387](https://cve.now/CVE-2024-3387.md): PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure (CVSS 5.3, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2024-3386](https://cve.now/CVE-2024-3386.md): PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended (CVSS 5.3, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2024-3385](https://cve.now/CVE-2024-3385.md): PAN-OS: Firewall Denial of Service (DoS) when GTP Security is Disabled (CVSS 7.5, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2024-3384](https://cve.now/CVE-2024-3384.md): PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets (CVSS 7.5, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2024-3383](https://cve.now/CVE-2024-3383.md): PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE) (CVSS 7.4, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2024-3382](https://cve.now/CVE-2024-3382.md): PAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted Packets (CVSS 7.5, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2024-31299](https://cve.now/CVE-2024-31299.md): WordPress ReDi Restaurant Reservation plugin \<= 24.0128 - Cross Site Request Forgery (CSRF) to XSS vulnerability (CVSS 7.1, Reservation Diary ReDi Restaurant Reservation)
- [CVE-2024-31355](https://cve.now/CVE-2024-31355.md): WordPress Slideshow Gallery LITE plugin \<= 1.7.8 - Auth. SQL Injection vulnerability (CVSS 8.5, Tribulant Slideshow Gallery)
- [CVE-2024-31356](https://cve.now/CVE-2024-31356.md): WordPress User Activity Log plugin \<= 1.8 - Auth. SQL Injection vulnerability (CVSS 7.6, Solwin Infotech User Activity Log)
- [CVE-2024-31342](https://cve.now/CVE-2024-31342.md): WordPress Gallery Exporter plugin \<= 1.3 - Arbitrary File Download vulnerability (CVSS 6.5, WPcloudgallery WordPress Gallery Exporter)
- [CVE-2024-31343](https://cve.now/CVE-2024-31343.md): WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin \<= 4.10.1 - Arbitrary File Download vulnerability (CVSS 7.5, Sonaar Music MP3 Audio Player for Music, Radio & Podcast by…)
- [CVE-2024-31287](https://cve.now/CVE-2024-31287.md): WordPress Media Library Folders plugin \<= 8.1.8 - Directory Traversal vulnerability (CVSS 6.5, Max Foundry Media Library Folders)
- [CVE-2024-31240](https://cve.now/CVE-2024-31240.md): WordPress WP Poll Maker plugin \<= 3.1 - Auth. Arbitrary File Deletion vulnerability (CVSS 7.7, InfoTheme WP Poll Maker)
- [CVE-2024-31874](https://cve.now/CVE-2024-31874.md): IBM Security Verify Access Appliance denial of service (CVSS 6.2, IBM Security Verify Access Appliance)
- [CVE-2024-31297](https://cve.now/CVE-2024-31297.md): WordPress Wholesale For WooCommerce plugin \<= 2.3.1 - Unauthenticated Arbitrary Post/Page vulnerability (CVSS 7.5, WPExperts Wholesale For WooCommerce)
- [CVE-2024-31873](https://cve.now/CVE-2024-31873.md): IBM Security Verify Access Appliance information disclosure (CVSS 7.5, IBM Security Verify Access Appliance)
- [CVE-2024-31358](https://cve.now/CVE-2024-31358.md): WordPress 5 Stars Rating Funnel plugin \<= 1.2.67 - Arbitrary Content Deletion vulnerability (CVSS 7.5, Saleswonder Team: Tobias 5 Stars Rating Funnel)
- [CVE-2024-0218](https://cve.now/CVE-2024-0218.md): DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1 (CVSS 7.5, Nozomi Networks Guardian)
- [CVE-2024-31871](https://cve.now/CVE-2024-31871.md): IBM Security Verify Access Appliance improper certificate validation (CVSS 7.5, IBM Security Verify Access Appliance)
- [CVE-2024-31245](https://cve.now/CVE-2024-31245.md): WordPress ConvertKit plugin \<= 2.4.5 - Email Disclosure in Log File vulnerability (CVSS 5.3, ConvertKit)
- [CVE-2024-31872](https://cve.now/CVE-2024-31872.md): IBM Security Verify Access Appliance missing certificate validation (CVSS 7.5, IBM Security Verify Access Appliance)
- [CVE-2024-31247](https://cve.now/CVE-2024-31247.md): WordPress FG Drupal to WordPress plugin \<= 3.70.3 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, Frédéric GILLES FG Drupal to WordPress)
- [CVE-2023-6916](https://cve.now/CVE-2023-6916.md): Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1 (CVSS 7.2, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2024-31249](https://cve.now/CVE-2024-31249.md): WordPress Subscribe To Comments Reloaded plugin \<= 220725 - Sensitive Data Exposure vulnerability (CVSS 5.3, WPKube Subscribe To Comments Reloaded)
- [CVE-2024-31254](https://cve.now/CVE-2024-31254.md): WordPress WordPress Backup & Migration plugin \<= 1.4.7 - Sensitive Data Exposure via Log File vulnerability (CVSS 3.7, WebToffee WordPress Backup & Migration)
- [CVE-2024-31259](https://cve.now/CVE-2024-31259.md): WordPress SearchIQ plugin \<= 4.5 - Sensitive Data Exposure via Log File vulnerability (CVSS 7.5, SearchIQ)
- [CVE-2024-31278](https://cve.now/CVE-2024-31278.md): WordPress Premium Addons for Elementor plugin \<= 4.10.22 - Sensitive Data Exposure vulnerability (CVSS 4.3, Leap13 Premium Addons for Elementor)
- [CVE-2024-31298](https://cve.now/CVE-2024-31298.md): WordPress User Spam Remover plugin \<= 1.0 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, Joel Hardi User Spam Remover)
- [CVE-2024-31302](https://cve.now/CVE-2024-31302.md): WordPress Contact Form Email plugin \<= 1.3.44 - Sensitive Data Exposure vulnerability (CVSS 5.3, CodePeople Contact Form Email)
- [CVE-2024-31353](https://cve.now/CVE-2024-31353.md): WordPress Slideshow Gallery LITE plugin \<= 1.7.8 - Sensitive Data Exposure vulnerability (CVSS 5.3, Tribulant Slideshow Gallery)
- [CVE-2024-31253](https://cve.now/CVE-2024-31253.md): WordPress WP OAuth Server (OAuth Authentication) plugin \<= 4.3.3 - Open Redirection vulnerability (CVSS 4.7, WP OAuth Server OAuth Server)
- [CVE-2024-31282](https://cve.now/CVE-2024-31282.md): WordPress App Builder plugin \<= 3.8.7 - Open Redirection vulnerability (CVSS 4.7, Appcheap.io App Builder)
- [CVE-2024-3566](https://cve.now/CVE-2024-3566.md): Command injection vulnerability in programing languages on Microsoft Windows operating system. (CVSS 9.8, Node.js · Go Programming Language GoLang +1)
- [CVE-2024-24809](https://cve.now/CVE-2024-24809.md): Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type (CVSS 8.5, traccar)
- [CVE-2024-3567](https://cve.now/CVE-2024-3567.md): Qemu-kvm: net: assertion failure in update\_sctp\_checksum() (CVSS 5.5, net · Red Hat Enterprise Linux)
- [CVE-2024-3448](https://cve.now/CVE-2024-3448.md): Improper Access Control Leads to Server-Side Request Forgery in Mautic (CVSS 5.0, Mautic)
- [CVE-2024-2731](https://cve.now/CVE-2024-2731.md): Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic (CVSS 5.4, Mautic)
- [CVE-2024-2730](https://cve.now/CVE-2024-2730.md): Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic (CVSS 5.3, Mautic)
- [CVE-2024-26816](https://cve.now/CVE-2024-26816.md): x86, relocs: Ignore relocations in .notes section (no CVSS, Linux)
- [CVE-2024-31492](https://cve.now/CVE-2024-31492.md): An external control of file name or path vulnerability \[CWE-73\] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below install (CVSS 7.8, Fortinet FortiClientMac)
- [CVE-2024-20772](https://cve.now/CVE-2024-20772.md): Adobe Media Encoder 2024 AI file parsing Stack based buffer overflow (CVSS 7.8, Adobe Media Encoder)
- [CVE-2024-31924](https://cve.now/CVE-2024-31924.md): WordPress EWWW Image Optimizer plugin \<= 7.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, nosilver4u EWWW Image Optimizer)
- [CVE-2024-20766](https://cve.now/CVE-2024-20766.md): Adobe Indesign 2024 TIF File Parsing Out-Of-Bound Read Information Disclosure Vulnerabiity (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-20770](https://cve.now/CVE-2024-20770.md): Adobe Photoshop 2024 TIF File parsing Out-Of-Bound Read (CVSS 5.5, Adobe Photoshop Desktop)
- [CVE-2024-31309](https://cve.now/CVE-2024-31309.md): Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2024-20758](https://cve.now/CVE-2024-20758.md): Adobe Commerce | Improper Input Validation (CWE-20) (CVSS 9.0, Adobe Commerce · magento/community-edition +1)
- [CVE-2024-20759](https://cve.now/CVE-2024-20759.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.1, Adobe Commerce · magento/community-edition +1)
- [CVE-2024-26815](https://cve.now/CVE-2024-26815.md): net/sched: taprio: proper TCA\_TAPRIO\_TC\_ENTRY\_INDEX check (CVSS 7.8, Linux)
- [CVE-2023-2794](https://cve.now/CVE-2023-2794.md): Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode\_deliver() function (CVSS 8.1, ofono)
- [CVE-2024-2243](https://cve.now/CVE-2024-2243.md): Csmock: command injection vulnerability in csmock-plugin-snyk (CVSS 7.6, csmock)
- [CVE-2024-20737](https://cve.now/CVE-2024-20737.md): Adobe After Effect 2024 RGB File parsing Memory Corruption Vulnerability (CVSS 5.5, Adobe After Effects)
- [CVE-2024-26097](https://cve.now/CVE-2024-26097.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26087](https://cve.now/CVE-2024-26087.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-20779](https://cve.now/CVE-2024-20779.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-20780](https://cve.now/CVE-2024-20780.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26046](https://cve.now/CVE-2024-26046.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26084](https://cve.now/CVE-2024-26084.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26076](https://cve.now/CVE-2024-26076.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26122](https://cve.now/CVE-2024-26122.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26047](https://cve.now/CVE-2024-26047.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26079](https://cve.now/CVE-2024-26079.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-20778](https://cve.now/CVE-2024-20778.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26098](https://cve.now/CVE-2024-26098.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-1780](https://cve.now/CVE-2024-1780.md): BizCalendar Web \<= 1.1.0.25 - Reflected Cross-Site Scripting via 'tab' (CVSS 6.1, setriosoft BizCalendar Web)
- [CVE-2024-22448](https://cve.now/CVE-2024-22448.md): Dell BIOS contains an Out-of-Bounds Write vulnerability. (CVSS 4.7, Dell CPG BIOS)
- [CVE-2024-22450](https://cve.now/CVE-2024-22450.md): Dell Alienware Command Center, versions prior to 6.2.7.0, contain an uncontrolled search path element vulnerability. (CVSS 7.4, Dell Alienware Command Center)
- [CVE-2024-0159](https://cve.now/CVE-2024-0159.md): Dell Alienware Command Center, versions 5.5.52.0 and prior, contain improper access control vulnerability, leading to Denial of Service on l (CVSS 6.7, Dell Alienware Command Center)
- [CVE-2024-3542](https://cve.now/CVE-2024-3542.md): Campcodes Church Management System add\_visitor.php cross site scripting (CVSS 3.5, Campcodes Church Management System)
- [CVE-2024-3210](https://cve.now/CVE-2024-3210.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' (CVSS 6.4, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2024-2655](https://cve.now/CVE-2024-2655.md): Elementor Addons by Livemesh \<= 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2024-2539](https://cve.now/CVE-2024-2539.md): Elementor Addons by Livemesh \<= 8.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget \_id attribute (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2024-3541](https://cve.now/CVE-2024-3541.md): Campcodes Church Management System admin\_user.php cross site scripting (CVSS 3.5, Campcodes Church Management System)
- [CVE-2024-3540](https://cve.now/CVE-2024-3540.md): Campcodes Church Management System add\_sundaysch.php sql injection (CVSS 6.3, Campcodes Church Management System)
- [CVE-2024-3539](https://cve.now/CVE-2024-3539.md): Campcodes Church Management System addgiving.php sql injection (CVSS 6.3, Campcodes Church Management System)
- [CVE-2024-2428](https://cve.now/CVE-2024-2428.md): The Ultimate Video Player For WordPress \< 2.2.3 - Contributor+ Stored XSS (CVSS 4.7, The Ultimate Video Player For WordPress)
- [CVE-2023-6385](https://cve.now/CVE-2023-6385.md): WordPress Ping Optimizer \<= 2.35.1.3.0 - Log Clearing via CSRF (CVSS 4.3, WordPress Ping Optimizer)
- [CVE-2024-21507](https://cve.now/CVE-2024-21507.md): Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cac (CVSS 6.5, mysql2)
- [CVE-2024-21509](https://cve.now/CVE-2024-21509.md): Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user (CVSS 6.5, mysql2)
- [CVE-2024-3538](https://cve.now/CVE-2024-3538.md): Campcodes Church Management System addTithes.php sql injection (CVSS 6.3, Campcodes Church Management System)
- [CVE-2024-3020](https://cve.now/CVE-2024-3020.md): Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce \<= 2.6.3 - Authenticated (Admin+) PHP Object Injection (CVSS 7.2, shapedplugin Carousel, Slider, Photo Gallery with Lightbox,…)
- [CVE-2024-1042](https://cve.now/CVE-2024-1042.md): WP Radio – Worldwide Online Radio Stations Directory for WordPress \<= 3.1.9 - Missing Authorization via multiple AJAX actions (CVSS 6.4, princeahmed WP Radio – Worldwide Online Radio Stations Dire…)
- [CVE-2024-3235](https://cve.now/CVE-2024-3235.md): Essential Grid \<= 3.1.1 - Unauthenticated Private Post Disclosure (CVSS 5.3, ThemePunch Essential Grid Gallery WordPress Plugin)
- [CVE-2024-2736](https://cve.now/CVE-2024-2736.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2024-2735](https://cve.now/CVE-2024-2735.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via "Price List" Element (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2024-2734](https://cve.now/CVE-2024-2734.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI Features (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2024-1041](https://cve.now/CVE-2024-1041.md): WP Radio – Worldwide Online Radio Stations Directory for WordPress \<= 3.1.9 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Settings (CVSS 6.4, princeahmed WP Radio – Worldwide Online Radio Stations Dire…)
- [CVE-2024-3537](https://cve.now/CVE-2024-3537.md): Campcodes Church Management System admin\_user.php sql injection (CVSS 6.3, Campcodes Church Management System)
- [CVE-2024-2733](https://cve.now/CVE-2024-2733.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Element (CVSS 5.4, boldthemes Bold Page Builder)
- [CVE-2024-2666](https://cve.now/CVE-2024-2666.md): Premium Addons for Elementor \<= 4.10.24 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 5.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-3536](https://cve.now/CVE-2024-3536.md): Campcodes Church Management System delete\_log.php sql injection (CVSS 6.3, Campcodes Church Management System)
- [CVE-2024-2664](https://cve.now/CVE-2024-2664.md): Premium Addons for Elementor \<= 4.10.24 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-2665](https://cve.now/CVE-2024-2665.md): Premium Addons for Elementor \<= 4.10.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-3535](https://cve.now/CVE-2024-3535.md): Campcodes Church Management System index.php sql injection (CVSS 7.3, Campcodes Church Management System)
- [CVE-2024-3534](https://cve.now/CVE-2024-3534.md): Campcodes Church Management System login.php sql injection (CVSS 7.3, Campcodes Church Management System)
- [CVE-2024-3533](https://cve.now/CVE-2024-3533.md): Campcodes Complete Online Student Management System academic\_year\_view.php cross site scripting (CVSS 3.5, Campcodes Complete Online Student Management System)
- [CVE-2024-3532](https://cve.now/CVE-2024-3532.md): Campcodes Complete Online Student Management System attendance\_view.php cross site scripting (CVSS 3.5, Campcodes Complete Online Student Management System)
- [CVE-2024-3531](https://cve.now/CVE-2024-3531.md): Campcodes Complete Online Student Management System courses\_view.php cross site scripting (CVSS 3.5, Campcodes Complete Online Student Management System)
- [CVE-2023-50347](https://cve.now/CVE-2023-50347.md): Insecure SQL Interface affects HCL DRYiCE MyXalytics (CVSS 3.7, HCL Software DRYiCE MyXalytics)
- [CVE-2023-6236](https://cve.now/CVE-2023-6236.md): Eap: oidc app attempting to access the second tenant, the user should be prompted to log (CVSS 7.3, Red Hat JBoss Enterprise Application Platform · org.wildfly…)
- [CVE-2024-3530](https://cve.now/CVE-2024-3530.md): Campcodes Complete Online Student Management System Marks\_view.php cross site scripting (CVSS 3.5, Campcodes Complete Online Student Management System)
- [CVE-2024-3529](https://cve.now/CVE-2024-3529.md): Campcodes Complete Online Student Management System students\_view.php cross site scripting (CVSS 3.5, Campcodes Complete Online Student Management System)
- [CVE-2024-3528](https://cve.now/CVE-2024-3528.md): Campcodes Complete Online Student Management System units\_view.php cross site scripting (CVSS 3.5, Campcodes Complete Online Student Management System)
- [CVE-2024-3526](https://cve.now/CVE-2024-3526.md): Campcodes Online Event Management System index.php cross site scripting (CVSS 3.5, Campcodes Online Event Management System)
- [CVE-2023-40148](https://cve.now/CVE-2023-40148.md): PingFederate Server Side Request Forgery vulnerability (CVSS 6.5, Ping Identity PingFederate)
- [CVE-2024-3525](https://cve.now/CVE-2024-3525.md): Campcodes Online Event Management System index.php cross site scripting (CVSS 3.5, Campcodes Online Event Management System)
- [CVE-2023-52070](https://cve.now/CVE-2023-52070.md): JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method. (CVSS 8.4)
- [CVE-2024-23076](https://cve.now/CVE-2024-23076.md): JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. (CVSS 7.5)
- [CVE-2024-23077](https://cve.now/CVE-2024-23077.md): JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java. (CVSS 7.5)
- [CVE-2024-23080](https://cve.now/CVE-2024-23080.md): Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). (CVSS 9.1)
- [CVE-2024-23083](https://cve.now/CVE-2024-23083.md): Time4J Base v5.9.3 was discovered to contain a NullPointerException via the component net.time4j.format.internal.FormatUtils::useDefaultWeek (CVSS 5.3)
- [CVE-2024-23734](https://cve.now/CVE-2024-23734.md): Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for Bit (CVSS 5.2)
- [CVE-2024-23735](https://cve.now/CVE-2024-23735.md): Cross Site Scripting (XSS) vulnerability in in the S/MIME certificate upload functionality of the User Profile pages in savignano S/Notify b (CVSS 6.1)
- [CVE-2024-26362](https://cve.now/CVE-2024-26362.md): HTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML co (CVSS 8.8)
- [CVE-2024-27474](https://cve.now/CVE-2024-27474.md): Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). (CVSS 8.8)
- [CVE-2024-27476](https://cve.now/CVE-2024-27476.md): Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. (CVSS 4.7)
- [CVE-2024-27477](https://cve.now/CVE-2024-27477.md): In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers (CVSS 6.1)
- [CVE-2024-28344](https://cve.now/CVE-2024-28344.md): An Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. (CVSS 3.1)
- [CVE-2024-28345](https://cve.now/CVE-2024-28345.md): An issue discovered in Sipwise C5 NGCP Dashboard below mr11.5.1 allows a low privileged user to access the Journal endpoint by directly visi (CVSS 5.5)
- [CVE-2024-29269](https://cve.now/CVE-2024-29269.md): An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter. (CVSS 8.8)
- [CVE-2024-29296](https://cve.now/CVE-2024-29296.md): A user enumeration vulnerability was found in Portainer CE 2.19.4. (CVSS 5.3, github.com/portainer/portainer)
- [CVE-2024-29460](https://cve.now/CVE-2024-29460.md): An issue in PX4 Autopilot v.1.14.0 allows an attacker to manipulate the flight path allowing for crashes of the drone via the home point loc (CVSS 6.6)
- [CVE-2024-29500](https://cve.now/CVE-2024-29500.md): An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a C (CVSS 9.8)
- [CVE-2024-29502](https://cve.now/CVE-2024-29502.md): An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths. (CVSS 6.5)
- [CVE-2024-29504](https://cve.now/CVE-2024-29504.md): Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payloa (CVSS 7.6, summernote)
- [CVE-2024-31819](https://cve.now/CVE-2024-31819.md): An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the sub (CVSS 9.8, wwbn/avideo)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.