CVEs published April 12, 2024
128 CVEs were published on April 12, 2024: 6 critical, 32 high. 1 is now in CISA KEV.
- Published
- 128
- Critical
- 6
- High
- 32
- Medium
- 86
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 47
Most affected products
- Juniper Networks Junos OS
- 23
- GitLab
- 4
- IBM UrbanCode Deploy · IBM DevOps Deploy
- 4
- Juniper Networks Junos OS Evolved
- 4
- OpenGnsys
- 4
- Campcodes House Rental Management System
- 3
- IBM Sterling B2B Integrator
- 3
- IOSiX IO-1020 Micro ELD
- 3
- DedeCMS
- 2
- PHPGurukul Small CRM
- 2
Critical 6
- CVE-2024-28878IOSIX IO-1020 Micro ELD Download of Code Without Integrity CheckIOSiX IO-1020 Micro ELD
- CVE-2024-3704SQL Injection vulnerability in OpenGnsysOpenGnsys
- CVE-2023-51409WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerabilityJordy Meow AI Engine: ChatGPT Chatbot
- CVE-2024-3400PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2024-28718An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py.magnum
- CVE-2024-31818Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.p
High 32
- CVE-2024-28869Possible denial of service vulnerability with Content-length header in Traefiktraefik · github.com/traefik/traefik +2
- CVE-2024-29022Session Hijacking via XSS attack in header and session grid in Xibo CMSxibosignage xibo-cms
- CVE-2024-29023Session Hijacking via token exposure on the session page in Xibo CMSxibosignage xibo-cms
- CVE-2024-32005Local File Inclusion in NiceGUI leaflet componentzauberzeug nicegui · nicegui
- CVE-2024-32019ndsudo: local privilege escalation via untrusted search pathnetdata
- CVE-2024-32003Dusk plugin may allow unfettered user authentication in misconfigured installswintercms wn-dusk-plugin · winter/wn-dusk-plugin
- CVE-2024-3691PHPGurukul Small CRM Registration Page sql injectionPHPGurukul Small CRM
- CVE-2024-30398Junos OS: SRX4600 Series - A high amount of specific traffic causes packet drops and an eventual PFE crashJuniper Networks Junos OS
- CVE-2024-30397Junos OS: An invalid certificate causes a Denial of Service in the Internet Key Exchange (IKE) processJuniper Networks Junos OS
- CVE-2024-30382Junos OS and Junos OS Evolved: RPD crash when CoS-based forwarding (CBF) policy is configuredJuniper Networks Junos OS
- CVE-2024-31069IOSIX IO-1020 Micro ELD Use of Default CredentialsIOSiX IO-1020 Micro ELD
- CVE-2024-30210IOSIX IO-1020 Micro ELD Use of Default CredentialsIOSiX IO-1020 Micro ELD
- CVE-2024-30392Junos OS: MX Series with SPC3 and MS-MPC/-MIC: When URL filtering is enabled and a specific URL request is received a flowd crash occursJuniper Networks Junos OS
- CVE-2024-30394Junos OS and Junos OS Evolved: A specific EVPN type-5 route causes rpd crashJuniper Networks Junos OS
- CVE-2024-30395Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crashJuniper Networks Junos OS
- CVE-2024-30405Junos OS: SRX 5000 Series with SPC2: Processing of specific crafted packets when ALG is enabled causes a transit traffic Denial of ServiceJuniper Networks Junos OS
- CVE-2024-30407[Child CVE] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacksJuniper Networks cRPD · Juniper Networks Juniper Cloud Nati…
- CVE-2024-30381Paragon Active Assurance: probe_serviced exposes internal objects to local usersJuniper Networks Paragon Active Assurance
- CVE-2024-21598Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crashJuniper Networks Junos OS
- CVE-2023-51515WordPress Uncode Core plugin <= 2.8.8 - Privilege Escalation vulnerabilityUndsgn Uncode Core
- CVE-2024-3705Unrestricted Upload of File with Dangerous Type vulnerability in OpenGnsysOpenGnsys
- CVE-2024-3054WPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR Deserializationwpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2024-3211Shopping Cart & eCommerce Store <= 5.6.3 - Authenticated (Contributor+) SQL Injectionlevelfourstorefront Shopping Cart & eCommerce Store
- CVE-2024-27309Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft modeApache Software Foundation Apache Kafka · org.apache.kafka:…
- CVE-2024-2279Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-3092Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2020-8006The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time
- CVE-2023-44852Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafte
- CVE-2023-44857An issue in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_21D24 functi
- CVE-2023-49528Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of
- CVE-2024-25545An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework compo
- CVE-2024-29400An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter.
Medium, low and unrated 90
- CVE-2024-32028Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCoreopen-telemetry opentelemetry-dotnet · OpenTelemetry.Inst… +1
- CVE-2024-31462Limited file write in Stable-diffusion-webui - GHSL-2024-010AUTOMATIC1111 stable-diffusion-webui
- CVE-2024-32000Truncated content of messages can be leaked from matrix-appservice-ircmatrix-org matrix-appservice-irc · matrix-appservice-irc
- CVE-2024-3698Campcodes House Rental Management System manage_payment.php sql injectionCampcodes House Rental Management System
- CVE-2024-0157Dell Storage Resource Manager, 4.9.0.0 and below, contain(s) a Session Fixation Vulnerability in SRM Windows Host Agent.Dell Storage Resource Manager
- CVE-2024-22358IBM UrbanCode Deploy session fixationIBM UrbanCode Deploy · IBM DevOps Deploy
- CVE-2024-22339IBM UrbanCode Deploy information disclosureIBM UrbanCode Deploy · IBM DevOps Deploy
- CVE-2024-22334IBM UrbanCode Deploy improper privilege controlIBM UrbanCode Deploy · IBM DevOps Deploy
- CVE-2024-3697Campcodes House Rental Management System manage_tenant.php sql injectionCampcodes House Rental Management System
- CVE-2024-22359IBM UrbanCode Deploy cross-site scriptingIBM UrbanCode Deploy · IBM DevOps Deploy
- CVE-2024-3696Campcodes House Rental Management System view_payment.php sql injectionCampcodes House Rental Management System
- CVE-2024-3695SourceCodester Computer Laboratory Management System Users.php cross site scriptingSourceCodester Computer Laboratory Management System
- CVE-2024-30403Junos OS Evolved: When MAC learning happens, and an interface gets flapped, the PFE crashesJuniper Networks Junos OS Evolved
- CVE-2024-30402Junos OS and Junos OS Evolved: The l2ald crashes on receiving telemetry messages from a specific subscriptionJuniper Networks Junos OS
- CVE-2024-30401Junos OS: MX Series and EX9200-15C: Stack-based buffer overflow in aftmanJuniper Networks Junos OS
- CVE-2024-30391Junos OS: MX Series with SPC3, and SRX Series: When IPsec authentication is configured with "hmac-sha-384" and "hmac-sha-512" no authentication of traffic is performedJuniper Networks Junos OS
- CVE-2024-30390Junos OS Evolved: Connection limits is not being enforced while the resp. rate limit is being enforcedJuniper Networks Junos OS Evolved
- CVE-2024-30389Junos OS: EX4300 Series: Firewall filter not blocking egress trafficJuniper Networks Junos OS
- CVE-2024-30386Junos OS and Junos OS Evolved: In a EVPN-VXLAN scenario state changes on adjacent systems can cause an l2ald process crashJuniper Networks Junos OS
- CVE-2024-30384Junos OS: EX4300 Series: If a specific CLI command is issued PFE crashes will occurJuniper Networks Junos OS
- CVE-2024-30387Junos OS: ACX5448 & ACX710: Due to interface flaps the PFE process can crashJuniper Networks Junos OS
- CVE-2024-30388Junos OS: QFX5000 Series and EX Series: Specific malformed LACP packets will cause flapsJuniper Networks Junos OS
- CVE-2024-30406Junos OS Evolved: ACX Series with Paragon Active Assurance Test Agent: A local high privileged attacker can recover other administrators credentialsJuniper Networks Junos OS Evolved
- CVE-2024-30409Junos OS and Junos OS Evolved: Higher CPU consumption on routing engine leads to Denial of Service (DoS).Juniper Networks Junos OS
- CVE-2024-30410Junos OS: EX4300 Series: Loopback filter not blocking traffic despite having discard term.Juniper Networks Junos
- CVE-2024-31391Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentialsApache Software Foundation Apache Solr Operator · github.co…
- CVE-2024-3690PHPGurukul Small CRM Change Password sql injectionPHPGurukul Small CRM
- CVE-2024-21618Junos OS and Junos OS Evolved: When LLDP is enabled and a malformed LLDP packet is received, l2cpd crashesJuniper Networks Junos OS
- CVE-2024-21615Junos OS and Junos OS Evolved: A low-privileged user can access confidential informationJuniper Networks Junos OS
- CVE-2024-21610Junos OS: If in a scaled CoS scenario information on CoS state is gathered mgd processes get stuckJuniper Networks Junos OS
- CVE-2024-21609Junos OS: MX Series with SPC3, and SRX Series: If specific IPsec parameters are negotiated iked will crash due to a memory leakJuniper Networks Junos OS
- CVE-2024-21605Junos OS: SRX 300 Series: Specific link local traffic causes a control plane overloadJuniper Networks Junos OS
- CVE-2024-21593Junos OS: MX Series with MPC10, MPC11, LC9600, and MX304: A specific MPLS packet will cause a PFE crashJuniper Networks Junos OS
- CVE-2024-21590Junos OS Evolved: Packets which are not destined to the device can reach the REJuniper Networks Junos OS Evolved
- CVE-2023-51499WordPress WooCommerce Shipping Per Product plugin <= 2.5.4 - Broken Access Control vulnerabilityWooCommerce Shipping Per Product
- CVE-2023-52211WordPress WP Job Manager plugin <= 2.0.0 - Broken Access Control vulnerabilityAutomattic WP Job Manager
- CVE-2024-3689Zhejiang Land Zongheng Network Technology O2OA information disclosureZhejiang Land Zongheng Network Technology O2OA
- CVE-2024-3688Xiamen Four-Faith RMP Router Management Platform sql injectionXiamen Four-Faith RMP Router Management Platform
- CVE-2024-3687bihell Dice Comment cross site scriptingbihell Dice
- CVE-2024-3707Exposure of Information Through Directory Listing vulnerability in OpenGnsysOpenGnsys
- CVE-2024-3706Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenGnsysOpenGnsys
- CVE-2024-3686DedeCMS update_guide.php path traversalDedeCMS
- CVE-2024-2397infinite loop in the PPP printer of tcpdumpThe Tcpdump Group tcpdump
- CVE-2022-40211WordPress GiveWP plugin <= 2.25.1 - Cross Site Scripting (XSS) via render_dropdown vulnerabilityGiveWP
- CVE-2024-31235WordPress Comments Import & Export plugin <= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerabilityWebToffee WordPress Comments Import & Export
- CVE-2024-31238WordPress Smart Online Order for Clover plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerabilityZaytech Smart Online Order for Clover
- CVE-2024-3685DedeCMS stepselect_main.php sql injectionDedeCMS
- CVE-2024-31239WordPress Nudgify Social Proof, Sales Popup & FOMO plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerabilityNudgify Social Proof, Sales Popup & FOMO
- CVE-2024-31250WordPress WP Server Health Stats plugin <= 1.7.3 - Cross Site Request Forgery (CSRF) vulnerabilitySaumya Majumder WP Server Health Stats
- CVE-2024-31251WordPress Community by PeepSo plugin <= 6.3.1.1 - Cross Site Request Forgery (CSRF) vulnerabilityCommunity by PeepSo
- CVE-2024-31262WordPress WooCommerce Checkout Field Editor (Checkout Manager) plugin <= 2.1.8 - Cross Site Request Forgery (CSRF) vulnerabilityJcodex WooCommerce Checkout Field Editor
- CVE-2024-31263WordPress Loan Repayment Calculator and Application Form plugin <= 2.9.4 - Cross Site Request Forgery (CSRF) vulnerabilityaerin Loan Repayment Calculator and Application Form
- CVE-2024-31264WordPress Post Views Counter plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) vulnerabilitydFactory Post Views Counter
- CVE-2024-31265WordPress Sumo plugin <= 1.34 - Cross Site Request Forgery (CSRF) vulnerabilitySumoMe Sumo
- CVE-2024-31268WordPress AppPresser plugin <= 4.3.0 - Cross Site Request Forgery (CSRF) vulnerabilityAppPresser Team AppPresser
- CVE-2024-31269WordPress Easy Google Maps plugin <= 1.11.11 - Cross Site Request Forgery (CSRF) vulnerabilitySupsystic Easy Google Maps
- CVE-2024-31271WordPress Ultimate Maps plugin <= 1.2.16 - Cross Site Request Forgery vulnerabilityUltimate Maps by Supsystic
- CVE-2024-31272WordPress ARForms Form Builder plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerabilityRepute InfoSystems ARForms Form Builder
- CVE-2024-31279WordPress Generate Child Theme plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerabilityCatch Plugins Generate Child Theme
- CVE-2024-31289WordPress Hello Elementor theme <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityHello Elementor
- CVE-2024-31293WordPress Easy Digital Downloads plugin <= 3.2.6 - Cross Site Request Forgery (CSRF) vulnerabilityEasy Digital Downloads
- CVE-2024-31301WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.0 - Cross Site Request Forgery (CSRF) vulnerabilityThemeisle Multiple Page Generator Plugin – MPG
- CVE-2024-31303WordPress Sign-up Sheets plugin <= 2.2.11.1 - Cross Site Request Forgery (CSRF) vulnerabilityFetch Designs Sign-up Sheets
- CVE-2024-31305WordPress Transcoder plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerabilityrtCamp Transcoder
- CVE-2024-31354WordPress Slideshow Gallery LITE plugin <= 1.7.8 - Cross Site Request Forgery (CSRF) vulnerabilityTribulant Slideshow Gallery
- CVE-2024-31360WordPress Benchmark Email Lite plugin <= 4.1 - Cross Site Request Forgery (CSRF) vulnerabilityCoded Commerce Benchmark Email Lite
- CVE-2024-31362WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerabilityMetagauss ProfileGrid
- CVE-2024-31363WordPress LifterLMS plugin <= 7.5.0 - Cross Site Request Forgery (CSRF) vulnerabilityLifterLMS
- CVE-2024-31364WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts
- CVE-2023-47714IBM Sterling File Gateway cross-site scriptingIBM Sterling File Gateway
- CVE-2024-27261IBM Storage Defender - Resiliency Service privilege escalationIBM Storage Defender
- CVE-2024-31371WordPress WP Event Aggregator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) vulnerabilityXylus Themes WP Event Aggregator
- CVE-2024-31372WordPress No-Bot Registration plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerabilityArnan de Gans No-Bot Registration
- CVE-2023-45186IBM Sterling B2B Integrator cross-site scriptingIBM Sterling B2B Integrator
- CVE-2024-2801Shopkeeper Extender <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scriptinggetbowtied Shopkeeper Extender
- CVE-2024-2137All-in-One Addons for Elementor – WidgetKit <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Widgetsshamsbd71 All-in-One Addons for Elementor – WidgetKit
- CVE-2023-50307IBM Sterling B2B Integrator cross-site scriptingIBM Sterling B2B Integrator
- CVE-2024-22357IBM Sterling B2B Integrator cross-site scriptingIBM Sterling B2B Integrator
- CVE-2023-6489Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2023-6678Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2023-44853\An issue was discovered in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the
- CVE-2023-44854Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafte
- CVE-2023-44855Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019 allows a remote attacker to execute arbitrary code via a crafted
- CVE-2023-44856Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafte
- CVE-2024-22526Buffer Overflow vulnerability in bandisoft bandiview v7.0, allows local attackers to cause a denial of service (DoS) via exr image file.
- CVE-2024-22734An issue was discovered in AMCS Group Trux Waste Management Software before version 7.19.0018.26912, allows local attackers to obtain sensit
- CVE-2024-29461An issue in Floodlight SDN OpenFlow Controller v.1.2 allows a remote attacker to cause a denial of service via the datapath id component.
- CVE-2024-30614An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope.
- CVE-2024-30845Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the va
- CVE-2024-31839Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandlergithub.com/tiagorlampert/CHAOS