CVEs published April 24, 2024
130 CVEs were published on April 24, 2024: 9 critical, 48 high. 2 are now in CISA KEV.
- Published
- 130
- Critical
- 9
- High
- 48
- Medium
- 69
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 24
Most affected products
- Tenda W15E
- 13
- Tenda TX9
- 4
- Linux
- 3
- Better Comments
- 2
- BloomPixel Max Addons Pro for Bricks
- 2
- Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- 2
- Cisco TelePresence Management Suite
- 2
- Cisco Unified Computing System
- 2
- Dell Repository Manager
- 2
- Foliovision FV Flowplayer Video Player
- 2
Critical 9
- CVE-2023-51477WordPress BuddyBoss Theme theme <= 2.4.60 - Unauth. Arbitrary WordPress Settings Change vulnerabilityBUDDYBOSS DMCC BuddyBoss Theme
- CVE-2023-51472WordPress Checkout Mestres WP plugin <= 7.1.9.7 - Unauthenticated Account Takeover vulnerabilityMestres do WP Checkout Mestres WP
- CVE-2023-51425WordPress Rencontre plugin <= 3.10.1 - Unauthenticated Account Takeover vulnerabilityJacques Malgrange Rencontre – Dating Site
- CVE-2023-31090WordPress Unlimited Elements For Elementor plugin <= 1.5.60 - Unrestricted Zip Extraction vulnerabilityUnlimited Elements For Elementor
- CVE-2024-32954WordPress Newsletters plugin <= 4.9.5 - Arbitrary File Upload vulnerabilityTribulant Newsletters
- CVE-2024-32709WordPress WP-Recall plugin <= 16.26.5 - SQL Injection vulnerabilityPlechev Andrey WP-Recall
- CVE-2024-32836WordPress WP-Lister Lite for eBay plugin <= 3.5.11 - Arbitrary File Upload vulnerabilityWP Lab WP-Lister Lite for eBay
- CVE-2024-32948WordPress ARMember – Membership Plugin plugin <= 4.0.28 - Broken Access Control vulnerabilityRepute Infosystems ARMember
- CVE-2024-28613SQL Injection vulnerability in PHP Task Management System v.1.0 allows a remote attacker to escalate privileges and obtain sensitive informa
High 48
- CVE-2024-26926binder: check offset alignment in binder_get_object()Linux
- CVE-2024-29205An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti PIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-26925netfilter: nf_tables: release mutex after nft_gc_seq_end from abort pathLinux
- CVE-2024-26924netfilter: nft_set_pipapo: do not free live elementLinux
- CVE-2024-26923af_unix: Fix garbage collector racing against connect()Linux · :linux_kernel:
- CVE-2024-20313A vulnerability in the OSPF version 2 (OSPFv2) feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause aCisco IOS XE Software
- CVE-2024-20295A vulnerability in the CLI of the Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to perform commaCisco Unified Computing System
- CVE-2024-20356A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote aCisco Unified Computing System
- CVE-2024-4127Tenda W15E guestWifiRuleRefresh stack-based overflowTenda W15E
- CVE-2024-4126Tenda W15E SetSysTimeCfg formSetSysTime stack-based overflowTenda W15E
- CVE-2024-32876NewPipe has potential security vulnerability when importing settingsTeamNewPipe NewPipe
- CVE-2024-4125Tenda W15E setStaticRoute formSetStaticRoute stack-based overflowTenda W15E
- CVE-2024-4124Tenda W15E SetRemoteWebManage formSetRemoteWebManage stack-based overflowTenda W15E
- CVE-2024-4123Tenda W15E SetPortMapping formSetPortMapping stack-based overflowTenda W15E
- CVE-2024-20353A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefensCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-4122Tenda W15E setDebugCfg formSetDebugCfg stack-based overflowTenda W15E
- CVE-2024-4121Tenda W15E formQOSRuleDel stack-based overflowTenda W15E
- CVE-2024-4120Tenda W15E modifyIpMacBind formIPMacBindModify stack-based overflowTenda W15E
- CVE-2024-4119Tenda W15E delIpMacBind formIPMacBindDel stack-based overflowTenda W15E
- CVE-2024-23271A logic issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +3
- CVE-2024-3371Insufficient validation of external input in Compass may enable MITM attacksMongoDB Compass
- CVE-2024-4118Tenda W15E addIpMacBind formIPMacBindAdd stack-based overflowTenda W15E
- CVE-2023-51471WordPress Checkout Mestres WP plugin <= 7.1.9.7 - Unauthenticated Arbitrary Options Update vulnerabilityMestres do WP Checkout Mestres WP
- CVE-2023-51405WordPress BookingPress plugin <= 1.0.74 - Booking Price Manipulation vulnerabilityRepute Infosystems BookingPress
- CVE-2024-4117Tenda W15E DelPortMapping formDelPortMapping stack-based overflowTenda W15E
- CVE-2024-4116Tenda W15E DelDhcpRule formDelDhcpRule stack-based overflowTenda W15E
- CVE-2024-4115Tenda W15E AddDnsForward formAddDnsForward stack-based overflowTenda W15E
- CVE-2024-4114Tenda TX9 PowerSaveSet sub_42C014 stack-based overflowTenda TX9
- CVE-2024-4113Tenda TX9 SetSysTimeCfg sub_42D4DC stack-based overflowTenda TX9
- CVE-2024-32958WordPress Slash Admin plugin <= 3.8.1 - CSRF to XSS vulnerabilityGiorgos Sarigiannidis Slash Admin
- CVE-2024-4112Tenda TX9 SetVirtualServerCfg sub_42CB94 stack-based overflowTenda TX9
- CVE-2024-4111Tenda TX9 SetLEDCfg sub_42BD7C stack-based overflowTenda TX9
- CVE-2023-23976WordPress RegistrationMagic plugin <= 5.1.9.2 - Arbitrary Price ChangeMetagauss RegistrationMagic
- CVE-2024-32785WordPress The Pack Elementor addons plugin <= 2.0.8.3 - Cross Site Request Forgery (CSRF) to XSS vulnerabilityWebangon The Pack Elementor addons
- CVE-2024-32789WordPress Seers plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) to XSS vulnerabilitySeers
- CVE-2024-32702WordPress ARForms plugin <= 6.4 - Reflected Cross Site Scripting (XSS) vulnerabilityreputeinfosystems ARForms
- CVE-2024-32950WordPress WP Media Category Management plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityDeBAAT WP Media Category Management
- CVE-2024-32952WordPress Max Addons Pro for Bricks plugin <= 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityBloomPixel Max Addons Pro for Bricks
- CVE-2024-32706WordPress ARForms plugin <= 6.4 - Subscriber+ SQL Injection vulnerabilityreputeinfosystems ARForms
- CVE-2024-32710WordPress WP-Recall plugin <= 16.26.5 - SQL Injection vulnerabilityPlechev Andrey WP-Recall
- CVE-2024-28976Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module.Dell Repository Manager
- CVE-2024-32726WordPress Frontend Dashboard plugin <= 2.2.2 - Sensitive Data Exposure on PII vulnerabilityvinoth06. Frontend Dashboard
- CVE-2024-32781WordPress Email Customizer for WooCommerce plugin <= 2.6.0 - Sensitive Data Exposure vulnerabilityThemeHigh Email Customizer for WooCommerce
- CVE-2024-32816WordPress Combo Blocks plugin <= 2.2.78 - Sensitive Data Exposure via API vulnerabilityPickPlugins Post Grid
- CVE-2024-32825WordPress Simply Static plugin <= 3.1.3 - Sensitive Data Exposure via Log File vulnerabilitySimply Static
- CVE-2024-32953WordPress Newsletters plugin <= 4.9.5 - Sensitive Data Exposure vulnerabilityNewsletters
- CVE-2024-31406Active debug code vulnerability exists in RoamWiFi R10 prior to 4.8.45.RoamWiFi Technology Co. RoamWiFi R10
- CVE-2024-33531cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the valu
Medium, low and unrated 73
- CVE-2024-23527An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unaIvanti Avalanche
- CVE-2023-20249A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, reCisco TelePresence Management Suite
- CVE-2023-20248A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, reCisco TelePresence Management Suite
- CVE-2024-32879social-auth-app-django Improper Handling of Case Sensitivity vulnerabilitypython-social-auth social-app-django · social-auth-app-djan…
- CVE-2024-20358A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco FirepCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2024-4141Out-of-bounds array write in Xpdf 4.05 due to incorrect bounds checkXpdf
- CVE-2024-20359A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco AdapCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-0151Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiledArm v8-M Security Extensions Requirements on Development To…
- CVE-2024-27791The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-23228This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2023-48763WordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerabilityCrocoblock JetFormBuilder
- CVE-2023-47774WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerabilityAutomattic Jetpack
- CVE-2023-47504WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerabilityElementor Website Builder
- CVE-2023-32127WordPress Multi Rating plugin <= 5.0.6 - Unauth Arbitrary rating value changeDaniel Powney Multi Rating
- CVE-2023-25790WordPress WoodMart theme <= 7.0.4 - Unauth Arbitrary Shortcodes Injectionxtemos WoodMart
- CVE-2024-32078WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerabilityFoliovision FV Flowplayer Video Player
- CVE-2024-32432WordPress Ovic Addon Toolkit plugin <= 2.6.1 - Broken Access Control vulnerabilityOvic Team Ovic Addon Toolkit
- CVE-2024-32675WordPress Order Limit for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerabilityXfinity Soft Order Limit for WooCommerce
- CVE-2024-32677WordPress LoginPress Pro plugin < 3.0.0 - Unauth. License Activation/Deactivation vulnerabilityLoginPress Pro
- CVE-2024-32678WordPress TrackShip for WooCommerce plugin <= 1.7.5 - Broken Access Control vulnerabilityTrackShip for WooCommerce
- CVE-2024-32699WordPress YITH WooCommerce Compare plugin <= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerabilityYITHEMES YITH WooCommerce Compare
- CVE-2024-32728WordPress Paid Membership Subscriptions plugin <= 2.11.0 - Cross Site Request Forgery (CSRF) vulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2024-32773WordPress Royal Elementor Kit theme <= 1.0.116 - Cross Site Request Forgery (CSRF) vulnerabilityWP Royal Royal Elementor Kit
- CVE-2024-32793WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerabilityPaid Memberships Pro
- CVE-2024-32794WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerabilityPaid Memberships Pro
- CVE-2024-32795WordPress WPCal.io <= 0.9.5.8 - Cross Site Request Forgery (CSRF) vulnerabilityRevmakx WPCal.io – Easy Meeting Scheduler
- CVE-2024-32806WordPress Headline Analyzer plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerabilityCoSchedule Headline Analyzer
- CVE-2024-32947WordPress WP ADA Compliance Check Basic plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerabilityAlumniOnline Web Services WP ADA Compliance Check Basic
- CVE-2024-32872Umbraco Workflow's Backoffice users can execute arbitrary SQLUmbraco.Workflow.Issues · Umbraco.Workflow +1
- CVE-2023-25785WordPress WP Post Rating plugin <= 2.5 - Vote Manipulation VulnerabilityShoaib Saleem WP Post Rating
- CVE-2023-23989WordPress RegistrationMagic plugin <= 5.1.9.2 - Content InjectionMetagauss RegistrationMagic
- CVE-2024-28825Brute-force protection ineffective for some login methodsCheckmk
- CVE-2023-23985WordPress Quiz Maker plugin <= 6.3.9.4 - Content SpoofingQuiz Maker team Quiz Maker
- CVE-2022-45852WordPress WP-FormAssembly plugin <= 2.0.5 - Auth. Arbitrary File Read vulnerabilityFormAssembly / Drew Buschhorn WP-FormAssembly
- CVE-2024-32772WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerabilityMetagauss ProfileGrid
- CVE-2024-32808WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerabilityMetagauss ProfileGrid
- CVE-2024-32823WordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerabilityFeedbackWP Rate my Post – WP Rating System
- CVE-2024-32707WordPress Image Slider plugin <= 1.1.125 - Cross Site Scripting (XSS) vulnerabilityGhozyLab Image Slider Widget
- CVE-2024-32711WordPress myCred plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerabilitySaad Iqbal myCred
- CVE-2024-32721WordPress Jeg Elementor Kit plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerabilityJegtheme Jeg Elementor Kit
- CVE-2024-32722WordPress Coupon & Discount Code Reveal Button plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityCoupon & Discount Code Reveal Button
- CVE-2024-32723WordPress Advanced Floating Content plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityCode Tides Advanced Floating Content
- CVE-2024-32791WordPress Premium Addons for Elementor plugin <= 4.10.25 - Cross Site Scripting (XSS) vulnerabilityLeap13 Premium Addons for Elementor
- CVE-2024-32801WordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityShapedPlugin Widget Post Slider
- CVE-2024-32815WordPress All-in-one Like Widget plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerabilityJeroen Peters All-in-one Like Widget
- CVE-2024-32833WordPress List Custom Taxonomy Widget plugin <= 4.1 - Cross Site Scripting (XSS) vulnerabilityNick Halsey List Custom Taxonomy Widget
- CVE-2024-32834WordPress WooCommerce Shipping Label plugin <= 2.3.8 - Cross Site Scripting (XSS) vulnerabilityWebToffee WooCommerce Shipping Label
- CVE-2024-32956WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityRometheme RTMKit
- CVE-2024-28977Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module.Dell Repository Manager
- CVE-2024-32716WordPress StreamWeasels Twitch Integration plugin <= 1.7.8 - API Sensitive Data Exposure vulnerabilityStreamWeasels Twitch Integration
- CVE-2024-32780WordPress VikRentCar Car Rental Management System plugin <= 1.3.2 - Sensitive Data Exposure via Invoices vulnerabilityE4J s.r.l. VikRentCar
- CVE-2024-28963Telemetry Dashboard v1.0.0.7 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability.Dell Wyse Proprietary OS
- CVE-2024-32782WordPress HT Mega plugin <= 2.4.7 - Sensitive Data Exposure vulnerabilityDevItems HT Mega
- CVE-2024-32788WordPress FG Joomla to Wordpress plugin <= 4.20.2 - Sensitive Data Exposure via Log File vulnerabilityFrédéric GILLES FG Joomla to WordPress
- CVE-2024-32796WordPress WP Fusion Lite plugin <= 3.42.10 - Sensitive Data Exposure vulnerabilityJack Arturo WP Fusion Lite
- CVE-2024-32817WordPress Import and export users and customers plugin <= 1.26.2 - PHP Object Injection vulnerabilityJavier Carazo Import and export users and customers
- CVE-2024-32835WordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerabilityWebToffee Import Export WordPress Users
- CVE-2024-32718WordPress The Pack Elementor addons plugin <= 2.0.8.2 - Server Side Request Forgery (SSRF) vulnerabilityWebangon The Pack Elementor addons
- CVE-2024-32775WordPress Embed Google Photos album plugin <= 2.1.9 - Server Side Request Forgery (SSRF) vulnerabilityPavex Embed Google Photos album
- CVE-2024-32803WordPress SuperFaktura WooCommerce plugin <= 1.40.3 - Server Side Request Forgery (SSRF) vulnerability2day.sk, Webikon SuperFaktura WooCommerce
- CVE-2024-32812WordPress Podlove Podcast Publisher plugin <= 4.0.11 - Server Side Request Forgery (SSRF) vulnerabilityPodlove Podcast Publisher
- CVE-2024-32819WordPress Culqi plugin <= 3.0.14 - Server Side Request Forgery (SSRF) vulnerabilityCulqi
- CVE-2024-32955WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerabilityFoliovision FV Flowplayer Video Player
- CVE-2024-32951WordPress Max Addons Pro for Bricks plugin <= 1.6.1 - Unauthenticated Plugin Settings Reset vulnerabilityBloomPixel Max Addons Pro for Bricks
- CVE-2024-32051Insertion of sensitive information into log file issue exists in RoamWiFi R10 prior to 4.8.45.RoamWiFi Technology Co. RoamWiFi R10
- CVE-2024-3261Strong Testimonials < 3.1.12 - Contributor+ Stored XSSStrong Testimonials
- CVE-2024-2972Floating Chat Widget < 3.1.9 - Editor+ Stored XSSFloating Chat Widget: Contact Chat Icons, WhatsApp, Telegra…
- CVE-2024-2404Better Comments < 1.5.6 - Subscriber+ Stored XSSBetter Comments
- CVE-2024-2402Better Comments < 1.5.6 - Admin+ Stored XSSBetter Comments
- CVE-2024-1756WooCommerce Customers Manager < 29.8 - Subscriber+ Email DisclosureWooCommerce Customers Manager
- CVE-2024-1743WooCommerce Customers Manager < 29.8 - Reflected XSSWooCommerce Customers Manager
- CVE-2023-7253Import WP < 2.13.1 - Admin+ Server-side Request ForgeryImport WP
- CVE-2024-4093SourceCodester Simple Subscription Website view_application.php sql injectionSourceCodester Simple Subscription Website