CVEs published April 11, 2024
80 CVEs were published on April 11, 2024: 3 critical, 19 high.
- Published
- 80
- Critical
- 3
- High
- 19
- Medium
- 55
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- SourceCodester Kortex Lite Advocate Office Management System
- 5
- Adobe Animate
- 4
- Adobe Illustrator
- 4
- Saturday Drive Ninja Forms
- 3
- SourceCodester Warehouse Management System
- 3
- Honeywell Experion Server
- 2
- themeisle Otter Blocks – Gutenberg Blocks, Page Builder for…
- 2
- Adobe Bridge
- 1
- Alex Tselegidis Easy!Appointments
- 1
- Aminur Islam WP Login and Logout Redirect
- 1
Critical 3
- CVE-2024-21508Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validmysql2
- CVE-2024-22718Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client_id parameter in the appli
- CVE-2024-31678Sourcecodester Loan Management System v1.0 is vulnerable to SQL Injection via the "password" parameter in the "login.php" file.
High 19
- CVE-2023-5394Server receiving a malformed message that where the GCL message hostname may be too large which may cause a stack overflow; resulting in posHoneywell Experion Server
- CVE-2023-5393Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code eHoneywell Experion Server
- CVE-2023-5392C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function.Honeywell C300
- CVE-2024-30271Adobe Illustrator 2023 CC 27.7 Memory Corruption Out-Of-Bounds-Write Vulnerability III.Adobe Illustrator
- CVE-2024-30272Adobe Illustrator 2024 GIF file parsing Out-Of-Bound Write remote code execution vulnerabiityAdobe Illustrator
- CVE-2024-30273Adobe Illustrator 2024 PS file Parsing Stack based Buffer Overflow Remote Code Execution VulnerabilityAdobe Illustrator
- CVE-2024-31285WordPress WordPress Tooltips plugin <= 9.5.3 - Cross Site Request Forgery (CSRF) vulnerabilityWordPress Tooltips
- CVE-2024-20797Out-of-bounds access vulnerability in Adobe Animate that directly changes the rip when parsing FLA files.Adobe Animate
- CVE-2024-20795Animate has an arbitrary code execution vulnerability when parsing svg filesAdobe Animate
- CVE-2024-25572Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31.Saturday Drive Ninja Forms
- CVE-2023-6811Language Translate Widget for WordPress – ConveyThis <= 223 - Unauthenticated Stored Cross-Site Scripting via api_keyTranslate WordPress Websites Globally with ConveyThis Trans…
- CVE-2023-29483eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending dnspython · eventlet
- CVE-2024-22719SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client
- CVE-2024-22722Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field
- CVE-2024-25376An issue discovered in Thesycon Software Solutions Gmbh & Co.
- CVE-2024-25852Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access contro
- CVE-2024-28458Null Pointer Dereference vulnerability in swfdump in swftools 0.9.2 allows attackers to crash the appliation via the function compileSWFActi
- CVE-2024-29399An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a cr
- CVE-2024-30884Reflected Cross-Site Scripting (XSS) vulnerability in Discuz! version X3.4 20220811, allows remote attackers to execute arbitrary code and o
Medium, low and unrated 58
- CVE-2023-50949IBM QRadar improper certificate validationIBM QRadar SIEM
- CVE-2024-0881Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts AccessPost Grid, Form Maker, Popup Maker, WooCommerce Blocks, Pos…
- CVE-2024-32105WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts
- CVE-2024-32106WordPress WP Compress plugin <= 6.10.35 - Cross Site Request Forgery (CSRF) vulnerabilityWP Compress – Image Optimizer [All-In-One]
- CVE-2024-32107WordPress Finale Lite plugin <= 2.18.0 - Cross Site Request Forgery (CSRF) vulnerabilityXLPlugins Finale Lite
- CVE-2024-32108WordPress Convert Post Types plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilityStephanie Leary Convert Post Types
- CVE-2024-32109WordPress WP Matterport Shortcode plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) vulnerabilityJulien Berthelot / MPEmbed.com WP Matterport Shortcode
- CVE-2024-32083WordPress Easy Logo plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerabilityVarun Kumar Easy Logo
- CVE-2024-31361WordPress bunny.net plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilitybunny.net
- CVE-2024-31387WordPress Popup Likebox plugin <= 3.7.2 - Cross-Site Scripting (XSS) vulnerabilityPopup LikeBox Team Popup Like box
- CVE-2024-31925WordPress F4 Improvements plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerabilityFAKTOR VIER F4 Improvements
- CVE-2024-31926WordPress Advanced Cron Manager – debug & control plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerabilityBracketSpace Advanced Cron Manager – debug & control
- CVE-2024-31927WordPress WP Login and Logout Redirect plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityAminur Islam WP Login and Logout Redirect
- CVE-2024-31928WordPress Top Bar plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilityWP Darko Top Bar
- CVE-2024-31929WordPress Intagrate Lite plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityIain Poulson Intagrate Lite
- CVE-2024-31930WordPress Save as PDF by Pdfcrowd plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilitySave as PDF plugin by Pdfcrowd
- CVE-2024-31931WordPress Save as Image plugin by Pdfcrowd plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilitySave as Image plugin by Pdfcrowd
- CVE-2024-31932WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerabilityCreativeThemes Blocksy Companion
- CVE-2024-31934WordPress Link Whisper Free plugin <= 0.6.9 - Cross Site Request Forgery (CSRF) vulnerabilityLink Whisper Free
- CVE-2024-31935WordPress Simple Post Notes plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) vulnerabilityBracketSpace Simple Post Notes
- CVE-2024-31936WordPress UsersWP plugin < 1.2.6 - Cross Site Request Forgery (CSRF) vulnerabilityAyeCode UsersWP
- CVE-2024-31937WordPress TWIPLA (Visitor Analytics IO) plugin <= 1.2.0 - Cross-Site Scripting (XSS) vulnerabilityTWIPLA
- CVE-2024-32112WordPress Leadinfo plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerabilityLeadinfo
- CVE-2023-32295WordPress Easy!Appointments plugin <= 1.3.3 - Arbitrary File Deletion vulnerabilityAlex Tselegidis Easy!Appointments
- CVE-2024-3344Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Author+) Limited File Upload to Stored Cross-Site Scriptingthemeisle Otter Blocks – Gutenberg Blocks, Page Builder for…
- CVE-2024-3343Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributesthemeisle Otter Blocks – Gutenberg Blocks, Page Builder for…
- CVE-2024-20794Adobe Animate 2024 WAV File Parsing Null Pointer DereferenceAdobe Animate
- CVE-2024-20796Adobe Animation SWF File Parsing Memory CorruptionAdobe Animate
- CVE-2023-32228A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last Bosch AMS · Bosch BIS
- CVE-2024-32080WordPress Search Keyword Redirect plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityNick Pelton Search Keyword Redirect
- CVE-2024-20798Illustrator 2024 CDR File parsing Out of Bound Read Information disclosure vulnerabilityAdobe Illustrator
- CVE-2024-20771Bridge 2024 MOV File parsing memory corruptionAdobe Bridge
- CVE-2024-2966Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.5.6 - Sensitive Information Exposure via element_pack_ajax_searchbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-3285Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows <= 3.70.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via metaslider ShortcodeSlider, Gallery, and Carousel by MetaSlider – Image Slider,…
- CVE-2023-6257Inline Related Posts < 3.6.0 - Subscriber+ Password Protected Post ReadInline Related Posts
- CVE-2024-3621SourceCodester Kortex Lite Advocate Office Management System register_case.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-3620SourceCodester Kortex Lite Advocate Office Management System adds.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-3619SourceCodester Kortex Lite Advocate Office Management System addcase_stage.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-3618SourceCodester Kortex Lite Advocate Office Management System activate_case.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-26019Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing.Saturday Drive Ninja Forms
- CVE-2024-29220Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels.Saturday Drive Ninja Forms
- CVE-2024-3617SourceCodester Kortex Lite Advocate Office Management System deactivate_case.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-3652IKEv1 default AH/ESP responder can cause libreswan to abort and restartThe Libreswan Project (www.libreswan.org) libreswan
- CVE-2024-3616SourceCodester Warehouse Management System pengguna.php cross site scriptingSourceCodester Warehouse Management System
- CVE-2024-3614SourceCodester Warehouse Management System customer.php cross site scriptingSourceCodester Warehouse Management System
- CVE-2024-3613SourceCodester Warehouse Management System supplier.php cross site scriptingSourceCodester Warehouse Management System
- CVE-2023-48865An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL.reportico-web/reportico
- CVE-2024-22717Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the First Name field in the applicat
- CVE-2024-22721Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link.
- CVE-2024-27592Open Redirect vulnerability in Corezoid Process Engine v6.5.0 allows attackers to redirect to arbitrary websites via appending a crafted lin
- CVE-2024-30878A cross-site scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtai
- CVE-2024-30879Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML a
- CVE-2024-30880Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML a
- CVE-2024-30883Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML a
- CVE-2024-30885Reflected Cross-Site Scripting (XSS) vulnerability in HadSky v7.6.3, allows remote attackers to execute arbitrary code and obtain sensitive
- CVE-2024-30915An issue was discovered in OpenDDS commit b1c534032bb62ad4ae32609778de6b8d6c823a66, allows a local attacker to cause a denial of service and
- CVE-2024-30916An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensi
- CVE-2024-30917An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensi