CVEs published April 18, 2024
124 CVEs were published on April 18, 2024: 11 critical, 39 high.
- Published
- 124
- Critical
- 11
- High
- 39
- Medium
- 68
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- Electrolink Compact DAB Transmitter · Electrolink Medium… +6
- 7
- judge0
- 3
- SolarWinds Platform
- 3
- Averta Master Slider
- 2
- bdthemes Element Pack – Widgets, Templates & Addons for Ele…
- 2
- Booking Algorithms BA Book Everything
- 2
- HCL Software Connections
- 2
- Microsoft Edge
- 2
- tolgee-platform
- 2
- Totara LMS
- 2
Critical 11
- CVE-2024-2796SSRF in Akana API PlatformAkana API Platform
- CVE-2024-29021SSRF into Sandbox Escape through Unsafe Default Configurationjudge0
- CVE-2024-28189Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Linkjudge0
- CVE-2024-28185Judge0 vulnerable to Sandbox Escape via Symbolic Linkjudge0
- CVE-2024-32599WordPress WP Dummy Content Generator plugin <= 3.2.1 - Arbitrary Code Execution vulnerabilityDeepak anand WP Dummy Content Generator
- CVE-2023-49742WordPress Support Genix plugin <= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerabilitySupport Genix
- CVE-2024-30564An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted @andrei-tatar/nora-firebase-common
- CVE-2024-30922SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rende
- CVE-2024-30923SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Docu
- CVE-2024-30938SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to obtain sensitive information via the ID parameter in the SEMCMS_User
- CVE-2024-31750SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req_id parameter.
High 39
- CVE-2024-3742Electrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive InformationElectrolink Compact DAB Transmitter · Electrolink Medium… +6
- CVE-2024-1491Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical FunctionElectrolink Compact DAB Transmitter · Electrolink Medium… +6
- CVE-2024-21872Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity CheckingElectrolink Compact DAB Transmitter · Electrolink Medium… +6
- CVE-2024-22186Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity CheckingElectrolink Compact DAB Transmitter · Electrolink Medium… +6
- CVE-2024-22179Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable DataElectrolink Compact DAB Transmitter · Electrolink Medium… +6
- CVE-2024-3741Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable DataElectrolink Compact DAB Transmitter · Electrolink Medium… +6
- CVE-2024-32477Race condition when flushing input stream leads to permission prompt bypassdenoland deno
- CVE-2024-32474Sentry's superuser cleartext password leaked in logsgetsentry sentry · sentry
- CVE-2024-20380ClamAV HTML Parser Denial of Service VulnerabilityCisco ClamAV
- CVE-2023-3758Sssd: race condition during authorization leads to gpo policies functioning inconsistentlysssd · Red Hat Enterprise Linux +1
- CVE-2024-32462Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsingflatpak
- CVE-2024-24910LocalprivilegeescalationinCheckPointZoneAlarmExtremeSecurityNextGen,IdentityAgentforWindows,andIdentityAgentforWindowsTerminalServerviacraftedDLLfilecheckpoint ZoneAlarmExtremeSecurityNextGen,IdentityAgentfor…
- CVE-2024-32475Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytesenvoyproxy envoy
- CVE-2023-47843WordPress CataBlog Plugin <= 1.7.0 is vulnerable to Arbitrary File DeletionZachary Segal CataBlog
- CVE-2024-32551WordPress SP Project & Document Manage plugin <= 4.71 - Auth. SQL Injection vulnerabilitySmartypants SP Project & Document Manager
- CVE-2024-32602WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.3.1 - SQL Injection vulnerabilityOnTheGoSystems WooCommerce Multilingual & Multicurrency
- CVE-2024-32600WordPress Master Slider plugin <= 3.9.5 - PHP Object Injection vulnerabilityAverta Master Slider
- CVE-2024-32553WordPress Superfly Menu plugin <= 5.0.25 - Subscriber+ Site-Wide Stored Cross Site Scripting (XSS) vulnerabilitylooks_awesome Superfly Menu
- CVE-2024-32558WordPress eCommerce Product Catalog plugin <= 3.3.32 - Cross Site Scripting (XSS) vulnerabilityimpleCode eCommerce Product Catalog
- CVE-2024-32559WordPress WP 404 Auto Redirect to Similar Post plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityhwk-fr WP 404 Auto Redirect to Similar Post
- CVE-2024-32562WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityVIICTORY MEDIA Z Y N I T H
- CVE-2024-32563WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityVikBooking Hotel Booking Engine & PMS
- CVE-2024-32567WordPress DirectoryPress plugin <= 3.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityDesigninvento DirectoryPress
- CVE-2024-32568WordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityMelapress WP 2FA
- CVE-2024-26921inet: inet_defrag: prevent sk release while still in useLinux
- CVE-2024-32570WordPress Cornerstone plugin <= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityArchetyped Cornerstone
- CVE-2024-32574WordPress WP Simple HTML Sitemap plugin <= 2.8 - Cross Site Scripting (XSS) vulnerabilityAshish Ajani WP Simple HTML Sitemap
- CVE-2024-32578WordPress Sliderby10Web plugin <= 1.2.54 - Cross Site Scripting (XSS) vulnerabilitySlider by 10Web
- CVE-2024-32582WordPress Debug Log Manager plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerabilityBowo Debug Log Manager
- CVE-2024-32583WordPress Photo Gallery by 10Web plugin <= 1.8.21 - Reflected Cross Site Scripting (XSS) vulnerabilityPhoto Gallery Team Photo Gallery by 10Web
- CVE-2024-29003SolarWinds Platform Cross Site Scripting Vulnerability SolarWinds Platform
- CVE-2024-29001SolarWinds Platform SWQL Injection Vulnerability SolarWinds Platform
- CVE-2024-28076SolarWinds Platform Arbitrary Open Redirection VulnerabilitySolarWinds Platform
- CVE-2024-32588WordPress LearnPress Export Import plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityThimPress LearnPress Export Import
- CVE-2024-32595WordPress WP Helper Premium plugin < 4.6.0 - Reflected Cross Site Scripting (XSS) vulnerabilityMat Bao WP Helper Premium
- CVE-2024-32603WordPress WooBuddy plugin <= 3.4.20 - PHP Object Injection vulnerabilityThemeKraft WooBuddy
- CVE-2024-30920Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php
- CVE-2024-30928SQL Injection vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary SQL commands via 'classids' Parameter in ajax/q
- CVE-2024-30929Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the 'back' Parameter in playlis
Medium, low and unrated 74
- CVE-2024-21846Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical FunctionElectrolink Compact DAB Transmitter · Electrolink Medium… +6
- CVE-2024-32473Moby IPv6 enabled on IPv4-only network interfacesmoby · github.com/docker/docker
- CVE-2024-30107HCL Connections is vulnerable to broken access controlHCL Software Connections
- CVE-2024-29987Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2024-29986Microsoft Edge for Android (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2024-23557HCL Connections is vulnerable to a user enumeration vulnerabilityHCL Software Connections
- CVE-2024-32470Tolgee' API keys created by server admin users bypass the permission checktolgee-platform
- CVE-2024-32466Tolgee's API key scopes not checked when querying translation datatolgee-platform
- CVE-2024-302571Panel's password verification is suspected to have a timing attack vulnerability1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- CVE-2024-27306aiohttp vulnerable to XSS on index pages for static file handlingaio-libs aiohttp · aiohttp
- CVE-2023-6892EAN for WooCommerce <= 4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta Shortcodewpcodefactory EAN Barcode Generator for WooCommerce: UPC, I…
- CVE-2023-6897EAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcodewpcodefactory EAN Barcode Generator for WooCommerce: UPC, I…
- CVE-2023-50885WordPress Store Locator WordPress Plugin <= 1.4.14 is vulnerable to Arbitrary File DeletionAGILELOGIX Store Locator WordPress
- CVE-2024-3948SourceCodester Home Clean Service System Photo student.add.php unrestricted uploadSourceCodester Home Clean Service System
- CVE-2023-3675Insufficient input validation when downloading certain file types.Secomea GateManager
- CVE-2024-32689WordPress WP Social Comments plugin <= 1.7.3 - Broken Access Control vulnerabilityGenialSouls WP Social Comments
- CVE-2024-32686WordPress Backup Migration plugin <= 1.4.3 - Sensitive Data Exposure via Log vulnerabilityInisev Backup Migration
- CVE-2024-31229WordPress Really Simple SSL plugin <= 7.2.3 - Server Side Request Forgery (SSRF) vulnerabilityReally Simple Plugins Really Simple SSL
- CVE-2023-49768WordPress WP-FormAssembly plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerabilityFormAssembly / Drew Buschhorn WP-FormAssembly
- CVE-2024-32126WordPress Navigation menu as dropdown Widget plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityJeroen Peters Navigation menu as Dropdown Widget
- CVE-2024-32552WordPress Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityTagbox Taggbox
- CVE-2024-32554WordPress Knight Lab Timeline plugin <= 3.9.3.4 - Cross Site Scripting (XSS) vulnerabilityKnight Lab Timeline
- CVE-2024-32556WordPress HurryTimer plugin <=2.9.2 - Cross Site Scripting (XSS) vulnerabilityNabil Lemsieh HurryTimer
- CVE-2024-32560WordPress QR Code Composer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilitySharabindu QR Code Composer
- CVE-2024-32561WordPress Tagembed plugin <= 4.7 - Cross Site Scripting (XSS) vulnerabilityTagembed
- CVE-2024-32564WordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityWPXPO PostX
- CVE-2024-32565WordPress App Builder plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerabilityAppcheap.io App Builder
- CVE-2024-32566WordPress WP Club Manager plugin <= 2.2.11 - Cross Site Scripting (XSS) vulnerabilityWP Club Manager
- CVE-2024-32569WordPress Ditty plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerabilityMetaphor Creations Ditty
- CVE-2024-32571WordPress WP Stripe Checkout plugin <= 1.2.2.41 - Cross Site Scripting (XSS) vulnerabilitynaa986 WP Stripe Checkout
- CVE-2024-32572WordPress Element Pack Elementor Addons plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerabilityBdThemes Element Pack Elementor Addons
- CVE-2024-32573WordPress WP-Lister Lite for eBay plugin <=3.5.11 - Cross Site Scripting (XSS) vulnerabilityWP Lab WP-Lister Lite for eBay
- CVE-2024-32575WordPress Mega Elements plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerabilityKraftplugins Mega Elements
- CVE-2024-32576WordPress BA Book Everything plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerabilityBooking Algorithms BA Book Everything
- CVE-2024-32577WordPress CBX Bookmark & Favorite plugin <= 1.7.20 - Cross Site Scripting (XSS) vulnerabilityCodeboxr Team CBX Bookmark & Favorite
- CVE-2024-2833Jobs for WordPress <= 2.7.5 - Reflected Cross-Site Scripting via job-searchblueglassch Job Postings
- CVE-2024-32579WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilityGloriaFood Restaurant Menu – Food Ordering System – Table R…
- CVE-2024-32580WordPress Master Slider plugin <= 3.9.8 - Cross Site Scripting (XSS) vulnerabilityAverta Master Slider
- CVE-2024-32581WordPress Mortgage Calculators WP plugin <= 1.56 - Cross Site Scripting (XSS) vulnerabilityLenderd Mortgage Calculators WP
- CVE-2024-32584WordPress TeraWallet plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityStandaloneTech TeraWallet – For WooCommerce
- CVE-2024-32585WordPress Import Content in WordPress & WooCommerce with Excel plugin <= 4.2 - Cross Site Scripting (XSS) vulnerabilityextendWP Import Content in WordPress & WooCommerce with Exc…
- CVE-2024-32586WordPress Gutenberg Block Editor Toolkit plugin <= 1.40.4 - Cross Site Scripting (XSS) vulnerabilityMunir Kamal Gutenberg Block Editor Toolkit
- CVE-2024-32587WordPress EnvíaloSimple plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEnvialoSimple EnvíaloSimple
- CVE-2024-32590WordPress Kattene plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityWebfood Kattene
- CVE-2024-32591WordPress Backend Designer plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityDaniele De Rosa Backend Designer
- CVE-2024-32592WordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityVoidCoders, innovs Void Elementor WHMCS Elements For Elemen…
- CVE-2024-32593WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.3.4.2 - Cross Site Scripting (XSS) vulnerabilityWPBITS Addons For Elementor Page Builder
- CVE-2024-32594WordPress Attesa Extra plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerabilityAttesaWP Attesa Extra
- CVE-2024-32596WordPress DSGVO Youtube plugin <= 1.4.5 - Cross Site Scripting (XSS) vulnerabilityEric-Oliver Mächler DSGVO Youtube
- CVE-2024-32597WordPress WP Smart Import plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityXylus Themes WordPress Importer
- CVE-2024-32598WordPress BA Book Everything plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerabilityBooking Algorithms BA Book Everything
- CVE-2024-32601WordPress Popup Anything plugin <= 2.8 - Broken Access Control vulnerabilityWP OnlineSupport, Essential Plugin Popup Anything
- CVE-2024-32604WordPress WP-Recall plugin <= 16.26.5 - Insecure Direct Object References (IDOR) vulnerabilityPlechev Andrey WP-Recall
- CVE-2023-41864WordPress PeproDev CF7 Database plugin <= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerabilityPepro Dev. Group PeproDev CF7 Database
- CVE-2024-32142WordPress Ovic Responsive WPBakery plugin <= 1.3.0 - Broken Access Control vulnerabilityOvic Team Ovic Responsive WPBakery
- CVE-2024-31869Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config usedApache Software Foundation Apache Airflow · apache-airflow
- CVE-2024-2729Otter Blocks < 2.6.6 - Contributor+ Stored XSSOtter Blocks
- CVE-2024-1429Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Panel Slider Widgetbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-1426Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price List Widgetbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-29956cleartext password in supportsave logs when a user schedules a switch Supportsave from Brocade SANnavBrocade SANnav
- CVE-2024-3932Totara LMS User Selector cross-site request forgeryTotara LMS
- CVE-2024-3931Totara LMS User Selector check.php cross site scriptingTotara LMS
- CVE-2024-30921Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component
- CVE-2024-30924Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.
- CVE-2024-30925Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the photo-thumbs.php component.
- CVE-2024-30926Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component.
- CVE-2024-30927Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the racer-results.php component
- CVE-2024-32325TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the ssid parameter in the setWiFiExtenderC
- CVE-2024-32326TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the key parameter in the setWiFiExtenderCo
- CVE-2024-32327TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in Port Forwarding under the Firewall Page.
- CVE-2024-32332TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in WDS Settings under the Wireless Page.
- CVE-2024-32333TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page.
- CVE-2024-32334TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firewall Page
- CVE-2024-32335TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in Access Control under the Wireless Page.