CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- phpfoxA cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary...6.1 Medium
- phpfoxA cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary...4.3 Medium
- phpfoxA cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary...7.1 High
- thimo grauerholz wp-spreadplugin, wordpress thimo grauerholz wp-spreadplugin +1 moreThimo Grauerholz WP-Spreadplugin spreadplugin.php cross site scripting3.5 Low
- apache airflow, apache software foundation airflow ftp provider, apache apache-airflow-providers-ftp +2 moreApache Airflow FTP Provider: FTP_TLS instance with unverified SSL context2.7 Low
- apache answerApache Answer: XSS vulnerability when changing personal website4.6 Medium
- keenetic kn-1010, kn-1410, kn-1711 +3 more +5 moreKeenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Version Data version.js information disclosure5.3 Medium
- keenetic kn-1010, kn-1410, kn-1711 +2 more +4 moreKeenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Configuration Setting ndmComponents.js information disclosure5.3 Medium
- tenda fh1206, fh1206 firmware +1 moreTenda FH1206 addressNat fromAddressNat buffer overflow8.8 High
- byzoro smart s80 management platformByzoro Smart S80 Management Platform importhtml.php deserialization6.3 Medium
zip_nextcrates.ioThe crate `zip_next` has been renamed to `zip`.No score- wordpress plugin hcaptcha, hcaptcha for wp +1 morehCaptcha for WordPress <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode6.4 Medium
- bdthemes prime slider – addons for elementor, prime slider +1 morePrime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) <= 3.14.0 - Authenticated (Contributor+) Store…5.4 Medium
- hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin, hasthemes woolentor-addons +2 moreShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
checkstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statementNo score- google chromeInappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed a remote...4.3 Medium
- google chromeInappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote...4.3 Medium
- unitronics vision120, vision230, vision280 +2 more +4 moreUnitronics Vision Standard Unauthenticated Password Retrieval7.5 High
- mealieMealie vulnerable to a DoS in recipe image importer (GHSL-2023-228)6.5 Medium
- mealieMealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227)6.2 Medium
- mealieMealie contains a DoS vulnerability in recipe importer6.5 Medium
- mealieMealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225)4.1 Medium
- beyondtrust u-series appliancePrivilege Escalation in U-Series Appliance8.8 High
- beyondtrust u-series appliancePrivilege Escalation in U-Series Appliance8.8 High
- corydolphin corydolphin/flask-cors, flask-cors +1 moreLog Injection Vulnerability in corydolphin/flask-cors5.3 Medium
- owncastOwncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)2.7 Low
- hono node-server@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed7.5 High
- covesa vsomeipCOVESA vsomeip race condition4.4 Medium
uptime-kumanpmEnabling Authentication does not close all logged in socket connections immediatelyNo score- github enterprise serverRace Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions5.5 Medium
- ibm aspera faspexIBM Aspera Faspex information disclosure5.5 Medium
- ibm aspera faspexIBM Aspera Faspex data manipulation3.6 Low
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability5.0 Medium
- ibm aspera faspexIBM Aspera Faspex denial of service6.5 Medium
- ibm aspera faspexIBM Aspera Faspex information disclosure2.5 Low
- baidu openraspOpenRASP vulnerable to a reflected Cross-Site Scripting (XSS) attack in /login6.1 Medium
- ibm aspera faspexIBM Aspera Faspex information disclosure5.5 Medium
- memosmemos vulnerable to an SSRF in /o/get/image6.1 Medium
- usememos memosmemos vulnerable to an SSRF in /o/get/httpmeta5.8 Medium
- memosmemos vulnerable to an SSRF in /api/resource5.8 Medium
- git-ecosystem git-credential-managerGit Credential Manager (GCM)'s Debian package does not set root ownership on installed files6.9 Medium
- wazuh, wazuh manager +1 moreWazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability9.8 Critical
- wazuhWazuh's vulnerability in host_deny AR script allows arbitrary command execution8.8 High
- github enterprise serverImproper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console8.0 High
- wazuhWazuh vulnerable to NULL Pointer Dereference in wazuh-analysisd6.5 Medium
- github enterprise serverCommand injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console8.0 High
- github enterprise serverRepository administrator can bypass organization's ruleset using deploy keys5.9 Medium
- ibm aspera faspexIBM Aspera Faspex privilege escalation7.8 High
- teimas global teixoCross-Site Scripting Vulnerability in Teixo by Teimas Global6.3 Medium
- rustlsRustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input7.5 High
- Show moreLoading…