# CVEs published 2024-04-15

219 CVEs were published on April 15, 2024: 11 critical, 51 high. Days are UTC.

- [CVE-2024-27794](https://cve.now/CVE-2024-27794.md): Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handled (CVSS 4.3, Claris FileMaker Server)
- [CVE-2024-2424](https://cve.now/CVE-2024-2424.md): Rockwell Automation Input/Output Device Vulnerable to Major Nonrecoverable Fault (CVSS 7.5, Rockwell Automation 5015-AENFTXT)
- [CVE-2024-3493](https://cve.now/CVE-2024-3493.md): Rockwell Automation ControlLogix and GaurdLogix Vulnerable to Major Nonrecoverable Fault Due to Invalid Header Value (CVSS 8.6, Rockwell Automation ControlLogix · Rockwell Automation G… +2)
- [CVE-2024-23558](https://cve.now/CVE-2024-23558.md): HCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logout (CVSS 6.3, HCL Software DevOps Deploy / Launch)
- [CVE-2024-23561](https://cve.now/CVE-2024-23561.md): HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability (CVSS 4.3, HCL Software DevOps Deploy / Launch)
- [CVE-2024-32036](https://cve.now/CVE-2024-32036.md): SixLabors.ImageSharp vulnerable to data leakage (CVSS 5.3, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2024-32035](https://cve.now/CVE-2024-32035.md): Memory Allocation with Excessive Size Value in SixLabors.ImageSharp (CVSS 5.3, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2024-31990](https://cve.now/CVE-2024-31990.md): Argo CD' API server does not enforce project sourceNamespaces (CVSS 4.8, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2024-3804](https://cve.now/CVE-2024-3804.md): Vesystem Cloud Desktop fileupload2.php unrestricted upload (CVSS 6.3, Vesystem Cloud Desktop)
- [CVE-2024-23560](https://cve.now/CVE-2024-23560.md): HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type (CVSS 4.4, HCL Software DevOps Deploy / Launch)
- [CVE-2024-3803](https://cve.now/CVE-2024-3803.md): Vesystem Cloud Desktop fileupload.php unrestricted upload (CVSS 6.3, Vesystem Cloud Desktop)
- [CVE-2024-23594](https://cve.now/CVE-2024-23594.md): A buffer overflow vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operati (CVSS 6.4, Lenovo Windows 7 and 8 PC Preloads)
- [CVE-2024-23593](https://cve.now/CVE-2024-23593.md): A vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from (CVSS 6.7, Lenovo Windows 7 and 8 PC Preloads)
- [CVE-2024-31219](https://cve.now/CVE-2024-31219.md): Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page (CVSS 4.3, discourse-reactions)
- [CVE-2024-2659](https://cve.now/CVE-2024-2659.md): A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to exe (CVSS 7.2, Lenovo SMM, SMM2, FPC)
- [CVE-2023-4857](https://cve.now/CVE-2023-4857.md): An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI ca (CVSS 7.5, Lenovo SMM, SMM2, FPC)
- [CVE-2023-4856](https://cve.now/CVE-2023-4856.md): A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a (CVSS 8.8, Lenovo SMM, SMM2, FPC)
- [CVE-2023-4855](https://cve.now/CVE-2023-4855.md): A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to exe (CVSS 7.2, Lenovo SMM, SMM2, FPC)
- [CVE-2023-48710](https://cve.now/CVE-2023-48710.md): iTop limit pages/exec.php script to PHP files (CVSS 9.8, Combodo iTop)
- [CVE-2023-48709](https://cve.now/CVE-2023-48709.md): iTop vulnerable to potential formula injection in Excel/CSV export file (CVSS 8.0, Combodo iTop)
- [CVE-2023-47626](https://cve.now/CVE-2023-47626.md): iTop vulnerable to XSS vulnerability in authent-token (CVSS 8.8, Combodo iTop)
- [CVE-2023-47622](https://cve.now/CVE-2023-47622.md): iTop vulnerable to XSS vulnerability in dashlet refresh (CVSS 8.8, Combodo iTop)
- [CVE-2023-47123](https://cve.now/CVE-2023-47123.md): iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget (CVSS 8.7, Combodo iTop)
- [CVE-2024-23559](https://cve.now/CVE-2024-23559.md): HCL DevOps Deploy / Launch is generating an obsolete HTTP header (CVSS 6.1, HCL Software DevOps Deploy / Launch)
- [CVE-2023-45808](https://cve.now/CVE-2023-45808.md): iTop missing silo check on extkey in console and portal (CVSS 4.1, Combodo iTop)
- [CVE-2023-44396](https://cve.now/CVE-2023-44396.md): iTop vulnerable to XSS in dashlet modifications ajax endpoints (CVSS 6.8, Combodo iTop)
- [CVE-2023-43790](https://cve.now/CVE-2023-43790.md): iTop vulnerable to XSS in friendlyname in object details (CVSS 5.7, Combodo iTop)
- [CVE-2023-38511](https://cve.now/CVE-2023-38511.md): iTop Dashboard editor vulnerable dashboard config file parameter (CVSS 5.0, Combodo iTop)
- [CVE-2024-3797](https://cve.now/CVE-2024-3797.md): SourceCodester QR Code Bookmark System sql injection (CVSS 6.3, SourceCodester QR Code Bookmark System)
- [CVE-2024-3796](https://cve.now/CVE-2024-3796.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3795](https://cve.now/CVE-2024-3795.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3794](https://cve.now/CVE-2024-3794.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3793](https://cve.now/CVE-2024-3793.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3792](https://cve.now/CVE-2024-3792.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3791](https://cve.now/CVE-2024-3791.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3790](https://cve.now/CVE-2024-3790.md): Cross-site Scripting vulnerability in WBSAirback (CVSS 4.8, WBSAirback White Bear Solutions)
- [CVE-2024-3789](https://cve.now/CVE-2024-3789.md): Uncontrolled Resource Consumption vulnerability in WBSAirback (CVSS 6.5, WBSAirback White Bear Solutions)
- [CVE-2024-3788](https://cve.now/CVE-2024-3788.md): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (CVSS 6.6, WBSAirback White Bear Solutions)
- [CVE-2024-3787](https://cve.now/CVE-2024-3787.md): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (CVSS 6.6, WBSAirback White Bear Solutions)
- [CVE-2024-3786](https://cve.now/CVE-2024-3786.md): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (CVSS 6.6, WBSAirback White Bear Solutions)
- [CVE-2024-3785](https://cve.now/CVE-2024-3785.md): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (CVSS 6.6, WBSAirback White Bear Solutions)
- [CVE-2024-3784](https://cve.now/CVE-2024-3784.md): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (CVSS 6.6, WBSAirback White Bear Solutions)
- [CVE-2024-3783](https://cve.now/CVE-2024-3783.md): Path Traversal vulnerability in WBSAirback (CVSS 7.7, WBSAirback White Bear Solutions)
- [CVE-2024-3782](https://cve.now/CVE-2024-3782.md): Cross-Site Request Forgery (CSRF) vulnerability in WBSAirback (CVSS 8.8, WBSAirback White Bear Solutions)
- [CVE-2024-3781](https://cve.now/CVE-2024-3781.md): OS Command Injection vulnerability in WBSAirback (CVSS 9.1, WBSAirback White Bear Solutions)
- [CVE-2024-24898](https://cve.now/CVE-2024-24898.md): Information Leakage in kernel (CVSS 6.0, openEuler kernel)
- [CVE-2024-24891](https://cve.now/CVE-2024-24891.md): Information Leakage in kernel (CVSS 6.0, openEuler kernel)
- [CVE-2024-3780](https://cve.now/CVE-2024-3780.md): Information exposure vulnerability on Technicolor CGA2121 (CVSS 7.8, Technicolor CGA2121)
- [CVE-2024-26023](https://cve.now/CVE-2024-26023.md): OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands. (CVSS 4.2, BUFFALO WCR-1166DS · BUFFALO WSR-1166DHP +5)
- [CVE-2024-23486](https://cve.now/CVE-2024-23486.md): Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker wi (CVSS 9.8, BUFFALO WSR-2533DHP · BUFFALO WSR-2533DHPL +2)
- [CVE-2024-28957](https://cve.now/CVE-2024-28957.md): Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series. (CVSS 5.3, DMG MORI Digital Co., LTD. and NEXT Co. Cente TCP/IPv4 · DM…)
- [CVE-2024-28894](https://cve.now/CVE-2024-28894.md): Out-of-bounds read vulnerability caused by improper checking of the option length values in IPv6 headers exists in Cente middleware TCP/IP N (CVSS 5.3, DMG MORI Digital Co., LTD. and NEXT Co. Cente IPv6)
- [CVE-2024-23911](https://cve.now/CVE-2024-23911.md): Out-of-bounds read vulnerability caused by improper checking of the option length values in IPv6 NDP packets exists in Cente middleware TCP/ (CVSS 7.5, DMG MORI Digital Co., LTD. and NEXT Co. Cente IPv6)
- [CVE-2024-30220](https://cve.now/CVE-2024-30220.md): Command injection vulnerability in PLANEX COMMUNICATIONS wireless LAN routers allows a network-adjacent unauthenticated attacker to execute (CVSS 8.8, PLANEX COMMUNICATIONS MZK-MF300N · PLANEX COMMUNICATIONS MZ…)
- [CVE-2024-30219](https://cve.now/CVE-2024-30219.md): Active debug code vulnerability exists in PLANEX COMMUNICATIONS wireless LAN routers. (CVSS 6.8, PLANEX COMMUNICATIONS MZK-MF300N · PLANEX COMMUNICATIONS MZ…)
- [CVE-2024-29219](https://cve.now/CVE-2024-29219.md): Out-of-bounds read vulnerability exists in KV STUDIO Ver.11.64 and earlier and KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver. (CVSS 7.8, KEYENCE KV STUDIO · KEYENCE KV REPLAY VIEWER +1)
- [CVE-2024-29218](https://cve.now/CVE-2024-29218.md): Out-of-bounds write vulnerability exists in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6. (CVSS 8.8, KEYENCE KV STUDIO · KEYENCE KV REPLAY VIEWER +1)
- [CVE-2024-32129](https://cve.now/CVE-2024-32129.md): WordPress Freshdesk (official) plugin \<= 2.3.6 - Open Redirection vulnerability (CVSS 4.7, Freshworks Freshdesk)
- [CVE-2024-28099](https://cve.now/CVE-2024-28099.md): VT STUDIO Ver.8.32 and earlier contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. (CVSS 7.8, KEYENCE VT STUDIO)
- [CVE-2024-30546](https://cve.now/CVE-2024-30546.md): WordPress Login With Ajax plugin \<= 4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Pixelite Login With Ajax)
- [CVE-2024-31373](https://cve.now/CVE-2024-31373.md): WordPress E2Pdf plugin \<= 1.20.27 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, e2pdf)
- [CVE-2024-31374](https://cve.now/CVE-2024-31374.md): WordPress AppPresser plugin \<= 4.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Scott Bolinger AppPresser)
- [CVE-2024-31376](https://cve.now/CVE-2024-31376.md): WordPress Dashboard To-Do List plugin \<= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Andrew Dashboard To-Do List)
- [CVE-2024-31378](https://cve.now/CVE-2024-31378.md): WordPress MailChimp Forms by MailMunch plugin \<= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, MailChimp Forms by MailMunch)
- [CVE-2024-31379](https://cve.now/CVE-2024-31379.md): WordPress Smash Balloon Social Post Feed plugin \<= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Smash Balloon Social Post Feed)
- [CVE-2024-31381](https://cve.now/CVE-2024-31381.md): WordPress Spotlight Social Feeds plugin \<= 1.6.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, RebelCode Spotlight Social Media Feeds)
- [CVE-2024-31382](https://cve.now/CVE-2024-31382.md): WordPress Blocksy theme \<= 2.0.22 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, creativethemeshq Blocksy)
- [CVE-2024-31383](https://cve.now/CVE-2024-31383.md): WordPress PopularFX theme \<= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Pagelayer PopularFX)
- [CVE-2024-31384](https://cve.now/CVE-2024-31384.md): WordPress Spa and Salon theme \<= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rara Theme Spa and Salon)
- [CVE-2024-31385](https://cve.now/CVE-2024-31385.md): WordPress ReDi Restaurant Reservation plugin \<= 24.0128 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Reservation Diary ReDi Restaurant Reservation)
- [CVE-2024-31388](https://cve.now/CVE-2024-31388.md): WordPress Tablesome plugin \<= 1.0.25 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Pauple Table & Contact Form 7 Database – Tablesome)
- [CVE-2024-31389](https://cve.now/CVE-2024-31389.md): WordPress MihanPanel plugin \< 12.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Ertano MihanPanel)
- [CVE-2024-31421](https://cve.now/CVE-2024-31421.md): WordPress Popup by Supsystic plugin \<= 1.10.27 - Broken Access Control vulnerability (CVSS 4.3, Popup by Supsystic)
- [CVE-2024-22439](https://cve.now/CVE-2024-22439.md): Certain HPE FlexNetwork and FlexFabric Switches, Remote Authentication Bypass (CVSS 6.9, Hewlett Packard Enterprise HPE FlexNetwork and FlexFabric p…)
- [CVE-2024-31422](https://cve.now/CVE-2024-31422.md): WordPress Favicon by RealFaviconGenerator plugin \<= 1.3.29 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Philippe Bernard Favicon)
- [CVE-2024-31424](https://cve.now/CVE-2024-31424.md): WordPress Login with Phone Number plugin \<= 1.6.93 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Hamid Alinia Login with phone number)
- [CVE-2024-31425](https://cve.now/CVE-2024-31425.md): WordPress Amelia plugin \<= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, TMS Amelia)
- [CVE-2024-31426](https://cve.now/CVE-2024-31426.md): WordPress Inline Related Posts plugin \<= 3.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Data443 Inline Related Posts)
- [CVE-2024-31427](https://cve.now/CVE-2024-31427.md): WordPress Marker.io plugin \<= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Marker.io)
- [CVE-2024-22438](https://cve.now/CVE-2024-22438.md): HPE OfficeConnect 1820 Network switches, Cross-Site Request Forgery (CSRF) (CVSS 3.5, Hewlett Packard Enterprise HPE OfficeConnect 1820 Network s…)
- [CVE-2024-31428](https://cve.now/CVE-2024-31428.md): WordPress The Conference theme \<= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rara Theme The Conference)
- [CVE-2024-31429](https://cve.now/CVE-2024-31429.md): WordPress Sarada Lite theme \<= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Blossom Themes Sarada Lite)
- [CVE-2024-31431](https://cve.now/CVE-2024-31431.md): WordPress Product Input Fields for WooCommerce plugin \<= 1.7.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tyche Softwares Product Input Fields for WooCommerce)
- [CVE-2024-31432](https://cve.now/CVE-2024-31432.md): WordPress Restrict Content plugin \<= 3.2.8 - Broken Access Control vulnerability (CVSS 5.3, StellarWP Restrict Content)
- [CVE-2024-31433](https://cve.now/CVE-2024-31433.md): WordPress The Events Calendar plugin \<= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, StellarWP The Events Calendar)
- [CVE-2024-31434](https://cve.now/CVE-2024-31434.md): WordPress Newsletter plugin \<= 8.0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Stefano Lissa & The Newsletter Team Newsletter)
- [CVE-2024-31920](https://cve.now/CVE-2024-31920.md): WordPress Currency per Product for WooCommerce plugin \<= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tyche Softwares Currency per Product for WooCommerce)
- [CVE-2024-31921](https://cve.now/CVE-2024-31921.md): WordPress Ultimate Product Catalog plugin \<= 5.2.15 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Etoile Web Design Ultimate Product Catalogue)
- [CVE-2024-31922](https://cve.now/CVE-2024-31922.md): WordPress Hosting Benchmark tool plugin \<= 1.3.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Anton Aleksandrov WordPress Hosting Benchmark tool)
- [CVE-2024-31923](https://cve.now/CVE-2024-31923.md): WordPress Feather Login Page plugin \<= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, PluginOps Feather Login Page)
- [CVE-2024-31933](https://cve.now/CVE-2024-31933.md): WordPress Page Builder: Live Composer plugin \<= 1.5.35 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Live Composer Team Page Builder: Live Composer)
- [CVE-2024-31938](https://cve.now/CVE-2024-31938.md): WordPress NewsXpress theme \<= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Themeinwp NewsXpress)
- [CVE-2024-22437](https://cve.now/CVE-2024-22437.md): HPE MSA SAN Storage VSS Provider and CAPI Proxy Software, Elevation of Privilege (CVSS 7.3, Hewlett Packard Enterprise HPE MSA SAN Storage VSS Provider…)
- [CVE-2024-31940](https://cve.now/CVE-2024-31940.md): WordPress Extra Product Options Builder for WooCommerce plugin \<= 1.2.104 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, RedNao Extra Product Options Builder for WooCommerce)
- [CVE-2024-31941](https://cve.now/CVE-2024-31941.md): WordPress CP Media Player plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, CodePeople CP Media Player)
- [CVE-2024-31942](https://cve.now/CVE-2024-31942.md): WordPress Calendarista Basic Edition plugin \<= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, typps Calendarista Basic Edition)
- [CVE-2024-32084](https://cve.now/CVE-2024-32084.md): WordPress Before And After plugin \<= 3.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Gold Plugins Before And After)
- [CVE-2024-32085](https://cve.now/CVE-2024-32085.md): WordPress Citadela Listing plugin \< 5.20.0 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, AitThemes Citadela Listing)
- [CVE-2024-32088](https://cve.now/CVE-2024-32088.md): WordPress Website Builder plugin \<= 6.15.20 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Coming Soon Page, Under Construction & Maintenance Mode by…)
- [CVE-2024-22435](https://cve.now/CVE-2024-22435.md): HPE NonStop Web ViewPoint Enterprise software, Unauthorized access (CVSS 8.3, Hewlett Packard Enterprise HPE NonStop Web ViewPoint Enterp…)
- [CVE-2024-32089](https://cve.now/CVE-2024-32089.md): WordPress Digital Publications by Supsystic plugin \<= 1.7.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Digital Publications by Supsystic)
- [CVE-2024-32090](https://cve.now/CVE-2024-32090.md): WordPress Church Admin plugin \<= 4.0.27 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, andy\_moyle Church Admin)
- [CVE-2024-32091](https://cve.now/CVE-2024-32091.md): WordPress Sangar Slider plugin \<= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, Tonjoo Sangar Slider)
- [CVE-2024-32092](https://cve.now/CVE-2024-32092.md): WordPress Kimili Flash Embed plugin \<= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Michael Bester Kimili Flash Embed)
- [CVE-2024-32093](https://cve.now/CVE-2024-32093.md): WordPress Novelist plugin \<= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Nose Graze Novelist)
- [CVE-2024-32094](https://cve.now/CVE-2024-32094.md): WordPress Church Content plugin \<= 2.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ChurchThemes Church Content – Sermons, Events and More)
- [CVE-2024-32095](https://cve.now/CVE-2024-32095.md): WordPress MultiParcels Shipping For WooCommerce plugin \< 1.16.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, MultiParcels Shipping For WooCommerce)
- [CVE-2024-32096](https://cve.now/CVE-2024-32096.md): WordPress WP Synchro plugin \<= 1.11.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, DAEV.tech WP Migration Plugin DB & Files – WP Synchro)
- [CVE-2024-32097](https://cve.now/CVE-2024-32097.md): WordPress GEO my WordPress plugin \<= 4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Eyal Fitoussi GEO my WordPress)
- [CVE-2024-32099](https://cve.now/CVE-2024-32099.md): WordPress WP Mail Catcher plugin \<= 2.1.6 - Cross Site Request Forgery vulnerability (CVSS 4.3, James Ward WP Mail Catcher)
- [CVE-2024-32101](https://cve.now/CVE-2024-32101.md): WordPress Email Marketing for WooCommerce plugin \<= 1.14.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Email Marketing for WooCommerce by Omnisend)
- [CVE-2024-32102](https://cve.now/CVE-2024-32102.md): WordPress Crony Cronjob Manager plugin \<= 0.5.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Scott Kingsley Clark Crony Cronjob Manager)
- [CVE-2024-32103](https://cve.now/CVE-2024-32103.md): WordPress Siteimprove plugin \<= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Siteimprove)
- [CVE-2024-32104](https://cve.now/CVE-2024-32104.md): WordPress NextMove Lite plugin \<= 2.18.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, XLPlugins NextMove Lite)
- [CVE-2024-32141](https://cve.now/CVE-2024-32141.md): WordPress Libsyn Publisher Hub plugin \<= 1.4.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Libsyn Publisher Hub)
- [CVE-2024-32433](https://cve.now/CVE-2024-32433.md): WordPress BEAF plugin \<= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Themefic BEAF)
- [CVE-2024-32434](https://cve.now/CVE-2024-32434.md): WordPress Order Delivery Date for WooCommerce plugin \<= 3.20.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tyche Softwares Order Delivery Date for WooCommerce)
- [CVE-2024-32435](https://cve.now/CVE-2024-32435.md): WordPress AffiEasy plugin \<= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, perrinalexandre05 AffiEasy)
- [CVE-2024-32436](https://cve.now/CVE-2024-32436.md): WordPress Gift Cards plugin \<= 4.4.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Codemenschen Gift Vouchers)
- [CVE-2024-32437](https://cve.now/CVE-2024-32437.md): WordPress eCommerce Product Catalog plugin \<= 3.3.28 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, impleCode eCommerce Product Catalog)
- [CVE-2024-32438](https://cve.now/CVE-2024-32438.md): WordPress SEO Booster plugin \<= 3.8.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, cleverplugins.com SEO Booster)
- [CVE-2024-32439](https://cve.now/CVE-2024-32439.md): WordPress WP Client Reports plugin \<= 1.0.22 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, SwitchWP WP Client Reports)
- [CVE-2024-32440](https://cve.now/CVE-2024-32440.md): WordPress Asgaros Forum plugin \<= 2.8.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Thomas Belser Asgaros Forum)
- [CVE-2024-32441](https://cve.now/CVE-2024-32441.md): WordPress Zoho Campaigns plugin \<= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Zoho Campaigns)
- [CVE-2024-32442](https://cve.now/CVE-2024-32442.md): WordPress Zoho Campaigns plugin \<= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Zoho Campaigns)
- [CVE-2024-32443](https://cve.now/CVE-2024-32443.md): WordPress IP2Location Country Blocker plugin \<= 2.34.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Download IP2Location Country Blocker)
- [CVE-2024-32445](https://cve.now/CVE-2024-32445.md): WordPress WebinarIgnition plugin \<= 3.05.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Saleswonder Team: Tobias WebinarIgnition)
- [CVE-2024-32446](https://cve.now/CVE-2024-32446.md): WordPress Wallet System for WooCommerce plugin \<= 2.5.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, WP Swings Wallet System for WooCommerce)
- [CVE-2024-32447](https://cve.now/CVE-2024-32447.md): WordPress AWP Classifieds plugin \<= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, AWP Classifieds Team AWP Classifieds)
- [CVE-2024-3701](https://cve.now/CVE-2024-3701.md): Improper Authentication in com.transsion.kolun.aiservice (CVSS 9.8, TECNO com.transsion.kolun.aiservice)
- [CVE-2024-32448](https://cve.now/CVE-2024-32448.md): WordPress Ads.txt Admin plugin \<= 1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, VideoYield.com Ads.txt Admin)
- [CVE-2024-32449](https://cve.now/CVE-2024-32449.md): WordPress RestroPress plugin \<= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, MagniGenie RestroPress)
- [CVE-2024-32450](https://cve.now/CVE-2024-32450.md): WordPress WpTravelly plugin \<= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, MagePeople Team WpTravelly)
- [CVE-2024-32451](https://cve.now/CVE-2024-32451.md): WordPress Legal Pages plugin \<= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wpWax Legal Pages)
- [CVE-2024-32452](https://cve.now/CVE-2024-32452.md): WordPress Shopping Cart & eCommerce Store plugin \<= 5.5.19 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, WP EasyCart)
- [CVE-2024-30545](https://cve.now/CVE-2024-30545.md): WordPress Social Author Bio plugin \<= 2.4 - Stored XSS via Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Nick Powers Social Author Bio)
- [CVE-2024-31086](https://cve.now/CVE-2024-31086.md): WordPress Change default login logo,url and title plugin \<= 2.0 - CSRF to XSS vulnerability (CVSS 7.1, Venugopal Change default login logo,url and title)
- [CVE-2024-31093](https://cve.now/CVE-2024-31093.md): WordPress Broken Images plugin \<= 0.2 - CSRF to XSS vulnerability (CVSS 7.1, Kaloyan K. Tsvetkov Broken Images)
- [CVE-2024-32082](https://cve.now/CVE-2024-32082.md): WordPress Sync Post With Other Site plugin \<= 1.9.1 - Cross Site Request Forgery (CSRF) to XSS vulnerability (CVSS 7.1, Kamlesh Parmar Sync Post With Other Site)
- [CVE-2024-3505](https://cve.now/CVE-2024-3505.md): JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege users (CVSS 4.3, JFrog Artifactory Self-Hosted)
- [CVE-2024-32087](https://cve.now/CVE-2024-32087.md): WordPress Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More plugin \<= 3.5.7 - Auth. SQL Injection (SQLi) vulnerability (CVSS 7.6, ExportFeed.com Product Feed on WooCommerce for Google)
- [CVE-2024-32098](https://cve.now/CVE-2024-32098.md): WordPress Advanced Page Visit Counter plugin \<= 8.0.6 - Auth. SQL Injection (SQLi) vulnerability (CVSS 7.6, Advanced Page Visit Counter)
- [CVE-2024-32125](https://cve.now/CVE-2024-32125.md): WordPress BA Book Everything plugin \<= 1.6.4 - Auth. SQL Injection vulnerability (CVSS 8.5, Booking Algorithms BA Book Everything)
- [CVE-2024-32127](https://cve.now/CVE-2024-32127.md): WordPress Find Duplicates plugin \<= 1.4.6 - Auth. SQL Injection vulnerability (CVSS 8.5, Markus Seyer Find Duplicates)
- [CVE-2024-32128](https://cve.now/CVE-2024-32128.md): WordPress Realtyna Organic IDX plugin + WPL Real Estate plugin \<= 4.14.4 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, Realtyna Organic IDX plugin)
- [CVE-2024-32132](https://cve.now/CVE-2024-32132.md): WordPress CBX Bookmark & Favorite plugin \<= 1.7.20 - SQL Injection vulnerability (CVSS 7.6, Codeboxr Team CBX Bookmark & Favorite)
- [CVE-2024-32134](https://cve.now/CVE-2024-32134.md): WordPress Forms to Zapier plugin \<= 1.1.12 - Auth. SQL Injection vulnerability (CVSS 7.6, Nasirahmed Forms to Zapier, Integromat, IFTTT, Workato, Aut…)
- [CVE-2024-32135](https://cve.now/CVE-2024-32135.md): WordPress Disable Comments | WPZest plugin \<= 1.51 - SQL Injection vulnerability (CVSS 7.6, Disable Comments | WPZest)
- [CVE-2024-32136](https://cve.now/CVE-2024-32136.md): WordPress BWL Advanced FAQ Manager plugin \<= 2.0.3 - Auth. SQL Injection vulnerability (CVSS 7.6, Xenioushk BWL Advanced FAQ Manager)
- [CVE-2024-32137](https://cve.now/CVE-2024-32137.md): WordPress User Activity Log Pro plugin \<= 2.3.4 - Auth. SQL Injection vulnerability (CVSS 8.5, Solwin User Activity Log Pro)
- [CVE-2024-32139](https://cve.now/CVE-2024-32139.md): WordPress Podlove Podcast Publisher plugin \<= 4.0.12 - SQL Injection vulnerability (CVSS 8.5, Podlove Podcast Publisher)
- [CVE-2024-32431](https://cve.now/CVE-2024-32431.md): WordPress Import Users from CSV plugin \<= 1.2 - PHP Object Injection (CVSS 4.4, WP All Import Import Users from CSV)
- [CVE-2024-32430](https://cve.now/CVE-2024-32430.md): WordPress ActiveCampaign plugin \<= 8.1.14 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, ActiveCampaign)
- [CVE-2024-32454](https://cve.now/CVE-2024-32454.md): WordPress Wappointment plugin \<= 2.6.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, Appointment Bookings for Zoom GoogleMeet and more – Wappoin…)
- [CVE-2023-52144](https://cve.now/CVE-2023-52144.md): WordPress Product Feed Manager plugin \<= 7.3.15 - Directory Traversal vulnerability (CVSS 5.5, RexTheme Product Feed Manager)
- [CVE-2024-32079](https://cve.now/CVE-2024-32079.md): WordPress Advanced iFrame plugin \<= 2024.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Michael Dempfle Advanced iFrame)
- [CVE-2024-32133](https://cve.now/CVE-2024-32133.md): WordPress EZ Form Calculator plugin \<= 2.14.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Michael Schuppenies EZ Form Calculator)
- [CVE-2024-32138](https://cve.now/CVE-2024-32138.md): WordPress Short URL plugin \<= 1.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, KaizenCoders Short URL)
- [CVE-2024-32140](https://cve.now/CVE-2024-32140.md): WordPress Libsyn Publisher Hub plugin \<= 1.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Libsyn Publisher Hub)
- [CVE-2024-32145](https://cve.now/CVE-2024-32145.md): WordPress WP Google Analytics Events – No-Code Custom Event Tracking for Google Analytics plugin \<= 2.8.0 - Reflected Cross-Site Scripting vulnerability (CVSS 7.1, PineWise WP Google Analytics Events)
- [CVE-2024-32147](https://cve.now/CVE-2024-32147.md): WordPress Contact Form Plugin plugin \<= 1.1.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Form Plugin Team - GhozyLab Easy Contact Form Lite)
- [CVE-2024-32149](https://cve.now/CVE-2024-32149.md): WordPress Jobs for WordPress plugin \<= 2.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BlueGlass Jobs for WordPress)
- [CVE-2024-32428](https://cve.now/CVE-2024-32428.md): WordPress MWW Disclaimer Buttons plugin \<= 3.0.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Moss Web Works MWW Disclaimer Buttons)
- [CVE-2024-32429](https://cve.now/CVE-2024-32429.md): WordPress Remove Footer Credit plugin \<= 1.0.13 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPChill Remove Footer Credit)
- [CVE-2024-32453](https://cve.now/CVE-2024-32453.md): WordPress POEditor plugin \<= 0.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, POEditor)
- [CVE-2024-3771](https://cve.now/CVE-2024-3771.md): PHPGurukul Student Record System edit-subject.php sql injection (CVSS 6.3, PHPGurukul Student Record System)
- [CVE-2024-3770](https://cve.now/CVE-2024-3770.md): PHPGurukul Student Record System sql injection (CVSS 6.3, PHPGurukul Student Record System)
- [CVE-2024-2858](https://cve.now/CVE-2024-2858.md): Simple Buttons Creator \<= 1.04 - Aribtrary Button Deletion via CSRF (CVSS 4.8, Simple Buttons Creator)
- [CVE-2024-2857](https://cve.now/CVE-2024-2857.md): Simple Buttons Creator \<= 1.04 - Unauthenticated Stored XSS (CVSS 6.1, Simple Buttons Creator)
- [CVE-2024-2836](https://cve.now/CVE-2024-2836.md): Super Socializer \< 7.13.64 - Editor+ Stored XSS (CVSS 4.8, Social Share, Social Login and Social Comments Plugin)
- [CVE-2024-2739](https://cve.now/CVE-2024-2739.md): Advance Search \<= 1.1.6 - Shortcode Deletion via CSRF (CVSS 8.7, Advanced Search)
- [CVE-2024-1849](https://cve.now/CVE-2024-1849.md): WP Customer Reviews \< 3.7.1 - Malicious Redirect via HTTP-EQUIV Injection (CVSS 5.4, WP Customer Reviews)
- [CVE-2024-1846](https://cve.now/CVE-2024-1846.md): Responsive Tabs \< 4.0.7 - Contributor+ Stored XSS (CVSS 5.4, Responsive Tabs)
- [CVE-2024-1755](https://cve.now/CVE-2024-1755.md): NPS computy \<= 2.7.5 - Results Deletion via CSRF (CVSS 8.8, NPS computy)
- [CVE-2024-1754](https://cve.now/CVE-2024-1754.md): NPS computy \<= 2.7.5 - Admin+ Stored XSS (CVSS 4.7, NPS computy)
- [CVE-2024-1746](https://cve.now/CVE-2024-1746.md): Testimonial Slider \< 2.3.8 - Admin+ Stored XSS (CVSS 5.4, Testimonial Slider)
- [CVE-2024-1712](https://cve.now/CVE-2024-1712.md): Carousel Slider \< 2.2.7 - Editor+ Stored XSS (CVSS 4.7, Carousel Slider)
- [CVE-2024-1660](https://cve.now/CVE-2024-1660.md): Top Bar \< 3.0.5 - Admin+ Stored XSS (CVSS 4.8, Top Bar)
- [CVE-2024-1310](https://cve.now/CVE-2024-1310.md): WooCommerce \< 8.6 - Contributor+ Private/Draft Products Access (CVSS 4.9, WooCommerce)
- [CVE-2024-1307](https://cve.now/CVE-2024-1307.md): Smart Forms \< 2.6.94 - Subscriber+ Edit Entries via Broken Access Control (CVSS 6.5, Smart Forms)
- [CVE-2024-1306](https://cve.now/CVE-2024-1306.md): Smart Forms \< 2.6.94 - Edit Entries via CSRF (CVSS 5.4, Smart Forms)
- [CVE-2024-1204](https://cve.now/CVE-2024-1204.md): Meta Box \< 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure (CVSS 4.3, Meta Box)
- [CVE-2024-0902](https://cve.now/CVE-2024-0902.md): Fancy Product Designer \< 6.1.81 - Admin+ Cross Site Scripting via Product Title (CVSS 4.3, Fancy Product Designer)
- [CVE-2024-0399](https://cve.now/CVE-2024-0399.md): WooCommerce Customers Manager \< 29.7 - Subscriber+ SQL Injection (CVSS 8.1, WooCommerce Customers Manager)
- [CVE-2023-7201](https://cve.now/CVE-2023-7201.md): Everest Backup \< 2.2.5 - Admin+ Arbitrary File Upload (CVSS 6.5, Everest Backup)
- [CVE-2023-6067](https://cve.now/CVE-2023-6067.md): WP User Profile Avatar \<= 1.0.1 - Contributor+ Stored XSS (CVSS 5.4, WP User Profile Avatar)
- [CVE-2024-1655](https://cve.now/CVE-2024-1655.md): ASUS WiFi Router - OS Command Injection (CVSS 8.8, ASUS ExpertWiFi EBM63 · ASUS ExpertWiFi EBM68 +1)
- [CVE-2024-3769](https://cve.now/CVE-2024-3769.md): PHPGurukul Student Record System login.php sql injection (CVSS 7.3, PHPGurukul Student Record System)
- [CVE-2024-3778](https://cve.now/CVE-2024-3778.md): Ai3 QbiBot - Unrestricted File Upload (CVSS 7.2, Ai3 QbiBot)
- [CVE-2024-3768](https://cve.now/CVE-2024-3768.md): PHPGurukul/itsourcecode News Portal search.php sql injection (CVSS 5.3, PHPGurukul News Portal · itsourcecode News Portal)
- [CVE-2024-3777](https://cve.now/CVE-2024-3777.md): Ai3 QbiBot - Broken Access Control (CVSS 9.8, Ai3 QbiBot)
- [CVE-2024-3767](https://cve.now/CVE-2024-3767.md): PHPGurukul News Portal edit-post.php sql injection (CVSS 5.3, PHPGurukul News Portal)
- [CVE-2024-3776](https://cve.now/CVE-2024-3776.md): Netvision airPASS - Reflected XSS (CVSS 6.1, Netvision airPASS)
- [CVE-2024-3775](https://cve.now/CVE-2024-3775.md): aEnrich Technology a+HRD - Argument Injection (CVSS 5.3, aEnrich Technology a+HRD)
- [CVE-2024-3774](https://cve.now/CVE-2024-3774.md): aEnrich Technology a+HRD - Exposure of Sensitive Data (CVSS 5.3, aEnrich Technology a+HRD)
- [CVE-2024-3772](https://cve.now/CVE-2024-3772.md): Regular expression denial of service in Pydantic \< 2.4.0 (CVSS 5.9, Pydantic)
- [CVE-2020-22539](https://cve.now/CVE-2020-22539.md): An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitrary code via uploadi (CVSS 7.2)
- [CVE-2020-22540](https://cve.now/CVE-2020-22540.md): Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive informati (CVSS 5.4)
- [CVE-2023-33806](https://cve.now/CVE-2023-33806.md): Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary comma (CVSS 7.8)
- [CVE-2023-45503](https://cve.now/CVE-2023-45503.md): SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), (CVSS 5.3)
- [CVE-2024-22014](https://cve.now/CVE-2024-22014.md): An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via Symbol (CVSS 8.8)
- [CVE-2024-24485](https://cve.now/CVE-2024-24485.md): An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive information via the GET EEP\_DAT (CVSS 7.5)
- [CVE-2024-24486](https://cve.now/CVE-2024-24486.md): An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to edit device settings via the SAVE EEP\_DATA comma (CVSS 9.1)
- [CVE-2024-24487](https://cve.now/CVE-2024-24487.md): An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packet (CVSS 6.8)
- [CVE-2024-28056](https://cve.now/CVE-2024-28056.md): Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. (CVSS 9.8, @aws-amplify/cli)
- [CVE-2024-28556](https://cve.now/CVE-2024-28556.md): SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate p (CVSS 9.8)
- [CVE-2024-28557](https://cve.now/CVE-2024-28557.md): SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate p (CVSS 9.8)
- [CVE-2024-28558](https://cve.now/CVE-2024-28558.md): SQL Injection vulnerability in sourcecodester Petrol pump management software v1.0, allows remote attackers to execute arbitrary code, escal (CVSS 8.8)
- [CVE-2024-30567](https://cve.now/CVE-2024-30567.md): An issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to execute arbitrary code via the Network Troubles (CVSS 6.3)
- [CVE-2024-30656](https://cve.now/CVE-2024-30656.md): An issue in Fireboltt Dream Wristphone BSW202\_FB\_AAC\_v2.0\_20240110-20240110-1956 allows attackers to cause a Denial of Service (DoS) via a c (CVSS 5.1)
- [CVE-2024-30840](https://cve.now/CVE-2024-30840.md): A Stack Overflow vulnerability in Tenda AC15 v15.03.05.18 allows attackers to cause a denial of service via the LISTEN parameter in the from (CVSS 6.5)
- [CVE-2024-31497](https://cve.now/CVE-2024-31497.md): In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a qui (CVSS 5.9)
- [CVE-2024-31648](https://cve.now/CVE-2024-31648.md): Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts or HTML via a craft (CVSS 6.1)
- [CVE-2024-31649](https://cve.now/CVE-2024-31649.md): A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via (CVSS 5.4)
- [CVE-2024-31650](https://cve.now/CVE-2024-31650.md): A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via (CVSS 9.6)
- [CVE-2024-31651](https://cve.now/CVE-2024-31651.md): A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via (CVSS 6.1)
- [CVE-2024-31652](https://cve.now/CVE-2024-31652.md): A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via (CVSS 6.1)
- [CVE-2024-32488](https://cve.now/CVE-2024-32488.md): In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the up (CVSS 7.8)
- [CVE-2024-32489](https://cve.now/CVE-2024-32489.md): TCPDF before 6.7.4 mishandles calls that use HTML syntax. (CVSS 6.1, tecnickcom/tcpdf)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.