CVEs published April 23, 2024
63 CVEs were published on April 23, 2024: 4 critical, 20 high.
- Published
- 63
- Critical
- 4
- High
- 20
- Medium
- 31
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Kashipara Online Furniture Shopping Ecommerce Website
- 7
- FreeRDP
- 5
- Tenda AC8
- 3
- WPMU DEV Forminator
- 3
- wproyal Royal Addons for Elementor – Addons and Templates K…
- 3
- AMD Software: Adrenalin Edition · AMD Software: PRO Edition
- 2
- advancedcoding Comments – wpDiscuz
- 1
- Anssi Laitila Shared Files
- 1
- Bkav Home
- 1
- edmundhung conform · @conform-to/dom +2
- 1
Critical 4
- CVE-2024-32659freerdp_image_copy out of bound readFreeRDP
- CVE-2024-32658FreeRDP ExtractRunLengthRegular* out of bound readFreeRDP
- CVE-2024-21511Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parametemysql2
- CVE-2024-33215Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/go
High 20
- CVE-2024-32866Conform contains Prototype Pollution Vulnerability in `parseWith...` functionedmundhung conform · @conform-to/dom +2
- CVE-2024-4066Tenda AC8 AdvSetMacMtuWan fromAdvSetMacMtuWan stack-based overflowTenda AC8
- CVE-2024-32662FreeRDP rdp_redirection_read_base64_wchar out of bound readFreeRDP
- CVE-2024-32661FreeRDP rdp_write_logon_info_v1 NULL accessFreeRDP
- CVE-2024-32660FreeRDP zgfx_decompress out of memory vulnerabilityFreeRDP
- CVE-2024-4065Tenda AC8 SetRebootTimer formSetRebootTimer stack-based overflowTenda AC8
- CVE-2024-4064Tenda AC8 execCommand R7WebsSecurityHandler stack-based overflowTenda AC8
- CVE-2024-28130An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8.OFFIS DCMTK
- CVE-2024-26922drm/amdgpu: validate the parameters of bo mapping operations more clearlyLinux
- CVE-2024-2493Session Hijacking Vulnerability in Hitachi Ops Center AnalyzerHitachi Ops Center Analyzer
- CVE-2024-31077Forminator prior to 1.29.3 contains a SQL injection vulnerability.WPMU DEV Forminator
- CVE-2024-3293rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Contributor+) SQL Injection via rtmedia_gallery Shortcodertcamp rtMedia for WordPress, BuddyPress and bbPress
- CVE-2023-48183QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval.
- CVE-2024-28627An issue in Flipsnack v.18/03/2024 allows a local attacker to obtain sensitive information via the reader.gz.js file.
- CVE-2024-31616An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2, Release(0715
- CVE-2024-32258The network server of fceux 2.7.0 has a path traversal vulnerability, allowing attackers to overwrite any files on the server without authen
- CVE-2024-33211Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the PPPOEPassword parameter in ip/g
- CVE-2024-33212Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter in ip/gofor
- CVE-2024-33214Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter in ip/goform/R
- CVE-2024-33217Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter in ip/goform/add
Medium, low and unrated 39
- CVE-2024-4075Kashipara Online Furniture Shopping Ecommerce Website login.php cross site scriptingKashipara Online Furniture Shopping Ecommerce Website
- CVE-2024-4074Kashipara Online Furniture Shopping Ecommerce Website prodInfo.php cross site scriptingKashipara Online Furniture Shopping Ecommerce Website
- CVE-2024-4073Kashipara Online Furniture Shopping Ecommerce Website prodList.php cross site scriptingKashipara Online Furniture Shopping Ecommerce Website
- CVE-2024-4072Kashipara Online Furniture Shopping Ecommerce Website search.php cross site scriptingKashipara Online Furniture Shopping Ecommerce Website
- CVE-2024-4071Kashipara Online Furniture Shopping Ecommerce Website prodInfo.php sql injectionKashipara Online Furniture Shopping Ecommerce Website
- CVE-2024-4070Kashipara Online Furniture Shopping Ecommerce Website prodList.php sql injectionKashipara Online Furniture Shopping Ecommerce Website
- CVE-2024-4069Kashipara Online Furniture Shopping Ecommerce Website search.php sql injectionKashipara Online Furniture Shopping Ecommerce Website
- CVE-2024-32875Hugo doesn't escape markdown title in internal render hooksgohugoio hugo · github.com/gohugoio/hugo
- CVE-2024-32869Hono vulnerable to Restricted Directory Traversal in serveStatic with denohonojs hono · hono
- CVE-2024-4063EZVIZ CS-C6-21WFR-8 Davinci Application certificate validationEZVIZ CS-C6-21WFR-8
- CVE-2024-4062Hualai Xiaofang iSC5 certificate validationHualai Xiaofang iSC5
- CVE-2024-32482Tillitis TKey Signer possible RAM disclosure vulnerabilitytillitis tkey-device-signer
- CVE-2024-31208Synapse's V2 state resolution weakness allows DoS from remote room memberselement-hq synapse · matrix-synapse
- CVE-2024-21979 An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformedAMD Software: Adrenalin Edition · AMD Software: PRO Edition
- CVE-2024-21972 An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformedAMD Software: Adrenalin Edition · AMD Software: PRO Edition
- CVE-2024-32679WordPress Shared Files plugin <= 1.7.16 - Broken Access Control vulnerabilityAnssi Laitila Shared Files
- CVE-2024-2477wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Textadvancedcoding Comments – wpDiscuz
- CVE-2023-47731IBM QRadar Suite Software cross-site scriptingIBM QRadar Suite Software · IBM Cloud Pak for Security
- CVE-2024-3911Welotec: Clickjacking Vulnerability in WebUIWelotec SMART EMS · Welotec VPN Security Suite
- CVE-2024-3491Schema & Structured Data for WP & AMP <= 1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via How To and FAQ Blocksmagazine3 Schema & Structured Data for WP & AMP
- CVE-2024-3732GeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcodepaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2024-3665Rank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…
- CVE-2024-3185Rapid7 Insight Agent Sensitive Key Exposed To Local UsersRapid7 Insight Agent
- CVE-2024-0900Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! <= 2.1.2 - Missing Authorization to Subscriber+ Arbitrary Post CreationEleSpare – News, Magazine and Blog Addons for Elementor
- CVE-2024-3664Quick Featured Images <= 13.7.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Thumbnail Deletion/Settingkybernetikservices Quick Featured Images
- CVE-2024-4031MEVO WEBCAM APP Windows Unquoted Service Path VulnerabilityLogitech MEVO WEBCAM APP
- CVE-2023-6833Information Exposure Vulnerability in Hitachi Ops Center AdministratorHitachi Ops Center Administrator
- CVE-2024-3889Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title Tagswproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-2798Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-2799Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tagswproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-28890Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability.WPMU DEV Forminator
- CVE-2024-31857Forminator prior to 1.15.4 contains a cross-site scripting vulnerability.WPMU DEV Forminator
- CVE-2024-1241Watchdog Antivirus v1.6.415 - Denial of ServiceWatchdog Antivirus
- CVE-2024-2760Bkav Home v7816, build 2403161130 - Kernel Memory LeakBkav Home
- CVE-2023-48184QuickJS before 7414e5f has a quickjs.h JS_FreeValueRT use-after-free because of incorrect garbage collection of async functions with closure
- CVE-2024-30800PX4 Autopilot v.1.14 allows an attacker to fly the drone into no-fly zones by breaching the geofence using flaws in the function.
- CVE-2024-30886A stored cross-site scripting (XSS) vulnerability in the remotelink function of HadSky v7.6.3 allows attackers to execute arbitrary web scri
- CVE-2024-31804An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privileges via the Program.
- CVE-2024-33213Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/go