CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- debian linux, linux kernel +1 morenet: ip_tunnel: prevent perpetual headroom growth7.8 High
- linux, linux kernel +1 morenet: veth: clear GRO when clearing XDP even when down5.5 Medium
- linux, linux kernel +1 morestmmac: Clear variable when destroying workqueue7.8 High
- linux, linux kernel +1 moreBluetooth: Avoid potential use-after-free in hci_error_reset8.8 High
- linux, linux kernel +1 moretls: fix use-after-free on failed backlog decryption9.8 Critical
- linux, linux kernel +1 moreASoC: qcom: Fix uninitialized pointer dmactl7.0 High
- linux, linux kernel +1 morefbcon: always restore the old font data in fbcon_do_set_font()5.5 Medium
- linux, linux kernel +1 moredrm/amd/display: Prevent potential buffer overflow in map_hw_resources7.8 High
- linux, linux kernel +1 moredrivers: perf: ctr_get_width function for legacy is not defined5.5 Medium
- debian linux, linux kernel +1 moreriscv: Sparse-Memory/vmemmap out-of-bounds fix7.8 High
- linux, linux kernel +1 moregtp: fix use-after-free and null-ptr-deref in gtp_newlink()7.8 High
- linux, linux kernel +1 morebtrfs: fix double free of anonymous device after snapshot creation failure7.8 High
- linux, linux kernel +1 morebtrfs: dev-replace: properly validate device names7.1 High
- debian linux, linux kernel +1 moredmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read5.5 Medium
- linux, linux kernel +1 morecrypto: arm64/neonbs - fix out-of-bounds access on short input7.8 High
- debian linux, linux kernel +1 moredmaengine: fsl-qdma: init irq after reg initialization5.5 Medium
- debian linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moremmc: mmci: stm32: fix DMA API overlapping mappings warning5.5 Medium
- linux, linux kernel +1 moreiommufd: Fix iopt_access_list_id overwrite bug7.8 High
- linux, linux kernel +1 moreiommufd: Fix protection fault in iommufd_test_syz_conv_iova5.5 Medium
- linux, linux kernel +1 morepmdomain: arm: Fix NULL dereference on scmi_perf_domain removal5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moremm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index5.5 Medium
- linux, linux kernel +1 moremptcp: fix double-free on socket dismantle9.8 Critical
- debian linux, linux kernel +1 moremptcp: fix possible deadlock in subflow diag5.5 Medium
- linux, linux kernel +1 moreaf_unix: Fix task hung while purging oob_skb in GC.5.5 Medium
- linux, linux kernel +1 moreaf_unix: Drop oob_skb ref before purging queue in GC.5.5 Medium
- linux, linux kernel +1 moredmaengine: idxd: Ensure safe user copy of completion record5.5 Medium
- linux, linux kernel +1 morepowerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV4.4 Medium
- apache cloudstackApache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance6.4 Medium
- apache cloudstackApache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences7.3 High
- apache cloudstackApache CloudStack: x-forwarded-for HTTP header parsed by default9.8 Critical
- nghttp2, debian linux, fedoraproject fedora +4 more +6 moreReading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage5.3 Medium
- nodejs node, nodejs +1 moreAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount...8.2 High
- mordauk cgc maintenance modeCGC Maintenance Mode <= 1.2 - Sensitive Information Exposure5.3 Medium
- kadencewp gutenberg blocks with ai, stellarwp kadence blocks — page builder toolkit for gutenberg editor +1 moreGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget6.4 Medium
- a wp life modal popup boxModal Popup Box – Popup Builder, Show Offers And News in Popup <= 1.5.2 - Authenticated (Contributor+) PHP Object Injection in awl_modal_popup_box_shortcode8.8 High
- stevejburge tag, category, and taxonomy manager – ai autotagger with openaiWordPress Tag and Category Manager – AI Autotagger <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- gqevu6bsiz announce from the dashboardAnnounce from the Dashboard <= 1.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- roxnor elementskit elementor addons – advanced widgets & templates addons for elementor, wpmet elements kit elementor addons +1 moreElementsKit Elementor addons <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget6.4 Medium
- hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 moreShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal P…6.4 Medium
- reputeinfosystems bookingpress, appointment booking calendar plugin and scheduling plugin – bookingpress +1 moreBookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload7.2 High
firefoxUbuntufirefox regressionsNo score- d-link dns-320l, dns-320lw, dns-327l +2 moreD-Link DNS-320L/DNS-320LW/DNS-327L HTTP GET Request info.cgi information disclosure5.3 Medium
- b3log siyuanSiYuan 3.0.3 - RCE via Server Side XSS9.0 Critical
- d-link dns-320l, dns-325, dns-327l +22 more +24 moreD-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection7.3 High
- d-link dns-320l, dns-325, dns-327l +22 more +24 moreD-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials9.8 Critical
- elecom co.,ltd. wrc-g01-w, wrc-x3200gst3-b, wmc-2lx-b +2 more +4 moreWRC-X3200GST3-B v1.25 and earlier, and WRC-G01-W v1.24 and earlier allow a network-adjacent...4.3 Medium
- elecom co.,ltd. wrc-g01-w, wrc-x3200gst3-b, elecom wrc-g01-w firmware +6 more +8 moreOS command injection vulnerability in WRC-X3200GST3-B v1.25 and earlier, and WRC-G01-W v1.24 and...6.8 Medium
- elecom wmc-x1800gst-b, elecom co.,ltd. wrc-g01-w, wrc-x3200gst3-b +2 more +4 moreOS command injection vulnerability in WRC-X3200GST3-B v1.25 and earlier, and WRC-G01-W v1.24 and...8.8 High
- seenergy svr-116 firmware, seenergy corp. svr-116 +1 moreSVR-116 firmware version 1.6.0.30028871 allows a remote authenticated attacker with an...7.2 High
- yubico yubikey manager guiykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows...8.8 High
- Show moreLoading…