CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
puppetMageiaUpdated puppet packages fix security vulnerabilitiesNo score- checkpoint identity agent, zonealarm extreme security nextgen, identity agent for windows, identity agent for windows terminal server, zonealarm extreme security +2 more +4 moreLocalprivilegeescalationinCheckPointZoneAlarmExtremeSecurityNextGen,IdentityAgentforWindows,andIdentityAgentforWindowsTerminalServerviacraftedDLLfile7.3 High
- tolgee, tolgee tolgee-platform +1 moreTolgee' API keys created by server admin users bypass the permission check6.5 Medium
- akana api platform, community manager developer portal +1 moreSSRF in Akana API Platform9.3 Critical
- tolgee, tolgee tolgee-platform +1 moreTolgee's API key scopes not checked when querying translation data2.7 Low
- 1panel-dev 1panel1Panel's password verification is suspected to have a timing attack vulnerability3.9 Low
- judge0SSRF into Sandbox Escape through Unsafe Default Configuration9.1 Critical
- judge0Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Link10.0 Critical
- judge0Judge0 vulnerable to Sandbox Escape via Symbolic Link10.0 Critical
- envoyproxy envoyEnvoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes7.5 High
- aio-libs aiohttp, fedoraproject fedora +1 moreaiohttp vulnerable to XSS on index pages for static file handling6.1 Medium
- wpfactory ean for woocommerce, wpcodefactory ean barcode generator for woocommerce: upc, isbn & gtin inventory +1 moreEAN for WooCommerce <= 4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta Shortcode6.4 Medium
- wpfactory ean for woocommerce, wpcodefactory ean barcode generator for woocommerce: upc, isbn & gtin inventory +1 moreEAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode4.3 Medium
- agile logix store locator wordpressWordPress Store Locator WordPress Plugin <= 1.4.14 is vulnerable to Arbitrary File Deletion6.8 Medium
- library system project system, sourcecodester home clean service system, home cleaning service system +2 moreSourceCodester Home Clean Service System Photo student.add.php unrestricted upload6.3 Medium
- zachary segal catablogWordPress CataBlog Plugin <= 1.7.0 is vulnerable to Arbitrary File Deletion7.6 High
- secomea gatemanagerInsufficient input validation when downloading certain file types.6.5 Medium
- genialsouls wp social commentsWordPress WP Social Comments plugin <= 1.7.3 - Broken Access Control vulnerability4.3 Medium
- inisev backup migrationWordPress Backup Migration plugin <= 1.4.3 - Sensitive Data Exposure via Log vulnerability5.3 Medium
- really simple plugins simple ssl, really-simple-plugins complianz +1 moreWordPress Really Simple SSL plugin <= 7.2.3 - Server Side Request Forgery (SSRF) vulnerability5.5 Medium
- smartypants sp project & document managerWordPress SP Project & Document Manage plugin <= 4.71 - Auth. SQL Injection vulnerability7.6 High
- onthegosystems woocommerce multilingual & multicurrency, sitepress-multilingual-cms, woocommerce multilingual \& multicurrency +2 moreWordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.3.1 - SQL Injection vulnerability7.6 High
- formassembly / drew buschhorn wp-formassembly, formassembly wpformassembly +1 moreWordPress WP-FormAssembly plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jeroen peters navigation menu as dropdown widgetWordPress Navigation menu as dropdown Widget plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- tagbox taggboxWordPress Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- averta master sliderWordPress Master Slider plugin <= 3.9.5 - PHP Object Injection vulnerability8.3 High
- looks awesome superfly menuWordPress Superfly Menu plugin <= 5.0.25 - Subscriber+ Site-Wide Stored Cross Site Scripting (XSS) vulnerability7.1 High
- knight lab timelineWordPress Knight Lab Timeline plugin <= 3.9.3.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nabil lemsieh hurrytimerWordPress HurryTimer plugin <=2.9.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- implecode ecommerce product catalogWordPress eCommerce Product Catalog plugin <= 3.3.32 - Cross Site Scripting (XSS) vulnerability7.1 High
- hwk-fr wp 404 auto redirect to similar postWordPress WP 404 Auto Redirect to Similar Post plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- sharabindu qr code composerWordPress QR Code Composer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tagembedWordPress Tagembed plugin <= 4.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- viictory media llc z y n i t h, victory media llc zynith +1 moreWordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Cross Site Scripting (XSS) vulnerability8.6 High
- e4jvikwp vikbooking hotel booking engine & pms, vikbooking hotel booking engine, vikbooking hotel booking engine & pms hotel booking engine & pms +2 moreWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wpxpo postx, post grid team by wpxpo postx-gutenberg blocks for post grid +1 moreWordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- app cheap builder, appcheap.io app builder +1 moreWordPress App Builder plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp club manager club manager, wpclubmanager wp club manager +1 moreWordPress WP Club Manager plugin <= 2.2.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- designinvento directorypressWordPress DirectoryPress plugin <= 3.6.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- melapress wp 2faWordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- metaphor creations dittyWordPress Ditty plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- linux, linux kernel +1 moreinet: inet_defrag: prevent sk release while still in use7.8 High
- archetyped cornerstoneWordPress Cornerstone plugin <= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- naa986 wp stripe checkoutWordPress WP Stripe Checkout plugin <= 1.2.2.41 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bdthemes element pack elementor addons, element pack +1 moreWordPress Element Pack Elementor Addons plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp lab wp-lister lite for ebayWordPress WP-Lister Lite for eBay plugin <=3.5.11 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- ashish ajani wp simple html sitemapWordPress WP Simple HTML Sitemap plugin <= 2.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- kraftplugins mega elementsWordPress Mega Elements plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ba-booking ba book everythingWordPress BA Book Everything plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codeboxr team cbx bookmark & favorite, codeboxr cbx bookmark \& favorite +1 moreWordPress CBX Bookmark & Favorite plugin <= 1.7.20 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…