CVEs published April 30, 2024
74 CVEs were published on April 30, 2024: 9 critical, 39 high.
- Published
- 74
- Critical
- 9
- High
- 39
- Medium
- 24
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Foxit Reader
- 3
- Adive Framework
- 2
- Hitachi Energy SDM600
- 2
- Apryse WebViewer
- 1
- awordpresslife Event Monster – Manager & Ticket Booking
- 1
- cluster-image-registry-operator · Red Hat OpenShift Contain…
- 1
- Dell iDRAC8 · Intel IPMI
- 1
- Delta Electronics CNCSoft-G2 DOPSoft
- 1
- DPS Telecom NetGuardian DIN Remote Telemetry Unit
- 1
- HashiCorp Vault Enterprise
- 1
Critical 9
- CVE-2024-3411Insufficient Randomness When Validating an IPMI Authenticated SessionDell iDRAC8 · Intel IPMI
- CVE-2019-19752nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification
- CVE-2019-19753SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes id
- CVE-2019-19755ethOS through 1.3.3 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identificat
- CVE-2023-49473Shenzhen JF6000 Cloud Media Collaboration Processing Platform firmware version V1.2.0 and software version V2.0.0 build 6245 is vulnerable t
- CVE-2024-33267SQL Injection vulnerability in Hero hfheropayment v.1.2.5 and before allows an attacker to escalate privileges via the HfHeropaymentGatewayB
- CVE-2024-33273SQL injection vulnerability in shipup before v.3.3.0 allows a remote attacker to escalate privileges via the getShopID function.
- CVE-2024-33275SQL injection vulnerability in Webbax supernewsletter v.1.4.21 and before allows a remote attacker to escalate privileges via the Super News
- CVE-2024-33308An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to escalate privileges via the Eme
High 39
- CVE-2024-4192Stack-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 DOPSoftDelta Electronics CNCSoft-G2 DOPSoft
- CVE-2024-4349SourceCodester Pisay Online E-Learning System controller.php unrestricted uploadSourceCodester Pisay Online E-Learning System
- CVE-2024-32970Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlexphlex-ruby phlex · phlex
- CVE-2024-23463Anti-Tampering bypass via Repair App functionalityZscaler Client Connector
- CVE-2024-25938A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget.Foxit Reader
- CVE-2024-25648A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget.Foxit Reader
- CVE-2024-25575A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object.Foxit Reader
- CVE-2024-4340Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.sqlparse
- CVE-2024-2378A vulnerability exists in the web-authentication component of the SDM600.Hitachi Energy SDM600
- CVE-2024-2617A vulnerability exists in the RTU500 that allows for authenticated and authorized users to bypass secure update, if secure update feature Hitachi Energy RTU500 series CMU firmware
- CVE-2024-2377A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600.Hitachi Energy SDM600
- CVE-2024-4336Múltiple vulnerabilities on Adive FrameworkAdive Framework
- CVE-2024-4337Múltiple vulnerabilities on Adive FrameworkAdive Framework
- CVE-2024-2663ZD YouTube FLV Player <= 1.2.6 - Server-Side Request Forgerywebsmokers ZD YouTube FLV Player
- CVE-2024-4185Customer Email Verification for WooCommerce <= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient Randomnesswpcodefactory Customer Email Verification for WooCommerce
- CVE-2024-1895Event Monster <= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Metaawordpresslife Event Monster – Manager & Ticket Booking
- CVE-2024-4225NGDIN_ST v2.0D.0062 - Multiple VulnerabilitiesDPS Telecom NetGuardian DIN Remote Telemetry Unit
- CVE-2020-27478Cross Site Scripting vulnerability found in Simplcommerce v.40734964b0811f3cbaf64b6dac261683d256f961 thru 3103357200c70b4767986544e01b19dbf1
- CVE-2023-45385ProQuality pqprintshippinglabels before v.4.15.0 is vulnerable to Directory Traversal via the pqprintshippinglabels module.
- CVE-2023-46304modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected
- CVE-2023-50053An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication proc
- CVE-2024-23773An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.
- CVE-2024-23774An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.
- CVE-2024-26331ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to
- CVE-2024-28269ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server.
- CVE-2024-28716An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.
- CVE-2024-29320Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.
- CVE-2024-29384An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information via the content.js and parseCSSRules funct
- CVE-2024-29466Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.
- CVE-2024-31837DMitry (Deepmagic Information Gathering Tool) 1.3a has a format-string vulnerability, with a threat model similar to CVE-2017-7938.
- CVE-2024-33270An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote attacker to obtain sensitive information via the
- CVE-2024-33274Directory Traversal vulnerability in FME Modules customfields v.2.2.7 and before allows a remote attacker to obtain sensitive information vi
- CVE-2024-33309An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to obtain sensitive information vi
- CVE-2024-33332An issue discovered in SpringBlade 3.7.1 allows attackers to obtain sensitive information via crafted GET request to api/blade-system/tenant
- CVE-2024-33383Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET
- CVE-2024-33437An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information due to missing support for CSS Style Rules
- CVE-2024-33465Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php compo
- CVE-2024-33831A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute
- CVE-2024-34088In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer.
Medium, low and unrated 26
- CVE-2024-4369Cluster-image-registry-operator: exposes a secret via env variable in pod definition on azurecluster-image-registry-operator · Red Hat OpenShift Contain…
- CVE-2024-4348osCommerce all-products cross site scriptingosCommerce
- CVE-2024-3746Measuresoft ScadaPro Improper Access ControlMeasuresoft ScadaPro
- CVE-2024-2877Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby NodeHashiCorp Vault Enterprise
- CVE-2023-38002IBM Storage Scale session fixationIBM Storage Scale
- CVE-2024-22405XADMaster may not apply quarantine attribute correctly to extracted filesMacPaw XADMaster
- CVE-2024-3072ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Updatehoriondigital ACF Front End Editor
- CVE-2024-1371LeadConnector <= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletionvarunvairavanlc LeadConnector
- CVE-2024-0216Google Doc Embedder <= 2.6.4 - Authenticated (Contributor+) Blind Server Side Request Forgerylevertechadmin Google Doc Embedder
- CVE-2024-4226It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and pOctopus Deploy Octopus Server
- CVE-2024-4327Apryse WebViewer PDF Document cross site scriptingApryse WebViewer
- CVE-2019-19751easyMINE before 2019-12-05 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes iden
- CVE-2019-19754HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes i
- CVE-2020-5200Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identif
- CVE-2023-50059An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galx
- CVE-2023-50914A Privilege Escalation issue in the inter-process communication procedure from GOG Galaxy (Beta) 2.0.67.2 through v2.0.71.2 allows authentic
- CVE-2023-50915An issue exists in GalaxyClientService.exe in GOG Galaxy (Beta) 2.0.67.2 through 2.0.71.2 that could allow authenticated users to overwrite
- CVE-2024-22546TRENDnet TEW-815DAP 1.0.2.0 is vulnerable to Command Injection via the do_setNTP function.
- CVE-2024-23772An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.
- CVE-2024-33101A stored cross-site scripting (XSS) vulnerability in the component /action/anti.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrar
- CVE-2024-33102A stored cross-site scripting (XSS) vulnerability in the component /pubs/counter.php of ThinkSAAS v3.7.0 allows attackers to execute arbitra
- CVE-2024-33103An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by
- CVE-2024-33371Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the m
- CVE-2024-33436An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information due to missing support for CSS variables
- CVE-2024-33832OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=api&method=get_link_in
- CVE-2024-34149In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than