CVEs published April 17, 2024
295 CVEs were published on April 17, 2024: 18 critical, 103 high.
- Published
- 295
- Critical
- 18
- High
- 103
- Medium
- 116
- Low
- 5
- Unrated
- 53
- Now in CISA KEV
- 0
- Fix available
- 91
Most affected products
- Linux
- 100
- Google Chrome
- 14
- Honeywell Experion Server
- 10
- Tenda AC500
- 6
- Peplink Smart Reader
- 5
- Brocade SANnav
- 4
- ofono · Fedora
- 4
- IBM WebSphere Application Server
- 2
- Loopus WP Cost Estimation & Payment Forms Builder
- 2
- NetApp ONTAP Select Deploy administration utility
- 2
Critical 18
- CVE-2024-3817HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git BranchesHashiCorp Shared library · github.com/hashicorp/go-getter
- CVE-2023-39367An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU).Peplink Smart Reader
- CVE-2024-26877crypto: xilinx - call finalize with bh disabledLinux
- CVE-2024-26853igc: avoid returning frame twice in XDP_REDIRECTLinux
- CVE-2024-26828cifs: fix underflow in parse_server_interfaces()Linux
- CVE-2024-32514WordPress WP Poll Maker plugin <= 3.4 - Authenticated Arbitrary File Upload vulnerabilityPoll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker
- CVE-2024-3847Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policyGoogle Chrome
- CVE-2024-3845Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy viGoogle Chrome
- CVE-2024-30980SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands
- CVE-2024-30982SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands
- CVE-2024-30985SQL Injection vulnerability in "B/W Dates Reports" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to exec
- CVE-2024-30990SQL Injection vulnerability in the "Invoices" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute a
- CVE-2024-31581FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c.
- CVE-2024-32161jizhiCMS 2.5 suffers from a File upload vulnerability.
- CVE-2024-32286Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromVirtualSer function.
- CVE-2024-32301Tenda AC7V1.0 v15.03.06.44 firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function.
- CVE-2024-32318Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability via the vlan parameter in the formSetVlanInfo function.
- CVE-2024-32340A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or
High 103
- CVE-2023-4235Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_deliver_report() functionofono · Fedora
- CVE-2023-4234Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_submit_report() functionofono · Fedora
- CVE-2023-4233Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the sms_decode_address_field() functionofono · Fedora
- CVE-2023-4232Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_status_report() functionofono · Fedora
- CVE-2024-21989Privilege Escalation Vulnerability in ONTAP Select Deploy administration utilityNetApp ONTAP Select Deploy administration utility
- CVE-2024-3323Reflected Cross Site Scripting (XSS) vulnerabilityTIBCO JasperReports Server
- CVE-2024-29950Brocade SANnav before v2.3.1, v2.3.0a uses weak encryptionBrocade SANnav
- CVE-2024-2961The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when convertiThe GNU C Library glibc
- CVE-2024-3914Use after free in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2024-28073SolarWinds Serv-U Directory Traversal Remote Code Execution Vulnerability SolarWinds ServU
- CVE-2023-5404Server receiving a malformed message can cause a pointer to be overwritten which can result in a remote code execution or failure.Honeywell Experion Server
- CVE-2023-5403Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failureHoneywell Experion Server
- CVE-2023-5401Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to Honeywell Experion Server
- CVE-2023-5400Server receiving a malformed message based on a using the specified key values can cause a heap overflow vulnerability which could lead to aHoneywell Experion Server
- CVE-2023-5397Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a failHoneywell Experion Server
- CVE-2023-5396Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code exeHoneywell Experion Server
- CVE-2023-5395Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote codHoneywell Experion Server
- CVE-2024-26919usb: ulpi: Fix debugfs directory leakLinux
- CVE-2024-26914drm/amd/display: fix incorrect mpc_combine array sizeLinux
- CVE-2024-26911drm/buddy: Fix alloc_range() error handling codeLinux
- CVE-2024-32463phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tagsphlex-ruby phlex · phlex
- CVE-2024-30253Handling untrusted input can result in a crash, leading to loss of availability / denial of servicesolana-labs solana-web3.js · @solana/web3.js
- CVE-2024-2419Keycloak: path traversal in the redirect validationkeycloak · Red Hat build of Keycloak +1
- CVE-2024-1249Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddoskeycloak · Red Hat AMQ Broker +16
- CVE-2024-1132Keycloak: path transversal in redirection validationkeycloak · Red Hat Migration Toolkit for Runtimes 1 on… +15
- CVE-2023-45744A data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU)Peplink Smart Reader
- CVE-2024-3910Tenda AC500 DhcpListClient fromDhcpListClient stack-based overflowTenda AC500
- CVE-2024-3909Tenda AC500 execCommand formexeCommand stack-based overflowTenda AC500
- CVE-2024-3907Tenda AC500 setcfm formSetCfm stack-based overflowTenda AC500
- CVE-2023-51418WordPress JVM rich text icons plugin <= 1.2.6 - Arbitrary File Deletion vulnerabilityJoris van Montfort JVM rich text icons
- CVE-2023-51500WordPress Uncode Core plugin <= 2.8.8 - Arbitrary File Deletion vulnerabilityUndsgn Uncode Core
- CVE-2024-3906Tenda AC500 QuickIndex formQuickIndex stack-based overflowTenda AC500
- CVE-2024-3905Tenda AC500 execCommand R7WebsSecurityHandler stack-based overflowTenda AC500
- CVE-2024-26909soc: qcom: pmic_glink_altmode: fix drm bridge use-after-freeLinux
- CVE-2024-26907RDMA/mlx5: Fix fortify source warning while accessing Eth segmentLinux
- CVE-2024-26898aoe: fix the potential use-after-free problem in aoecmd_cfg_pktsLinux
- CVE-2024-26895wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfacesLinux
- CVE-2024-26890Bluetooth: btrtl: fix out of bounds memory accessLinux
- CVE-2024-26885bpf: Fix DEVMAP_HASH overflow check on 32-bit archesLinux
- CVE-2024-26884bpf: Fix hashtab overflow check on 32-bit archesLinux
- CVE-2024-26883bpf: Fix stackmap overflow check on 32-bit archesLinux
- CVE-2024-26882net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()Linux
- CVE-2024-26881net: hns3: fix kernel crash when 1588 is received on HIP08 devicesLinux
- CVE-2024-26880dm: call the resume method on internal suspendLinux
- CVE-2024-26872RDMA/srpt: Do not register event handler until srpt device is fully setupLinux
- CVE-2024-26870NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102Linux
- CVE-2024-26869f2fs: fix to truncate meta inode pages forcelyLinux
- CVE-2024-26868nfs: fix panic when nfs4_ff_layout_prepare_ds() failsLinux
- CVE-2024-26865rds: tcp: Fix use-after-free of net in reqsk_timer_handler().Linux
- CVE-2024-26864tcp: Fix refcnt handling in __inet_hash_connect().Linux
- CVE-2022-47151WordPress JS Help Desk plugin <= 2.7.1 - Unauth. SQL Injection VulnerabilityJS Help Desk – Best Help Desk & Support Plugin
- CVE-2024-26857geneve: make sure to pull inner header in geneve_rx()Linux
- CVE-2024-26856net: sparx5: Fix use after free inside sparx5_del_mact_entryLinux
- CVE-2024-26854ice: fix uninitialized dplls mutex usageLinux
- CVE-2024-26852net/ipv6: avoid possible UAF in ip6_route_mpath_notify()Linux
- CVE-2024-26851netfilter: nf_conntrack_h323: Add protection for bmp length out of rangeLinux
- CVE-2024-26845scsi: target: core: Add TMF to tmr_list handlingLinux
- CVE-2024-26838RDMA/irdma: Fix KASAN issue with taskletLinux
- CVE-2024-26834netfilter: nft_flow_offload: release dst in case direct xmit path is usedLinux
- CVE-2024-32510WordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.75 - Reflected Cross Site Scripting (XSS) vulnerabilityLoopus WP Cost Estimation & Payment Forms Builder
- CVE-2024-32528WordPress WP Dynamic Keywords Injector plugin <= 2.3.18 - Reflected Cross Site Scripting (XSS) vulnerabilitySeerox WP Dynamic Keywords Injector
- CVE-2024-26830i40e: Do not allow untrusted VF to remove administratively set MACLinux
- CVE-2024-26826mptcp: fix data re-injection from stale subflowLinux
- CVE-2024-26824crypto: algif_hash - Remove bogus SGL free on zero-length error pathLinux
- CVE-2024-26823irqchip/gic-v3-its: Restore quirk probing for ACPI-based systemsLinux
- CVE-2024-26822smb: client: set correct id, uid and cruid for multiuser automountsLinux
- CVE-2024-32531WordPress GuCherry Blog theme <= 1.1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEverest themes GuCherry Blog
- CVE-2023-44227WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Arbitrary File DeletionMitchell Bennis Simple File List
- CVE-2024-32533WordPress LH Add Media From Url plugin <= 1.22 - Reflected Cross Site Scripting (XSS) vulnerabilityPeter Shaw LH Add Media From Url
- CVE-2024-32535WordPress Access Category Password plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityJojaba Access Category Password
- CVE-2024-32541WordPress WP-Cufon plugin <= 1.6.10 - Cross Site Scripting (XSS) vulnerabilityTobias Battenberg WP-Cufon
- CVE-2024-32542WordPress Bulk Block Converter plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityOrganic Themes Bulk Block Converter
- CVE-2024-32543WordPress MJ Update History plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityMinoji MJ Update History
- CVE-2024-32544WordPress Netgsm plugin <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityNetgsm
- CVE-2024-32545WordPress Canva – Design beautiful blog graphics plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityCanva – Design beautiful blog graphics
- CVE-2024-32546WordPress Tax Rate Upload plugin <= 2.4.5 - Cross Site Scripting (XSS) vulnerabilityAdam Bowen Tax Rate Upload
- CVE-2024-32550WordPress BMI Adult & Kid Calculator plugin <= 1.2.1 - CSRF to XSS vulnerabilityBMI Adult & Kid Calculator
- CVE-2024-32549WordPress Related Posts for WordPress plugin <= 4.0.3 - CSRF to XSS vulnerabilityMicrokid Related Posts for WordPress
- CVE-2024-3841Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTMLGoogle Chrome
- CVE-2024-3834Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2024-3833Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption Google Chrome
- CVE-2024-3832Object corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a craGoogle Chrome
- CVE-2024-22354IBM WebSphere Application Server XML external entity injectionIBM WebSphere Application Server
- CVE-2023-46060A Buffer Overflow vulnerability in Tenda AC500 v.2.0.1.9 allows a remote attacker to cause a denial of service via the port parameter at the
- CVE-2024-30983SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands
- CVE-2024-31031An issue in `coap_pdu.c` in libcoap 4.3.4 allows attackers to cause undefined behavior via a sequence of messages leading to unsigned intege
- CVE-2024-31041Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to cause a denial of ser
- CVE-2024-31578FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.
- CVE-2024-31582FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_co
- CVE-2024-31583Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.torch
- CVE-2024-32281Tenda AC7V1.0 v15.03.06.44 firmware contains a command injection vulnerablility in formexeCommand function via the cmdinput parameter.
- CVE-2024-32283Tenda FH1203 V2.0.1.6 firmware has a command injection vulnerablility in formexeCommand function via the cmdinput parameter.
- CVE-2024-32285Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the password parameter in the formaddUserName function.
- CVE-2024-32291Tenda W30E v1.0 firmware v1.0.1.25(633) has a stack overflow vulnerability via the page parameter in the fromNatlimit function.
- CVE-2024-32292Tenda W30E v1.0 V1.0.1.25(633) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput paramete
- CVE-2024-32293Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromDhcpListClient function.
- CVE-2024-32299Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function.
- CVE-2024-32303Tenda AC15 v15.03.20_multi, v15.03.05.19, and v15.03.05.18 firmware has a stack overflow vulnerability located via the PPW parameter in the
- CVE-2024-32305Tenda A18 v15.03.05.05 firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function.
- CVE-2024-32307Tenda FH1205 V2.0.0.7(775) firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function.
- CVE-2024-32310Tenda F1203 V2.0.1.6 firmware has a stack overflow vulnerability located in the PPW parameter of the fromWizardHandle function.
- CVE-2024-32317Tenda AC10 v4.0 V16.03.10.13 and V16.03.10.20 firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterS
- CVE-2024-32345A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML
Medium, low and unrated 174
- CVE-2024-3928Dromara open-capacity-platform auth-server heapdump information disclosureDromara open-capacity-platform
- CVE-2023-4509It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.Octopus Deploy Octopus Server
- CVE-2024-29955Insertion of Sensitive Information into Brocade SANnav Log FileBrocade SANnav
- CVE-2024-29952Clear text storage of sensistive information by manipulating command variables Brocade SANnav
- CVE-2024-32472excalidraw vulnerable to a Stored XSS in excalidraw's web embed componentexcalidraw · @excalidraw/excalidraw
- CVE-2024-0257RoboDK Heap-based Buffer OverflowRoboDK
- CVE-2024-21990Default Privileged Account Credentials Vulnerability in ONTAP Select Deploy administration utilityNetApp ONTAP Select Deploy administration utility
- CVE-2024-29951Brocade SANnav has weak encryption in internal SSH portsBrocade SANnav
- CVE-2024-3900Out-of-bounds stack array write in Xpdf 4.05 due to missing zero checkXpdf
- CVE-2023-5407Controller denial of service due to improper handling of a specially crafted message received by the controller.Honeywell C300
- CVE-2023-5406Server communication with a controller can lead to remote code execution using a specially crafted message from the controller.Honeywell Experion Server
- CVE-2023-5405Server information leak for the CDA Server process memory can occur when an error is generated in response to a specially crafted message.Honeywell Experion Server
- CVE-2023-5398Server receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service.Honeywell Experion Server
- CVE-2024-26920tracing/trigger: Fix to return error if failed to alloc snapshotLinux
- CVE-2024-26918PCI: Fix active state requirement in PME pollingLinux
- CVE-2024-26917scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"Linux
- CVE-2024-26916Revert "drm/amd: flush any delayed gfxoff on suspend entry"Linux
- CVE-2024-26915drm/amdgpu: Reset IH OVERFLOW_CLEAR bitLinux
- CVE-2024-26913drm/amd/display: Fix dcn35 8k30 Underflow/Corruption IssueLinux
- CVE-2024-26912drm/nouveau: fix several DMA buffer leaksLinux
- CVE-2024-26910netfilter: ipset: fix performance regression in swap operationLinux
- CVE-2023-52645pmdomain: mediatek: fix race conditions with genpdLinux
- CVE-2024-31463Ironic-image allows unauthenticated local access to Ironic APImetal3-io ironic-image
- CVE-2024-3825CSRF in BlazeMeter Jenkins plugin BlazeMeter Jenkins plugin · com.blazemeter.plugins:BlazeMet…
- CVE-2024-29035Umbraco's Blind SSRF Leads to Port Scan by using WebhooksUmbraco-CMS · Umbraco.Cms.Core +1
- CVE-2023-43491An information disclosure vulnerability exists in the web interface /cgi-bin/debug_dump.cgi functionality of Peplink Smart Reader v1.2.0 (inPeplink Smart Reader
- CVE-2023-45209An information disclosure vulnerability exists in the web interface /cgi-bin/download_config.cgi functionality of Peplink Smart Reader v1.2.Peplink Smart Reader
- CVE-2023-40146A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU).Peplink Smart Reader
- CVE-2023-6805RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…
- CVE-2024-3333Essential Addons for Elementor <= 5.9.14 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attributewpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-3908Tenda AC500 WriteFacMac formWriteFacMac command injectionTenda AC500
- CVE-2024-26906x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()Linux
- CVE-2024-26903Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_securityLinux
- CVE-2024-26902perf: RISCV: Fix panic on pmu overflow handlerLinux
- CVE-2024-26901do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleakLinux
- CVE-2024-26900md: fix kmemleak of rdev->serialLinux
- CVE-2024-26899block: fix deadlock between bd_link_disk_holder and partition scanLinux
- CVE-2024-26897wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is completeLinux
- CVE-2024-26896wifi: wfx: fix memory leak when starting APLinux
- CVE-2024-26894ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()Linux
- CVE-2024-26893firmware: arm_scmi: Fix double free in SMC transport cleanup pathLinux
- CVE-2024-26892wifi: mt76: mt7921e: fix use-after-free in free_irq()Linux
- CVE-2024-26891iommu/vt-d: Don't issue ATS Invalidation request when device is disconnectedLinux
- CVE-2024-26889Bluetooth: hci_core: Fix possible buffer overflowLinux
- CVE-2024-26888Bluetooth: msft: Fix memory leakLinux
- CVE-2024-26887Bluetooth: btusb: Fix memory leakLinux
- CVE-2024-26886Bluetooth: af_bluetooth: Fix deadlockLinux
- CVE-2024-26879clk: meson: Add missing clocks to axg_clk_regmapsLinux
- CVE-2024-26878quota: Fix potential NULL pointer dereferenceLinux
- CVE-2024-26876drm/bridge: adv7511: fix crash on irq during probeLinux
- CVE-2024-26875media: pvrusb2: fix uaf in pvr2_context_set_notifyLinux
- CVE-2024-26874drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flipLinux
- CVE-2024-26873scsi: hisi_sas: Fix a deadlock issue related to automatic dumpLinux
- CVE-2024-26871f2fs: fix NULL pointer dereference in f2fs_submit_page_write()Linux
- CVE-2024-26867comedi: comedi_8255: Correct error in subdevice initializationLinux
- CVE-2024-26866spi: lpspi: Avoid potential use-after-free in probe()Linux
- CVE-2024-26863hsr: Fix uninit-value access in hsr_get_node()Linux
- CVE-2024-26862packet: annotate data-races around ignore_outgoingLinux
- CVE-2024-26861wireguard: receive: annotate data-race around receiving_counter.counterLinux
- CVE-2024-26860dm-integrity: fix a memory leak when rechecking the dataLinux
- CVE-2024-26859net/bnx2x: Prevent access to a freed page in page_poolLinux
- CVE-2023-52644wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabledLinux
- CVE-2024-26858net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_mapLinux
- CVE-2024-26855net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()Linux
- CVE-2024-26850mm/debug_vm_pgtable: fix BUG_ON with pud advanced testLinux
- CVE-2024-26849netlink: add nla be16/32 types to minlen arrayLinux
- CVE-2024-26847powerpc/rtas: use correct function name for resetting TCE tablesLinux
- CVE-2022-41698WordPress If Menu – Visibility control for Menus plugin <= 0.16.3 - Broken Access ControlLayered If Menu
- CVE-2024-1350WordPress Honeypot for WP Comment plugin <= 2.2.3 - Arbitrary File Deletion vulnerabilityPrasidhda Malla Honeypot for WP Comment
- CVE-2024-26846nvme-fc: do not wait in vain when unloading moduleLinux
- CVE-2024-26844block: Fix WARNING in _copy_from_iterLinux
- CVE-2024-26843efi: runtime: Fix potential overflow of soft-reserved region sizeLinux
- CVE-2024-26842scsi: ufs: core: Fix shift issue in ufshcd_clear_cmd()Linux
- CVE-2024-26841LoongArch: Update cpu_sibling_map when disabling nonboot CPUsLinux
- CVE-2024-26840cachefiles: fix memory leak in cachefiles_add_cache()Linux
- CVE-2024-26839IB/hfi1: Fix a memleak in init_credit_returnLinux
- CVE-2024-26837net: bridge: switchdev: Skip MDB replays of deferred events on offloadLinux
- CVE-2024-26836platform/x86: think-lmi: Fix password opcode ordering for workstationsLinux
- CVE-2024-26835netfilter: nf_tables: set dormant flag on hook register failureLinux
- CVE-2024-26833drm/amd/display: Fix memory leak in dm_sw_fini()Linux
- CVE-2024-26832mm: zswap: fix missing folio cleanup in writeback race pathLinux
- CVE-2024-26829media: ir_toy: fix a memleak in irtoy_txLinux
- CVE-2024-32130WordPress Payment Forms for Paystack plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerabilityPayment Forms for Paystack
- CVE-2024-32456WordPress Envo Extra plugin <= 1.8.11 - Cross Site Scripting (XSS) vulnerabilityEnvoThemes Envo Extra
- CVE-2024-32457WordPress Elements Plus! plugin <= 2.16.3 - Cross Site Scripting (XSS) vulnerabilityThe CSSIgniter Team Elements Plus!
- CVE-2024-32505WordPress ElementsKit Elementor addons plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityRoxnor ElementsKit Elementor addons Lite
- CVE-2024-32508WordPress DethemeKit For Elementor plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityDethemeKit For Elementor
- CVE-2024-32526WordPress Easy Textillate plugin <= 2.02 - Cross Site Scripting (XSS) vulnerabilityFlector Easy Textillate
- CVE-2024-32527WordPress Jotform Online Forms plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityJotform Online Forms
- CVE-2024-26831net/handshake: Fix handshake_req_destroy_test1Linux
- CVE-2024-26825nfc: nci: free rx_data_reassembly skb on NCI device cleanupLinux
- CVE-2024-26820hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missedLinux
- CVE-2024-26818tools/rtla: Fix clang warning about mount_point var sizeLinux
- CVE-2023-52643iio: core: fix memleak in iio_device_register_sysfsLinux
- CVE-2023-52642media: rc: bpf attach/detach requires write permissionLinux
- CVE-2024-32529WordPress Yoga Schedule Momoyoga plugin <= 2.7.0 - Cross Site Scripting (XSS) vulnerabilityYoga Schedule Momoyoga
- CVE-2024-32530WordPress Simple Testimonials Showcase plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerabilityPressTigers Simple Testimonials Showcase
- CVE-2023-36505WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File DeletionSaturday Drive Ninja Forms Contact Form
- CVE-2023-25043WordPress Data Tables Generator by Supsystic Plugin <= 1.10.25 is vulnerable to Broken Access ControlSupsystic Data Tables Generator
- CVE-2024-32534WordPress Form Maker plugin <= 1.15.23 - Cross Site Scripting (XSS) vulnerability10Web Form Builder Team Form Maker by 10Web
- CVE-2024-32536WordPress WP TradingView plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityTrade Pips WP TradingView
- CVE-2024-32538WordPress Easy CountDowner plugin <= 1.0.8 - CSRF to XSS vulnerabilityJoshua Eldridge Easy CountDowner
- CVE-2024-24856NULL pointer deference in acpi_db_convert_to_package of Linux acpi moduleOpenAnolis Anolis OS
- CVE-2024-32539WordPress WP File Download Light plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityJoomUnited WP File Download Light
- CVE-2024-32540WordPress Fixed HTML Toolbar plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityWeb357 Fixed HTML Toolbar
- CVE-2024-32547WordPress Code Insert Manager (Q2W3 Inc Manager) plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilityMax Bond Code Insert Manager
- CVE-2024-32548WordPress What's New Generator plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityHideki Tanaka What's New Generator
- CVE-2024-32506WordPress Radio Player plugin <= 2.0.73 - Sensitive Data Exposure vulnerabilitySoftLab Radio Player
- CVE-2024-32513WordPress Product Feed PRO for WooCommerce plugin <= 13.3.1 - Sensitive Data Exposure vulnerabilityAdTribes.io Product Feed PRO for WooCommerce
- CVE-2024-3846Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in Google Chrome
- CVE-2024-3844Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crGoogle Chrome
- CVE-2024-3843Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2024-3840Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation resGoogle Chrome
- CVE-2024-3839Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information frGoogle Chrome
- CVE-2024-3838Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicGoogle Chrome
- CVE-2024-3837Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentiGoogle Chrome
- CVE-2024-32509WordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.76 - Broken Access Control vulnerabilityLoopus WP Cost Estimation & Payment Forms Builder
- CVE-2024-32515WordPress Mega Addons For Elementor plugin <= 1.8 - Broken Access Control vulnerabilityQamar Sheeraz, Nasir Ahmad Mega Addons For Elementor
- CVE-2024-32516WordPress Multi Currency For WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerabilityPalscode Multi Currency For WooCommerce
- CVE-2024-32517WordPress Custom Thank You Page Customize For WooCommerce by Binary Carpenter plugin <= 1.4.12 - Broken Access Control vulnerabilityWooCommerce & WordPress Tutorials Custom Thank You Page Cus…
- CVE-2024-32518WordPress PeproDev Ultimate Invoice plugin <= 2.0.0 - Broken Access Control vulnerabilityPepro Dev. Group PeproDev Ultimate Invoice
- CVE-2024-32519WordPress GG Woo Feed for WooCommerce plugin <= 1.2.6 - Broken Access Control vulnerabilityGutenGeek GG Woo Feed for WooCommerce
- CVE-2024-32520WordPress WPC Grouped Product for WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerabilityWPClever WPC Grouped Product for WooCommerce
- CVE-2024-32522WordPress Open Close WooCommerce Store plugin <= 4.9.1 - Broken Access Control vulnerabilityJaed Mosharraf & Pluginbazar Team Open Close WooCommerce St…
- CVE-2024-32524WordPress Custom Order Statuses for WooCommerce plugin <= 1.5.2 - Broken Access Control vulnerabilityNuggethon Custom Order Statuses for WooCommerce
- CVE-2024-32525WordPress Theme My Login plugin <= 7.1.6 - Broken Access Control vulnerabilityTheme My Login
- CVE-2024-32532WordPress Speed Optimizer plugin <= 7.4.6 - Broken Access Control vulnerabilitySiteGround Speed Optimizer
- CVE-2024-22440HPE Compute Scale-up Server 3200 Server, Disclosure of Sensitive InformationHewlett Packard Enterprise HPE Compute Scale-up Server 3200…
- CVE-2024-2309WP Staging < 3.4.0, 5.4.0 (Pro Version) - Admin+ Stored XSSWP STAGING WordPress Backup Plugin · wp-staging-pro
- CVE-2024-2118Social Media Share Buttons < 2.8.9 - Admin+ Stored XSS via settingsSocial Media Share Buttons & Social Sharing Icons
- CVE-2024-2102Salon booking system < 9.6.3 - Unauthenticated Stored XSSSalon booking system
- CVE-2024-2101WordPress Plugin Salon Booking System < 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)Salon booking system
- CVE-2024-1219Easy Social Feed < 6.5.6 - Contributor+ Stored XSSEasy Social Feed
- CVE-2024-0868coreActivity < 2.1 - Unauthenticated IP SpoofingcoreActivity: Activity Logging plugin for WordPress
- CVE-2024-22329IBM WebSphere Application Server server-side request forgeryIBM WebSphere Application Server
- CVE-2024-30950A stored cross-site scripting (XSS) vulnerability in FUDforum v3.1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2024-30951FUDforum v3.1.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the chpos parameter at /adm/admsmiley.php
- CVE-2024-30952A stored cross-site scripting (XSS) vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a craf
- CVE-2024-30953A stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or HTML via a crafted pa
- CVE-2024-30979Cross Site Scripting vulnerability in Cyber Cafe Management System 1.0 allows a remote attacker to execute arbitrary code via the compname p
- CVE-2024-30981SQL Injection vulnerability in /edit-computer-detail.php in phpgurukul Cyber Cafe Management System Using PHP & MySQL v1.0 allows attackers
- CVE-2024-30986Cross Site Scripting vulnerability in /edit-services-details.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attacke
- CVE-2024-30987Cross Site Scripting vulnerability in /bwdates-reports-ds.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers
- CVE-2024-30988Cross Site Scripting vulnerability in /search-invoices.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to
- CVE-2024-30989Cross Site Scripting vulnerability in /edit-client-details.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers
- CVE-2024-31040Buffer Overflow vulnerability in the get_var_integer function in mqtt_parser.c in NanoMQ 0.21.7 allows remote attackers to cause a denial of
- CVE-2024-31580PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp.torch-npu · torch
- CVE-2024-31585FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c.
- CVE-2024-32162CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion.
- CVE-2024-32163CMSeasy 7.7.7.9 is vulnerable to code execution.
- CVE-2024-32282Tenda FH1202 v1.2.0.14(408) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter.
- CVE-2024-32287Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the qos parameter in the fromqossetting function.
- CVE-2024-32288Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromwebExcptypemanFilter fu
- CVE-2024-32290Tenda W30E v1.0 v1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromAddressNat function.
- CVE-2024-32302Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function.
- CVE-2024-32306Tenda AC10U v1.0 Firmware v15.03.06.49 has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function.
- CVE-2024-32311Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterSetting function.
- CVE-2024-32312Tenda F1203 V2.0.1.6 firmware has a stack overflow vulnerability located in the adslPwd parameter of the formWanParameterSetting function.
- CVE-2024-32313Tenda FH1205 V2.0.0.7(775) firmware has a stack overflow vulnerability located via the adslPwd parameter of the formWanParameterSetting func
- CVE-2024-32314Tenda AC500 V2.0.1.9(1307) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter.
- CVE-2024-32315Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterSetting function.
- CVE-2024-32316Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability in the fromDhcpListClient function.
- CVE-2024-32320Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability via the timeZone parameter in the formSetTimeZone function.
- CVE-2024-32337A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or
- CVE-2024-32338A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or
- CVE-2024-32339Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts
- CVE-2024-32341Multiple cross-site scripting (XSS) vulnerabilities in the Home page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts o
- CVE-2024-32342A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML v
- CVE-2024-32343A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML v
- CVE-2024-32344A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML
- CVE-2024-32743A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or
- CVE-2024-32744A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or
- CVE-2024-32745A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or
- CVE-2024-32746A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or