CVEs published April 19, 2024
114 CVEs were published on April 19, 2024: 7 critical, 54 high.
- Published
- 114
- Critical
- 7
- High
- 54
- Medium
- 47
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 53
Most affected products
- Ivanti Avalanche
- 25
- Brocade SANnav
- 13
- IBM Aspera Faspex
- 6
- GitHub Enterprise Server
- 4
- mealie-recipes mealie
- 4
- usememos memos · github.com/usememos/memos
- 3
- wazuh
- 3
- BeyondTrust U-Series Appliance
- 2
- Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- 1
- Arm Midgard GPU Kernel Driver · Arm Bifrost GPU Kernel D… +2
- 1
Critical 7
- CVE-2024-32644Evmos' transaction execution not accounting for all state transition after interaction with precompilesevmos · github.com/evmos/evmos/v16 +21
- CVE-2024-32038Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerabilitywazuh
- CVE-2024-24996A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to eIvanti Avalanche
- CVE-2024-29204A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to eIvanti Avalanche
- CVE-2023-47435An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protected
- CVE-2024-31546Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/damage/view_damage.php.
- CVE-2024-31547Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/item/view_item.php.
High 54
- CVE-2024-1480Unitronics Vision Standard Unauthenticated Password RetrievalUnitronics Vision230 · Unitronics Vision280 +3
- CVE-2024-4017Privilege Escalation in U-Series ApplianceBeyondTrust U-Series Appliance
- CVE-2024-4018Privilege Escalation in U-Series ApplianceBeyondTrust U-Series Appliance
- CVE-2024-32652@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsedhonojs node-server · @hono/node-server
- CVE-2024-32650Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client inputrustls
- CVE-2023-50260Wazuh's vulnerability in host_deny AR script allows arbitrary command executionwazuh
- CVE-2024-3684Improper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management ConsoleGitHub Enterprise Server
- CVE-2024-3646Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management ConsoleGitHub Enterprise Server
- CVE-2023-37400IBM Aspera Faspex privilege escalationIBM Aspera Faspex
- CVE-2024-29969TLS/SSL weak message authentication code ciphers are added by default for port 18082Brocade SANnav
- CVE-2024-29968SQL Table names, column names, and SQL queries are collected in DR standby SupportsaveBrocade SANnav
- CVE-2024-29966hard-coded credentials in the documentation that appear as the appliance root passwordBrocade SANnav
- CVE-2024-29961supply-chain attack riskBrocade SANnav
- CVE-2024-29959Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support saveBrocade SANnav
- CVE-2024-29958Encryption key in the console when a privileged user executes the script to replace the Brocade SANnav Management Portal standby node.Brocade SANnav
- CVE-2024-29957Encryption key is stored in the DR log filesBrocade SANnav
- CVE-2024-3600Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site Scriptingays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…
- CVE-2024-22061A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to exIvanti Avalanche
- CVE-2024-25000A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryIvanti Avalanche
- CVE-2024-27977A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete arbitrary Ivanti Avalanche
- CVE-2024-24992A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryIvanti Avalanche
- CVE-2024-23532An out-of-bounds Read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attackerIvanti Avalanche
- CVE-2024-23535A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryIvanti Avalanche
- CVE-2024-24998A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryIvanti Avalanche
- CVE-2024-24995A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute Ivanti Avalanche
- CVE-2024-24993A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute Ivanti Avalanche
- CVE-2024-24999A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryIvanti Avlanche
- CVE-2024-24997A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryIvanti Avalanche
- CVE-2024-24994A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryIvanti Avalanche
- CVE-2024-23534An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to executIvanti Avalanche
- CVE-2024-23531An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker Ivanti Avalanche
- CVE-2024-27976A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryIvanti Avalanche
- CVE-2024-27975An Use-after-free vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to eIvanti Avalanche
- CVE-2024-27984A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete specific tIvanti Avalanche
- CVE-2023-49501Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output func
- CVE-2023-49502Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra
- CVE-2023-49963DYMO LabelWriter Print Server through 2.366 contains a backdoor hard-coded password that could allow an attacker to take control.
- CVE-2023-50008FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9
- CVE-2023-50009FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 com
- CVE-2023-50010FFmpeg v.n6.1-3-g466799d4f5 allows a buffer over-read at ff_gradfun_blur_line_movdqa_sse2, as demonstrated by a call to the set_encoder_id f
- CVE-2023-51791Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_pa
- CVE-2023-51793Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c
- CVE-2023-51795Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_show
- CVE-2023-51798Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point excepti
- CVE-2024-22640TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.tecnickcom/tcpdf
- CVE-2024-22905Buffer Overflow vulnerability in ARM mbed-os v.6.17.0 allows a remote attacker to execute arbitrary code via a crafted script to the hciTrSe
- CVE-2024-30974SQL Injection vulnerability in autoexpress v.1.3.0 allows attackers to run arbitrary SQL commands via the carId parameter.
- CVE-2024-31552CuteHttpFileServer v.3.1 version has an arbitrary file download vulnerability, which allows attackers to download arbitrary files on the ser
- CVE-2024-31744In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing att
- CVE-2024-31841An issue was discovered in Italtel Embrace 1.6.4.
- CVE-2024-31846An issue was discovered in Italtel Embrace 1.6.4.
- CVE-2024-32166Webid v1.2.1 suffers from an Insecure Direct Object Reference (IDOR) - Broken Access Control vulnerability, allowing attackers to buy now an
- CVE-2024-32391Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload.
- CVE-2024-32409An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script.
Medium, low and unrated 53
- CVE-2024-31994Mealie vulnerable to a DoS in recipe image importer (GHSL-2023-228)mealie-recipes mealie
- CVE-2024-31993Mealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227)mealie-recipes mealie
- CVE-2024-31992Mealie contains a DoS vulnerability in recipe importermealie-recipes mealie
- CVE-2024-31991Mealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225)mealie-recipes mealie
- CVE-2024-1681Log Injection Vulnerability in corydolphin/flask-corscorydolphin/flask-cors · flask-cors
- CVE-2024-31450Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)owncast · github.com/owncast/owncast
- CVE-2024-3979COVESA vsomeip race conditionCOVESA vsomeip
- CVE-2024-2440Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissionsGitHub Enterprise Server
- CVE-2022-40745IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2023-37397IBM Aspera Faspex data manipulationIBM Aspera Faspex
- CVE-2024-29991Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2023-27279IBM Aspera Faspex denial of serviceIBM Aspera Faspex
- CVE-2023-37396IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2024-29183OpenRASP vulnerable to a reflected Cross-Site Scripting (XSS) attack in /loginbaidu openrasp
- CVE-2023-22869IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2024-29029memos vulnerable to an SSRF in /o/get/imageusememos memos · github.com/usememos/memos
- CVE-2024-29028memos vulnerable to an SSRF in /o/get/httpmetausememos memos · github.com/usememos/memos
- CVE-2024-29030memos vulnerable to an SSRF in /api/resourceusememos memos · github.com/usememos/memos
- CVE-2024-32478Git Credential Manager (GCM)'s Debian package does not set root ownership on installed filesgit-ecosystem git-credential-manager
- CVE-2023-49275Wazuh vulnerable to NULL Pointer Dereference in wazuh-analysisdwazuh
- CVE-2024-3470Repository administrator can bypass organization's ruleset using deploy keysGitHub Enterprise Server
- CVE-2024-3654Cross-Site Scripting Vulnerability in Teixo by Teimas GlobalTeimas Global Teixo
- CVE-2024-32683WordPress WP Ultimate Review plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerabilityWpmet Wp Ultimate Review
- CVE-2024-1065Mali GPU Kernel Driver allows improper GPU memory processing operationsArm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- CVE-2024-0671Mali GPU Kernel Driver allows improper GPU memory processing operationsArm Midgard GPU Kernel Driver · Arm Bifrost GPU Kernel D… +2
- CVE-2024-29967In Brocade SANnav before v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount pointsBrocade SANnav
- CVE-2024-2761Genesis Blocks < 3.1.3 - Contributor+ Stored XSSGenesis Blocks
- CVE-2024-29965Insecure backupBrocade SANnav
- CVE-2024-29964Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker filesBrocade SANnav
- CVE-2024-29962Insecure file permission setting that makes files world-readableBrocade SANnav
- CVE-2024-29963Brocade SANnav contains hardcoded TLS keys used by DockerBrocade SANnav
- CVE-2024-29960Identical SSH keys utilized inside the OVA image (CVE-2024-29960)Brocade SANnav
- CVE-2024-3731Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's'ivole Customer Reviews for WooCommerce
- CVE-2024-3818Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.9 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting via "Social Icons" Blockwpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2024-3615Media Library Folders <= 8.2.0 - Reflected Cross-Site Scripting via 's'maxfoundry Media Library Folders
- CVE-2024-3598ElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ekit_btn_id'wpmet ElementsKit Pro
- CVE-2024-3560LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-23526An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unaIvanti Avalanche
- CVE-2024-23529An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unaIvanti Avalanche
- CVE-2024-23528An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unaIvanti Avalanche
- CVE-2024-24991A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attIvanti Avalanche
- CVE-2024-27978A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attIvanti Avalanche
- CVE-2024-23533An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an autIvanti Avalanche
- CVE-2024-23530An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unaIvanti Avalanche
- CVE-2023-50007FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thel
- CVE-2023-51792Buffer Overflow vulnerability in libde265 v1.0.12 allows a local attacker to cause a denial of service via the allocation size exceeding the
- CVE-2023-51796Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/f_revers
- CVE-2023-51797Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_show
- CVE-2024-27752Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the Default Keyword field in th
- CVE-2024-31584Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.torch
- CVE-2024-31587SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a
- CVE-2024-32206A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute a
- CVE-2024-32392Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component.