CVEs published April 22, 2024
78 CVEs were published on April 22, 2024: 13 critical, 27 high. 2 are now in CISA KEV.
- Published
- 78
- Critical
- 13
- High
- 27
- Medium
- 34
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 23
Most affected products
- FreeRDP
- 6
- librenms · librenms/librenms
- 3
- BdThemes Prime Slider – Addons For Elementor
- 2
- Ant-Media-Server · io.antmedia:ant-media-server
- 1
- Apache Software Foundation Apache HugeGraph-Hubble · org.ap…
- 1
- Apache Software Foundation Apache HugeGraph-Server · org… +1
- 1
- Apache Software Foundation Apache HugeGraph-Server · org.ap…
- 1
- Creative interactive media 3D FlipBook, PDF Viewer, PDF Emb…
- 1
- CrushFTP
- 1
- Essential Addons for Elementor Pro
- 1
Critical 13
- CVE-2024-32459FreeRDP Out-Of-Bounds Read in ncrush_decompressFreeRDP
- CVE-2024-32458FreeRDP Out-Of-Bounds Read in planar_skip_plane_rleFreeRDP
- CVE-2024-32041FreeRDP OutOfBound Read in zgfx_decompress_segmentFreeRDP
- CVE-2024-32039FreeRDP Integer overflow & OutOfBound Write in clear_decompress_residual_dataFreeRDP
- CVE-2024-4040Unauthenticated arbitrary file read and remote code execution in CrushFTPCrushFTP
- CVE-2024-27349Apache HugeGraph-Server: Bypass whitelist in Auth modeApache Software Foundation Apache HugeGraph-Server · org.ap…
- CVE-2024-27348Apache HugeGraph-Server: Command execution in gremlinApache Software Foundation Apache HugeGraph-Server · org… +1
- CVE-2024-27574SQL Injection vulnerability in Trainme Academy version Ichin v.1.3.2 allows a remote attacker to obtain sensitive information via the inform
- CVE-2024-29661A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.
- CVE-2024-31545Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manage_user&id=6.
- CVE-2024-31666An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit_addon_post.php component.
- CVE-2024-32238H3C ER8300G2-X is vulnerable to Incorrect Access Control.
- CVE-2024-32418An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add_addon.php component.
High 27
- CVE-2024-32656Ant Media Server vulnerable to local privilege escalationAnt-Media-Server · io.antmedia:ant-media-server
- CVE-2024-32480LibreNMS's Time-Based Blind SQL injection leads to database extractionlibrenms · librenms/librenms
- CVE-2024-32479LibreNMS's Improper Sanitization on Service template name leads to Stored XSSlibrenms · librenms/librenms
- CVE-2024-32461LibreNMS vulnerable to time-based SQL injection that leads to database extractionlibrenms · librenms/librenms
- CVE-2024-32460FreeRDP Out-Of-Bounds Read in interleaved_decompressFreeRDP
- CVE-2024-32040FreeRDP vulnerable to integer underflow in nsc_rle_decodeFreeRDP
- CVE-2024-32682WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerabilityBdThemes Prime Slider – Addons For Elementor
- CVE-2024-32693WordPress Automatic plugin < 3.93.0 - Multiple Cross Site Request Forgery (CSRF) vulnerabilityValvePress Automatic
- CVE-2024-32695WordPress Language Switcher for Transposh plugin <= 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerabilityMarco Gasi Language Switcher for Transposh
- CVE-2024-32694WordPress 3D FlipBook, PDF Viewer, PDF Embedder plugin <= 3.62 - Reflected Cross Site Scripting (XSS) vulnerabilityCreative interactive media 3D FlipBook, PDF Viewer, PDF Emb…
- CVE-2022-34560A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2022-35503Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM m
- CVE-2023-38290Certain software builds for the BLU View 2 and Sharp Rouvo V Android devices contain a vulnerable pre-installed app with a package name of c
- CVE-2023-38291An issue was discovered in a third-party component related to ro.boot.wifimacaddr, shipped on devices from multiple device manufacturers.
- CVE-2023-38292Certain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmen
- CVE-2023-38293Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a vulnerable, pre-installed app with a package name of com
- CVE-2023-38295Certain software builds for the TCL 30Z and TCL 10 Android devices contain a vulnerable, pre-installed app that relies on a missing permissi
- CVE-2023-38296Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local
- CVE-2023-38297An issue was discovered in a third-party com.factory.mmigroup component, shipped on devices from multiple device manufacturers.
- CVE-2023-38298Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed b
- CVE-2024-22808An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the com
- CVE-2024-22811An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the com
- CVE-2024-28699A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev
- CVE-2024-32368Insecure Permission vulnerability in Agasta Sanketlife 2.0 Pocket 12-Lead ECG Monitor FW Version 3.0 allows a local attacker to cause a deni
- CVE-2024-32394An issue in ruijie.com/cn RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S_07150910 and RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S
- CVE-2024-32399Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via
- CVE-2024-32407An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feat
Medium, low and unrated 38
- CVE-2024-3177Bypassing mountable secrets policy imposed by the ServiceAccount admission pluginKubernetes · k8s.io/kubernetes
- CVE-2024-32657Hydra has persistent XSS vulnerability serving HTML build outputsNixOS hydra
- CVE-2024-32653Insufficient input filtering of "package name" allows command execution in the device with shell privilegesskylot jadx
- CVE-2024-27347Apache HugeGraph-Hubble: SSRF in Hubble connection pageApache Software Foundation Apache HugeGraph-Hubble · org.ap…
- CVE-2024-3645Essential Addons for Elementor Pro <= 5.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_html_tag'Essential Addons for Elementor Pro
- CVE-2024-4026Cross-Site Scripting in the Holded applicationHolded
- CVE-2024-32681WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerabilityBdThemes Prime Slider – Addons For Elementor
- CVE-2024-32684WordPress WP Ultimate Review plugin <= 2.2.5 - Broken Access Control on Review vulnerabilityWpmet Wp Ultimate Review
- CVE-2024-32687WordPress WPC Frequently Bought Together for WooCommerce plugin <= 7.0.3 - Broken Access Control vulnerabilityWPClever WPC Frequently Bought Together for WooCommerce
- CVE-2024-32688WordPress MyRewards plugin <= 5.3.0 - Broken Access Control vulnerabilityLong Watch Studio MyRewards
- CVE-2024-32691WordPress Active Products Tables for WooCommerce plugin <= 1.0.6.2 - Broken Access Control vulnerabilityrealmag777 Active Products Tables for WooCommerce
- CVE-2024-32698WordPress Happy Addons for Elementor plugin <= 3.10.4 - Cross Site Scripting (XSS) vulnerabilityHappyMonster Happy Addons for Elementor
- CVE-2024-32697WordPress HelloAsso plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerabilityHelloAsso
- CVE-2024-32696WordPress AI Infographic Maker OpenAI plugin <= 4.6.6 - Cross Site Scripting (XSS) vulnerabilityQuantumCloud Infographic Maker – iList
- CVE-2024-32690WordPress RSS Feed Widget plugin <= 2.9.7 - Cross Site Scripting (XSS) vulnerabilityFahad Mahmood RSS Feed Widget
- CVE-2023-7252Tickera < 3.5.2.5 - Ticket leakage through IDORTickera
- CVE-2018-25101l2c2technologies Koha opac-MARCdetail.pl cross site scriptingl2c2technologies Koha
- CVE-2022-34561A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2022-34562A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2022-46897An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2023-38294Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsi
- CVE-2023-38299Various software builds for the AT&T Calypso, Nokia C100, Nokia C200, and BLU View 3 devices leak the device IMEI to a system property that
- CVE-2023-38300A certain software build for the Orbic Maui device (Orbic/RC545L/RC545L:10/ORB545L_V1.4.2_BVZPP/230106:user/release-keys) leaks the IMEI and
- CVE-2023-38301An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple device manufacturers.
- CVE-2023-38302A certain software build for the Sharp Rouvo V device (SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_530:user/release-keys) leak
- CVE-2024-22807An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to erase a critical sector of the flash memory, causing
- CVE-2024-22809Incorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder and
- CVE-2024-22813An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memo
- CVE-2024-22815An issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Servi
- CVE-2024-22856A SQL injection vulnerability via the Save Favorite Search function in Axefinance Axe Credit Portal >= v.3.0 allows authenticated attackers
- CVE-2024-28436Cross Site Scripting vulnerability in D-Link DAP products DAP-2230, DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2590, DAP-2690, DAP-2695, DA
- CVE-2024-28717An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.storlets
- CVE-2024-28722Cross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the qu
- CVE-2024-29368An arbitrary file upload vulnerability in the file handling module of moziloCMS v2.0 allows attackers to bypass extension restrictions via f
- CVE-2024-29376Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.sylius/sylius
- CVE-2024-30799An issue in PX4 Autopilot v1.14 and before allows a remote attacker to execute arbitrary code and cause a denial of service via the Breach R
- CVE-2024-31036A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of service via transmis
- CVE-2024-32405Cross Site Scripting vulnerability in inducer relate before v.2024.1 allows a remote attacker to escalate privileges via a crafted payload t