# CVEs published 2024-04-11

80 CVEs were published on April 11, 2024: 3 critical, 19 high. Days are UTC.

- [CVE-2023-5394](https://cve.now/CVE-2023-5394.md): Server receiving a malformed message that where the GCL message hostname may be too large which may cause a stack overflow; resulting in pos (CVSS 7.4, Honeywell Experion Server)
- [CVE-2023-5393](https://cve.now/CVE-2023-5393.md): Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code e (CVSS 7.4, Honeywell Experion Server)
- [CVE-2023-5392](https://cve.now/CVE-2023-5392.md): C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. (CVSS 7.5, Honeywell C300)
- [CVE-2024-30271](https://cve.now/CVE-2024-30271.md): Adobe Illustrator 2023 CC 27.7 Memory Corruption Out-Of-Bounds-Write Vulnerability III. (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-30272](https://cve.now/CVE-2024-30272.md): Adobe Illustrator 2024 GIF file parsing Out-Of-Bound Write remote code execution vulnerabiity (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-30273](https://cve.now/CVE-2024-30273.md): Adobe Illustrator 2024 PS file Parsing Stack based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2023-50949](https://cve.now/CVE-2023-50949.md): IBM QRadar improper certificate validation (CVSS 5.9, IBM QRadar SIEM)
- [CVE-2024-0881](https://cve.now/CVE-2024-0881.md): Combo Blocks \< 2.2.76 - Unauthenticated Password Protected Posts Access (CVSS 5.4, Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Pos…)
- [CVE-2024-32105](https://cve.now/CVE-2024-32105.md): WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin \<= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts)
- [CVE-2024-32106](https://cve.now/CVE-2024-32106.md): WordPress WP Compress plugin \<= 6.10.35 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WP Compress – Image Optimizer \[All-In-One\])
- [CVE-2024-32107](https://cve.now/CVE-2024-32107.md): WordPress Finale Lite plugin \<= 2.18.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, XLPlugins Finale Lite)
- [CVE-2024-32108](https://cve.now/CVE-2024-32108.md): WordPress Convert Post Types plugin \<= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Stephanie Leary Convert Post Types)
- [CVE-2024-32109](https://cve.now/CVE-2024-32109.md): WordPress WP Matterport Shortcode plugin \<= 2.1.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Julien Berthelot / MPEmbed.com WP Matterport Shortcode)
- [CVE-2024-32083](https://cve.now/CVE-2024-32083.md): WordPress Easy Logo plugin \<= 1.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Varun Kumar Easy Logo)
- [CVE-2024-31361](https://cve.now/CVE-2024-31361.md): WordPress bunny.net plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, bunny.net)
- [CVE-2024-31387](https://cve.now/CVE-2024-31387.md): WordPress Popup Likebox plugin \<= 3.7.2 - Cross-Site Scripting (XSS) vulnerability (CVSS 5.9, Popup LikeBox Team Popup Like box)
- [CVE-2024-31925](https://cve.now/CVE-2024-31925.md): WordPress F4 Improvements plugin \<= 1.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, FAKTOR VIER F4 Improvements)
- [CVE-2024-31926](https://cve.now/CVE-2024-31926.md): WordPress Advanced Cron Manager – debug & control plugin \<= 2.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, BracketSpace Advanced Cron Manager – debug & control)
- [CVE-2024-31927](https://cve.now/CVE-2024-31927.md): WordPress WP Login and Logout Redirect plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Aminur Islam WP Login and Logout Redirect)
- [CVE-2024-31928](https://cve.now/CVE-2024-31928.md): WordPress Top Bar plugin \<= 3.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP Darko Top Bar)
- [CVE-2024-31929](https://cve.now/CVE-2024-31929.md): WordPress Intagrate Lite plugin \<= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Iain Poulson Intagrate Lite)
- [CVE-2024-31930](https://cve.now/CVE-2024-31930.md): WordPress Save as PDF by Pdfcrowd plugin \<= 3.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Save as PDF plugin by Pdfcrowd)
- [CVE-2024-31931](https://cve.now/CVE-2024-31931.md): WordPress Save as Image plugin by Pdfcrowd plugin \<= 3.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Save as Image plugin by Pdfcrowd)
- [CVE-2024-31932](https://cve.now/CVE-2024-31932.md): WordPress Blocksy Companion plugin \<= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, CreativeThemes Blocksy Companion)
- [CVE-2024-31934](https://cve.now/CVE-2024-31934.md): WordPress Link Whisper Free plugin \<= 0.6.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Link Whisper Free)
- [CVE-2024-31935](https://cve.now/CVE-2024-31935.md): WordPress Simple Post Notes plugin \<= 1.7.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, BracketSpace Simple Post Notes)
- [CVE-2024-31936](https://cve.now/CVE-2024-31936.md): WordPress UsersWP plugin \< 1.2.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, AyeCode UsersWP)
- [CVE-2024-31937](https://cve.now/CVE-2024-31937.md): WordPress TWIPLA (Visitor Analytics IO) plugin \<= 1.2.0 - Cross-Site Scripting (XSS) vulnerability (CVSS 5.9, TWIPLA)
- [CVE-2024-31285](https://cve.now/CVE-2024-31285.md): WordPress WordPress Tooltips plugin \<= 9.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, WordPress Tooltips)
- [CVE-2024-32112](https://cve.now/CVE-2024-32112.md): WordPress Leadinfo plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Leadinfo)
- [CVE-2023-32295](https://cve.now/CVE-2023-32295.md): WordPress Easy!Appointments plugin \<= 1.3.3 - Arbitrary File Deletion vulnerability (CVSS 6.3, Alex Tselegidis Easy!Appointments)
- [CVE-2024-3344](https://cve.now/CVE-2024-3344.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.8 - Authenticated (Author+) Limited File Upload to Stored Cross-Site Scripting (CVSS 6.4, themeisle Otter Blocks – Gutenberg Blocks, Page Builder for…)
- [CVE-2024-3343](https://cve.now/CVE-2024-3343.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (CVSS 6.4, themeisle Otter Blocks – Gutenberg Blocks, Page Builder for…)
- [CVE-2024-20797](https://cve.now/CVE-2024-20797.md): Out-of-bounds access vulnerability in Adobe Animate that directly changes the rip when parsing FLA files. (CVSS 7.8, Adobe Animate)
- [CVE-2024-20794](https://cve.now/CVE-2024-20794.md): Adobe Animate 2024 WAV File Parsing Null Pointer Dereference (CVSS 5.5, Adobe Animate)
- [CVE-2024-20796](https://cve.now/CVE-2024-20796.md): Adobe Animation SWF File Parsing Memory Corruption (CVSS 5.5, Adobe Animate)
- [CVE-2024-20795](https://cve.now/CVE-2024-20795.md): Animate has an arbitrary code execution vulnerability when parsing svg files (CVSS 7.8, Adobe Animate)
- [CVE-2023-32228](https://cve.now/CVE-2023-32228.md): A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last (CVSS 4.6, Bosch AMS · Bosch BIS)
- [CVE-2024-32080](https://cve.now/CVE-2024-32080.md): WordPress Search Keyword Redirect plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Nick Pelton Search Keyword Redirect)
- [CVE-2024-20798](https://cve.now/CVE-2024-20798.md): Illustrator 2024 CDR File parsing Out of Bound Read Information disclosure vulnerability (CVSS 5.5, Adobe Illustrator)
- [CVE-2024-20771](https://cve.now/CVE-2024-20771.md): Bridge 2024 MOV File parsing memory corruption (CVSS 5.5, Adobe Bridge)
- [CVE-2024-2966](https://cve.now/CVE-2024-2966.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.5.6 - Sensitive Information Exposure via element\_pack\_ajax\_search (CVSS 5.3, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-3285](https://cve.now/CVE-2024-3285.md): Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows \<= 3.70.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via metaslider Shortcode (CVSS 6.4, Slider, Gallery, and Carousel by MetaSlider – Image Slider,…)
- [CVE-2023-6257](https://cve.now/CVE-2023-6257.md): Inline Related Posts \< 3.6.0 - Subscriber+ Password Protected Post Read (CVSS 4.3, Inline Related Posts)
- [CVE-2024-21508](https://cve.now/CVE-2024-21508.md): Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper valid (CVSS 9.8, mysql2)
- [CVE-2024-3621](https://cve.now/CVE-2024-3621.md): SourceCodester Kortex Lite Advocate Office Management System register\_case.php sql injection (CVSS 4.7, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-3620](https://cve.now/CVE-2024-3620.md): SourceCodester Kortex Lite Advocate Office Management System adds.php sql injection (CVSS 4.7, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-3619](https://cve.now/CVE-2024-3619.md): SourceCodester Kortex Lite Advocate Office Management System addcase\_stage.php sql injection (CVSS 4.7, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-3618](https://cve.now/CVE-2024-3618.md): SourceCodester Kortex Lite Advocate Office Management System activate\_case.php sql injection (CVSS 4.7, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-25572](https://cve.now/CVE-2024-25572.md): Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. (CVSS 8.8, Saturday Drive Ninja Forms)
- [CVE-2024-26019](https://cve.now/CVE-2024-26019.md): Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. (CVSS 5.4, Saturday Drive Ninja Forms)
- [CVE-2024-29220](https://cve.now/CVE-2024-29220.md): Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. (CVSS 6.1, Saturday Drive Ninja Forms)
- [CVE-2024-3617](https://cve.now/CVE-2024-3617.md): SourceCodester Kortex Lite Advocate Office Management System deactivate\_case.php sql injection (CVSS 4.7, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2023-6811](https://cve.now/CVE-2023-6811.md): Language Translate Widget for WordPress – ConveyThis \<= 223 - Unauthenticated Stored Cross-Site Scripting via api\_key (CVSS 7.2, Translate WordPress Websites Globally with ConveyThis Trans…)
- [CVE-2024-3652](https://cve.now/CVE-2024-3652.md): IKEv1 default AH/ESP responder can cause libreswan to abort and restart (CVSS 6.5, The Libreswan Project (www.libreswan.org) libreswan)
- [CVE-2024-3616](https://cve.now/CVE-2024-3616.md): SourceCodester Warehouse Management System pengguna.php cross site scripting (CVSS 3.5, SourceCodester Warehouse Management System)
- [CVE-2024-3614](https://cve.now/CVE-2024-3614.md): SourceCodester Warehouse Management System customer.php cross site scripting (CVSS 3.5, SourceCodester Warehouse Management System)
- [CVE-2024-3613](https://cve.now/CVE-2024-3613.md): SourceCodester Warehouse Management System supplier.php cross site scripting (CVSS 3.5, SourceCodester Warehouse Management System)
- [CVE-2023-29483](https://cve.now/CVE-2023-29483.md): eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending (CVSS 7.0, dnspython · eventlet)
- [CVE-2023-48865](https://cve.now/CVE-2023-48865.md): An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute\_mode parameter of the URL. (CVSS 6.5, reportico-web/reportico)
- [CVE-2024-22717](https://cve.now/CVE-2024-22717.md): Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the First Name field in the applicat (CVSS 6.1)
- [CVE-2024-22718](https://cve.now/CVE-2024-22718.md): Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client\_id parameter in the appli (CVSS 9.6)
- [CVE-2024-22719](https://cve.now/CVE-2024-22719.md): SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client (CVSS 8.1)
- [CVE-2024-22721](https://cve.now/CVE-2024-22721.md): Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link. (CVSS 6.3)
- [CVE-2024-22722](https://cve.now/CVE-2024-22722.md): Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field (CVSS 7.2)
- [CVE-2024-25376](https://cve.now/CVE-2024-25376.md): An issue discovered in Thesycon Software Solutions Gmbh & Co. (CVSS 7.8)
- [CVE-2024-25852](https://cve.now/CVE-2024-25852.md): Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access contro (CVSS 8.8)
- [CVE-2024-27592](https://cve.now/CVE-2024-27592.md): Open Redirect vulnerability in Corezoid Process Engine v6.5.0 allows attackers to redirect to arbitrary websites via appending a crafted lin (CVSS 4.3)
- [CVE-2024-28458](https://cve.now/CVE-2024-28458.md): Null Pointer Dereference vulnerability in swfdump in swftools 0.9.2 allows attackers to crash the appliation via the function compileSWFActi (CVSS 7.5)
- [CVE-2024-29399](https://cve.now/CVE-2024-29399.md): An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a cr (CVSS 7.6)
- [CVE-2024-30878](https://cve.now/CVE-2024-30878.md): A cross-site scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtai (CVSS 6.1)
- [CVE-2024-30879](https://cve.now/CVE-2024-30879.md): Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML a (CVSS 6.1)
- [CVE-2024-30880](https://cve.now/CVE-2024-30880.md): Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML a (CVSS 5.4)
- [CVE-2024-30883](https://cve.now/CVE-2024-30883.md): Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML a (CVSS 4.7)
- [CVE-2024-30884](https://cve.now/CVE-2024-30884.md): Reflected Cross-Site Scripting (XSS) vulnerability in Discuz! version X3.4 20220811, allows remote attackers to execute arbitrary code and o (CVSS 7.1)
- [CVE-2024-30885](https://cve.now/CVE-2024-30885.md): Reflected Cross-Site Scripting (XSS) vulnerability in HadSky v7.6.3, allows remote attackers to execute arbitrary code and obtain sensitive (CVSS 6.1)
- [CVE-2024-30915](https://cve.now/CVE-2024-30915.md): An issue was discovered in OpenDDS commit b1c534032bb62ad4ae32609778de6b8d6c823a66, allows a local attacker to cause a denial of service and (CVSS 4.3)
- [CVE-2024-30916](https://cve.now/CVE-2024-30916.md): An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensi (CVSS 4.0)
- [CVE-2024-30917](https://cve.now/CVE-2024-30917.md): An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensi (CVSS 5.5)
- [CVE-2024-31678](https://cve.now/CVE-2024-31678.md): Sourcecodester Loan Management System v1.0 is vulnerable to SQL Injection via the "password" parameter in the "login.php" file. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.