# CVEs published 2024-04-18

124 CVEs were published on April 18, 2024: 11 critical, 39 high. Days are UTC.

- [CVE-2024-3742](https://cve.now/CVE-2024-3742.md): Electrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive Information (CVSS 7.5, Electrolink Compact DAB Transmitter · Electrolink Medium… +6)
- [CVE-2024-1491](https://cve.now/CVE-2024-1491.md): Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function (CVSS 7.5, Electrolink Compact DAB Transmitter · Electrolink Medium… +6)
- [CVE-2024-21846](https://cve.now/CVE-2024-21846.md): Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function (CVSS 5.3, Electrolink Compact DAB Transmitter · Electrolink Medium… +6)
- [CVE-2024-21872](https://cve.now/CVE-2024-21872.md): Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking (CVSS 7.5, Electrolink Compact DAB Transmitter · Electrolink Medium… +6)
- [CVE-2024-22186](https://cve.now/CVE-2024-22186.md): Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking (CVSS 8.8, Electrolink Compact DAB Transmitter · Electrolink Medium… +6)
- [CVE-2024-22179](https://cve.now/CVE-2024-22179.md): Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data (CVSS 7.5, Electrolink Compact DAB Transmitter · Electrolink Medium… +6)
- [CVE-2024-3741](https://cve.now/CVE-2024-3741.md): Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data (CVSS 7.5, Electrolink Compact DAB Transmitter · Electrolink Medium… +6)
- [CVE-2024-32473](https://cve.now/CVE-2024-32473.md): Moby IPv6 enabled on IPv4-only network interfaces (CVSS 4.7, moby · github.com/docker/docker)
- [CVE-2024-30107](https://cve.now/CVE-2024-30107.md): HCL Connections is vulnerable to broken access control (CVSS 3.5, HCL Software Connections)
- [CVE-2024-32477](https://cve.now/CVE-2024-32477.md): Race condition when flushing input stream leads to permission prompt bypass (CVSS 7.7, denoland deno)
- [CVE-2024-32474](https://cve.now/CVE-2024-32474.md): Sentry's superuser cleartext password leaked in logs (CVSS 7.3, getsentry sentry · sentry)
- [CVE-2024-20380](https://cve.now/CVE-2024-20380.md): ClamAV HTML Parser Denial of Service Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2023-3758](https://cve.now/CVE-2023-3758.md): Sssd: race condition during authorization leads to gpo policies functioning inconsistently (CVSS 7.1, sssd · Red Hat Enterprise Linux +1)
- [CVE-2024-29987](https://cve.now/CVE-2024-29987.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2024-29986](https://cve.now/CVE-2024-29986.md): Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2024-23557](https://cve.now/CVE-2024-23557.md): HCL Connections is vulnerable to a user enumeration vulnerability (CVSS 3.5, HCL Software Connections)
- [CVE-2024-32462](https://cve.now/CVE-2024-32462.md): Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing (CVSS 8.4, flatpak)
- [CVE-2024-24910](https://cve.now/CVE-2024-24910.md): LocalprivilegeescalationinCheckPointZoneAlarmExtremeSecurityNextGen,IdentityAgentforWindows,andIdentityAgentforWindowsTerminalServerviacraftedDLLfile (CVSS 7.3, checkpoint ZoneAlarmExtremeSecurityNextGen,IdentityAgentfor…)
- [CVE-2024-32470](https://cve.now/CVE-2024-32470.md): Tolgee' API keys created by server admin users bypass the permission check (CVSS 6.5, tolgee-platform)
- [CVE-2024-2796](https://cve.now/CVE-2024-2796.md): SSRF in Akana API Platform (CVSS 9.3, Akana API Platform)
- [CVE-2024-32466](https://cve.now/CVE-2024-32466.md): Tolgee's API key scopes not checked when querying translation data (CVSS 2.7, tolgee-platform)
- [CVE-2024-30257](https://cve.now/CVE-2024-30257.md): 1Panel's password verification is suspected to have a timing attack vulnerability (CVSS 3.9, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2024-29021](https://cve.now/CVE-2024-29021.md): SSRF into Sandbox Escape through Unsafe Default Configuration (CVSS 9.1, judge0)
- [CVE-2024-28189](https://cve.now/CVE-2024-28189.md): Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Link (CVSS 10.0, judge0)
- [CVE-2024-28185](https://cve.now/CVE-2024-28185.md): Judge0 vulnerable to Sandbox Escape via Symbolic Link (CVSS 10.0, judge0)
- [CVE-2024-27306](https://cve.now/CVE-2024-27306.md): aiohttp vulnerable to XSS on index pages for static file handling (CVSS 6.1, aio-libs aiohttp · aiohttp)
- [CVE-2024-32475](https://cve.now/CVE-2024-32475.md): Envoy RELEASE\_ASSERT using auto\_sni with :authority header \> 255 bytes (CVSS 7.5, envoyproxy envoy)
- [CVE-2023-6892](https://cve.now/CVE-2023-6892.md): EAN for WooCommerce \<= 4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via alg\_wc\_ean\_product\_meta Shortcode (CVSS 6.4, wpcodefactory EAN Barcode Generator for WooCommerce: UPC, I…)
- [CVE-2023-6897](https://cve.now/CVE-2023-6897.md): EAN for WooCommerce \<= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode (CVSS 4.3, wpcodefactory EAN Barcode Generator for WooCommerce: UPC, I…)
- [CVE-2023-50885](https://cve.now/CVE-2023-50885.md): WordPress Store Locator WordPress Plugin \<= 1.4.14 is vulnerable to Arbitrary File Deletion (CVSS 6.8, AGILELOGIX Store Locator WordPress)
- [CVE-2024-3948](https://cve.now/CVE-2024-3948.md): SourceCodester Home Clean Service System Photo student.add.php unrestricted upload (CVSS 6.3, SourceCodester Home Clean Service System)
- [CVE-2023-47843](https://cve.now/CVE-2023-47843.md): WordPress CataBlog Plugin \<= 1.7.0 is vulnerable to Arbitrary File Deletion (CVSS 7.6, Zachary Segal CataBlog)
- [CVE-2023-3675](https://cve.now/CVE-2023-3675.md): Insufficient input validation when downloading certain file types. (CVSS 6.5, Secomea GateManager)
- [CVE-2024-32689](https://cve.now/CVE-2024-32689.md): WordPress WP Social Comments plugin \<= 1.7.3 - Broken Access Control vulnerability (CVSS 4.3, GenialSouls WP Social Comments)
- [CVE-2024-32686](https://cve.now/CVE-2024-32686.md): WordPress Backup Migration plugin \<= 1.4.3 - Sensitive Data Exposure via Log vulnerability (CVSS 5.3, Inisev Backup Migration)
- [CVE-2024-31229](https://cve.now/CVE-2024-31229.md): WordPress Really Simple SSL plugin \<= 7.2.3 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.5, Really Simple Plugins Really Simple SSL)
- [CVE-2024-32551](https://cve.now/CVE-2024-32551.md): WordPress SP Project & Document Manage plugin \<= 4.71 - Auth. SQL Injection vulnerability (CVSS 7.6, Smartypants SP Project & Document Manager)
- [CVE-2024-32602](https://cve.now/CVE-2024-32602.md): WordPress WooCommerce Multilingual & Multicurrency plugin \<= 5.3.3.1 - SQL Injection vulnerability (CVSS 7.6, OnTheGoSystems WooCommerce Multilingual & Multicurrency)
- [CVE-2023-49768](https://cve.now/CVE-2023-49768.md): WordPress WP-FormAssembly plugin \<= 2.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, FormAssembly / Drew Buschhorn WP-FormAssembly)
- [CVE-2024-32126](https://cve.now/CVE-2024-32126.md): WordPress Navigation menu as dropdown Widget plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Jeroen Peters Navigation menu as Dropdown Widget)
- [CVE-2024-32552](https://cve.now/CVE-2024-32552.md): WordPress Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics plugin \<= 3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tagbox Taggbox)
- [CVE-2024-32600](https://cve.now/CVE-2024-32600.md): WordPress Master Slider plugin \<= 3.9.5 - PHP Object Injection vulnerability (CVSS 8.3, Averta Master Slider)
- [CVE-2024-32553](https://cve.now/CVE-2024-32553.md): WordPress Superfly Menu plugin \<= 5.0.25 - Subscriber+ Site-Wide Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, looks\_awesome Superfly Menu)
- [CVE-2024-32554](https://cve.now/CVE-2024-32554.md): WordPress Knight Lab Timeline plugin \<= 3.9.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Knight Lab Timeline)
- [CVE-2024-32556](https://cve.now/CVE-2024-32556.md): WordPress HurryTimer plugin \<=2.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nabil Lemsieh HurryTimer)
- [CVE-2024-32558](https://cve.now/CVE-2024-32558.md): WordPress eCommerce Product Catalog plugin \<= 3.3.32 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, impleCode eCommerce Product Catalog)
- [CVE-2024-32559](https://cve.now/CVE-2024-32559.md): WordPress WP 404 Auto Redirect to Similar Post plugin \<= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, hwk-fr WP 404 Auto Redirect to Similar Post)
- [CVE-2024-32560](https://cve.now/CVE-2024-32560.md): WordPress QR Code Composer plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sharabindu QR Code Composer)
- [CVE-2024-32561](https://cve.now/CVE-2024-32561.md): WordPress Tagembed plugin \<= 4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tagembed)
- [CVE-2024-32562](https://cve.now/CVE-2024-32562.md): WordPress Z Y N I T H plugin \<= 7.4.9 - Unauthenticated Cross Site Scripting (XSS) vulnerability (CVSS 8.6, VIICTORY MEDIA Z Y N I T H)
- [CVE-2024-32563](https://cve.now/CVE-2024-32563.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VikBooking Hotel Booking Engine & PMS)
- [CVE-2024-32564](https://cve.now/CVE-2024-32564.md): WordPress PostX plugin \<= 4.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPXPO PostX)
- [CVE-2024-32565](https://cve.now/CVE-2024-32565.md): WordPress App Builder plugin \<= 3.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Appcheap.io App Builder)
- [CVE-2024-32566](https://cve.now/CVE-2024-32566.md): WordPress WP Club Manager plugin \<= 2.2.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Club Manager)
- [CVE-2024-32567](https://cve.now/CVE-2024-32567.md): WordPress DirectoryPress plugin \<= 3.6.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Designinvento DirectoryPress)
- [CVE-2024-32568](https://cve.now/CVE-2024-32568.md): WordPress WP 2FA plugin \<= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Melapress WP 2FA)
- [CVE-2024-32569](https://cve.now/CVE-2024-32569.md): WordPress Ditty plugin \<= 3.1.31 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Metaphor Creations Ditty)
- [CVE-2024-26921](https://cve.now/CVE-2024-26921.md): inet: inet\_defrag: prevent sk release while still in use (CVSS 7.8, Linux)
- [CVE-2024-32570](https://cve.now/CVE-2024-32570.md): WordPress Cornerstone plugin \<= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Archetyped Cornerstone)
- [CVE-2024-32571](https://cve.now/CVE-2024-32571.md): WordPress WP Stripe Checkout plugin \<= 1.2.2.41 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, naa986 WP Stripe Checkout)
- [CVE-2024-32572](https://cve.now/CVE-2024-32572.md): WordPress Element Pack Elementor Addons plugin \<= 5.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BdThemes Element Pack Elementor Addons)
- [CVE-2024-32573](https://cve.now/CVE-2024-32573.md): WordPress WP-Lister Lite for eBay plugin \<=3.5.11 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP Lab WP-Lister Lite for eBay)
- [CVE-2024-32574](https://cve.now/CVE-2024-32574.md): WordPress WP Simple HTML Sitemap plugin \<= 2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ashish Ajani WP Simple HTML Sitemap)
- [CVE-2024-32575](https://cve.now/CVE-2024-32575.md): WordPress Mega Elements plugin \<= 1.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kraftplugins Mega Elements)
- [CVE-2024-32576](https://cve.now/CVE-2024-32576.md): WordPress BA Book Everything plugin \<= 1.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Booking Algorithms BA Book Everything)
- [CVE-2024-32577](https://cve.now/CVE-2024-32577.md): WordPress CBX Bookmark & Favorite plugin \<= 1.7.20 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Codeboxr Team CBX Bookmark & Favorite)
- [CVE-2024-2833](https://cve.now/CVE-2024-2833.md): Jobs for WordPress \<= 2.7.5 - Reflected Cross-Site Scripting via job-search (CVSS 6.1, blueglassch Job Postings)
- [CVE-2024-32578](https://cve.now/CVE-2024-32578.md): WordPress Sliderby10Web plugin \<= 1.2.54 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Slider by 10Web)
- [CVE-2024-32579](https://cve.now/CVE-2024-32579.md): WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin \<= 2.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GloriaFood Restaurant Menu – Food Ordering System – Table R…)
- [CVE-2024-32580](https://cve.now/CVE-2024-32580.md): WordPress Master Slider plugin \<= 3.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Averta Master Slider)
- [CVE-2024-32581](https://cve.now/CVE-2024-32581.md): WordPress Mortgage Calculators WP plugin \<= 1.56 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Lenderd Mortgage Calculators WP)
- [CVE-2024-32582](https://cve.now/CVE-2024-32582.md): WordPress Debug Log Manager plugin \<= 2.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bowo Debug Log Manager)
- [CVE-2024-32583](https://cve.now/CVE-2024-32583.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.21 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Photo Gallery Team Photo Gallery by 10Web)
- [CVE-2024-32584](https://cve.now/CVE-2024-32584.md): WordPress TeraWallet plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, StandaloneTech TeraWallet – For WooCommerce)
- [CVE-2024-32585](https://cve.now/CVE-2024-32585.md): WordPress Import Content in WordPress & WooCommerce with Excel plugin \<= 4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, extendWP Import Content in WordPress & WooCommerce with Exc…)
- [CVE-2024-32586](https://cve.now/CVE-2024-32586.md): WordPress Gutenberg Block Editor Toolkit plugin \<= 1.40.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Munir Kamal Gutenberg Block Editor Toolkit)
- [CVE-2024-29003](https://cve.now/CVE-2024-29003.md): SolarWinds Platform Cross Site Scripting Vulnerability (CVSS 7.5, SolarWinds Platform)
- [CVE-2024-29001](https://cve.now/CVE-2024-29001.md): SolarWinds Platform SWQL Injection Vulnerability (CVSS 7.5, SolarWinds Platform)
- [CVE-2024-28076](https://cve.now/CVE-2024-28076.md): SolarWinds Platform Arbitrary Open Redirection Vulnerability (CVSS 7.0, SolarWinds Platform)
- [CVE-2024-32587](https://cve.now/CVE-2024-32587.md): WordPress EnvíaloSimple plugin \<= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 5.8, EnvialoSimple EnvíaloSimple)
- [CVE-2024-32588](https://cve.now/CVE-2024-32588.md): WordPress LearnPress Export Import plugin \<= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThimPress LearnPress Export Import)
- [CVE-2024-32590](https://cve.now/CVE-2024-32590.md): WordPress Kattene plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Webfood Kattene)
- [CVE-2024-32591](https://cve.now/CVE-2024-32591.md): WordPress Backend Designer plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Daniele De Rosa Backend Designer)
- [CVE-2024-32592](https://cve.now/CVE-2024-32592.md): WordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, VoidCoders, innovs Void Elementor WHMCS Elements For Elemen…)
- [CVE-2024-32593](https://cve.now/CVE-2024-32593.md): WordPress WPBITS Addons For Elementor Page Builder plugin \<= 1.3.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPBITS Addons For Elementor Page Builder)
- [CVE-2024-32594](https://cve.now/CVE-2024-32594.md): WordPress Attesa Extra plugin \<= 1.3.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, AttesaWP Attesa Extra)
- [CVE-2024-32595](https://cve.now/CVE-2024-32595.md): WordPress WP Helper Premium plugin \< 4.6.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mat Bao WP Helper Premium)
- [CVE-2024-32596](https://cve.now/CVE-2024-32596.md): WordPress DSGVO Youtube plugin \<= 1.4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Eric-Oliver Mächler DSGVO Youtube)
- [CVE-2024-32597](https://cve.now/CVE-2024-32597.md): WordPress WP Smart Import plugin \<= 1.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Xylus Themes WordPress Importer)
- [CVE-2024-32598](https://cve.now/CVE-2024-32598.md): WordPress BA Book Everything plugin \<= 1.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Booking Algorithms BA Book Everything)
- [CVE-2024-32599](https://cve.now/CVE-2024-32599.md): WordPress WP Dummy Content Generator plugin \<= 3.2.1 - Arbitrary Code Execution vulnerability (CVSS 10.0, Deepak anand WP Dummy Content Generator)
- [CVE-2024-32601](https://cve.now/CVE-2024-32601.md): WordPress Popup Anything plugin \<= 2.8 - Broken Access Control vulnerability (CVSS 5.3, WP OnlineSupport, Essential Plugin Popup Anything)
- [CVE-2024-32603](https://cve.now/CVE-2024-32603.md): WordPress WooBuddy plugin \<= 3.4.20 - PHP Object Injection vulnerability (CVSS 8.5, ThemeKraft WooBuddy)
- [CVE-2024-32604](https://cve.now/CVE-2024-32604.md): WordPress WP-Recall plugin \<= 16.26.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Plechev Andrey WP-Recall)
- [CVE-2023-41864](https://cve.now/CVE-2023-41864.md): WordPress PeproDev CF7 Database plugin \<= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Pepro Dev. Group PeproDev CF7 Database)
- [CVE-2023-49742](https://cve.now/CVE-2023-49742.md): WordPress Support Genix plugin \<= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerability (CVSS 9.9, Support Genix)
- [CVE-2024-32142](https://cve.now/CVE-2024-32142.md): WordPress Ovic Responsive WPBakery plugin \<= 1.3.0 - Broken Access Control vulnerability (CVSS 5.4, Ovic Team Ovic Responsive WPBakery)
- [CVE-2024-31869](https://cve.now/CVE-2024-31869.md): Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used (CVSS 5.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-2729](https://cve.now/CVE-2024-2729.md): Otter Blocks \< 2.6.6 - Contributor+ Stored XSS (CVSS 6.1, Otter Blocks)
- [CVE-2024-1429](https://cve.now/CVE-2024-1429.md): Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \<= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Panel Slider Widget (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-1426](https://cve.now/CVE-2024-1426.md): Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \<= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price List Widget (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-29956](https://cve.now/CVE-2024-29956.md): cleartext password in supportsave logs when a user schedules a switch Supportsave from Brocade SANnav (CVSS 6.5, Brocade SANnav)
- [CVE-2024-3932](https://cve.now/CVE-2024-3932.md): Totara LMS User Selector cross-site request forgery (CVSS 2.3, Totara LMS)
- [CVE-2024-3931](https://cve.now/CVE-2024-3931.md): Totara LMS User Selector check.php cross site scripting (CVSS 5.1, Totara LMS)
- [CVE-2024-30564](https://cve.now/CVE-2024-30564.md): An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted (CVSS 9.8, @andrei-tatar/nora-firebase-common)
- [CVE-2024-30920](https://cve.now/CVE-2024-30920.md): Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php (CVSS 7.4)
- [CVE-2024-30921](https://cve.now/CVE-2024-30921.md): Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component (CVSS 5.4)
- [CVE-2024-30922](https://cve.now/CVE-2024-30922.md): SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rende (CVSS 9.8)
- [CVE-2024-30923](https://cve.now/CVE-2024-30923.md): SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Docu (CVSS 9.8)
- [CVE-2024-30924](https://cve.now/CVE-2024-30924.md): Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component. (CVSS 4.6)
- [CVE-2024-30925](https://cve.now/CVE-2024-30925.md): Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the photo-thumbs.php component. (CVSS 6.5)
- [CVE-2024-30926](https://cve.now/CVE-2024-30926.md): Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component. (CVSS 4.6)
- [CVE-2024-30927](https://cve.now/CVE-2024-30927.md): Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the racer-results.php component (CVSS 6.3)
- [CVE-2024-30928](https://cve.now/CVE-2024-30928.md): SQL Injection vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary SQL commands via 'classids' Parameter in ajax/q (CVSS 8.1)
- [CVE-2024-30929](https://cve.now/CVE-2024-30929.md): Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the 'back' Parameter in playlis (CVSS 8.0)
- [CVE-2024-30938](https://cve.now/CVE-2024-30938.md): SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to obtain sensitive information via the ID parameter in the SEMCMS\_User (CVSS 9.8)
- [CVE-2024-31750](https://cve.now/CVE-2024-31750.md): SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req\_id parameter. (CVSS 9.8)
- [CVE-2024-32325](https://cve.now/CVE-2024-32325.md): TOTOLINK EX200 V4.0.3c.7646\_B20201211 contains a Cross-site scripting (XSS) vulnerability through the ssid parameter in the setWiFiExtenderC (CVSS 2.4)
- [CVE-2024-32326](https://cve.now/CVE-2024-32326.md): TOTOLINK EX200 V4.0.3c.7646\_B20201211 contains a Cross-site scripting (XSS) vulnerability through the key parameter in the setWiFiExtenderCo (CVSS 6.8)
- [CVE-2024-32327](https://cve.now/CVE-2024-32327.md): TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in Port Forwarding under the Firewall Page. (CVSS 5.5)
- [CVE-2024-32332](https://cve.now/CVE-2024-32332.md): TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in WDS Settings under the Wireless Page. (CVSS 6.1)
- [CVE-2024-32333](https://cve.now/CVE-2024-32333.md): TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page. (CVSS 4.3)
- [CVE-2024-32334](https://cve.now/CVE-2024-32334.md): TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firewall Page (CVSS 6.5)
- [CVE-2024-32335](https://cve.now/CVE-2024-32335.md): TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in Access Control under the Wireless Page. (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.