CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- red hat logging subsystem for red hat openshift, advanced cluster management for kubernetes 2, openshift container platform 4.13 +3 more +5 moreCoredns: cd bit response is cached and served later5.3 Medium
editorconfig-core-cMageiaUpdated editorconfig-core-c packages fix security vulnerabilityNo score- red hat openshift container platform 4, openshift container platform 4.11, openshift container platform 4.12 +2 moreOpenshift: incomplete fix for rapid reset (cve-2023-44487/cve-2023-39325)7.5 High
- red hat a-mq clients 2, cryostat 2, openshift serverless +9 more +11 moreQuarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.6.5 Medium
- prince radio playerWordPress Radio Player plugin <= 2.0.73 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- grassroot dicom dicom, fedoraproject fedora, grassroot platform +1 more +3 moreA heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of...7.7 High
- grassroot dicom dicom, fedoraproject fedora, malaterre grassroots dicom +2 moreAn out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon...8.1 High
- grassroot dicom dicom, fedoraproject fedora, malaterre grassroots dicom +2 moreAn out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu...6.5 Medium
- idccmsidcCMS cross-site request forgery4.3 Medium
- tenda w30e, w30e firmware +1 moreTenda W30E WizardHandle fromWizardHandle stack-based overflow8.8 High
- gitlabAuthentication Bypass by Assumed-Immutable Data in GitLab7.3 High
- gitlabIncorrect Authorization in GitLab4.3 Medium
- tenda 4g300, 4g300 firmware +1 moreTenda 4G300 sub_429A30 stack-based overflow8.8 High
- tenda 4g300, 4g300 firmware +1 moreTenda 4G300 sub_4279CC stack-based overflow8.8 High
- ibm websphere application server, websphere application server liberty +1 moreIBM WebSphere Application Server denial of service5.9 Medium
- tenda 4g300, 4g300 firmware +1 moreTenda 4G300 sub_4260F0 stack-based overflow8.8 High
- tenda 4g300, 4g300 firmware +1 moreTenda 4G300 sub_422AA4 stack-based overflow8.8 High
- hyperion web serverImproper Input Validation vulnerability in Hyperion Web Server5.4 Medium
- hyperion web serverCross-Site Scripting (XSS) vulnerability in Hyperion Web Server5.4 Medium
- tenda 4g300, 4g300 firmware +1 moreTenda 4G300 sub_41E858 stack-based overflow8.8 High
- tenda g3, g3 firmware +1 moreTenda G3 modifyDhcpRule stack-based overflow8.8 High
- gitlabAuthentication Bypass by Spoofing in GitLab4.3 Medium
- gitlabImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab8.5 High
- gitlabInefficient Regular Expression Complexity in GitLab7.5 High
- simple-membership-plugin simple membershipSimple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode5.4 Medium
- loginpress proWordPress LoginPress Pro plugin < 3.0.0 - Captcha Bypass vulnerability5.3 Medium
- tenda g3, g3 firmware +1 moreTenda G3 ModifyPppAuthWhiteMac formModifyPppAuthWhiteMac stack-based overflow8.8 High
- monsterinsights google analytics by monster insights, google analytics dashboard +1 moreWordPress MonsterInsights plugin <= 8.21.0 - Broken Access Control vulnerability4.3 Medium
- themeum tutor lms – elearning and online course solution, tutor lms, wordpress tutor lms elearning and online course solution +2 moreTutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode5.4 Medium
- gt3themes photo gallery – gt3 image gallery & gutenberg block gallery, photo gallery +1 morePhoto Gallery - GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.21 - Authenticated (Author+) Cross-Site Scripting6.4 Medium
- creativethemes blocksyWordPress Blocksy theme <= 2.0.33 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- andondesign udesignWordPress UDesign theme <= 4.7.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- algolplus advanced order export for woocommerce, advanced order export +1 moreWordPress Advanced Order Export For WooCommerce plugin <= 3.4.4 - Remote Code Execution (RCE) vulnerability9.1 Critical
- 大侠wp dx-watermarkWordPress DX-Watermark plugin <= 1.0.4 - CSRF to Arbitrary File Upload and XSS vulnerability9.6 Critical
- coderevolution wp setup wizardWordPress WP Setup Wizard plugin <= 1.0.8.1 - Auth. Full Database Download Vulnerability8.8 High
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Information Exposure5.3 Medium
- eli scheetz anti-malware security and brute-force firewallWordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.21.96 - Unauthenticated Predictable Nonce Brute-Force Leading to RCE vulnerability9.0 Critical
- wp-buy login as user or customer (user switching), login as user or customer \(user switching\) +1 moreWordPress Login as User or Customer plugin <= 3.8 - Unauthenticated Account Takeover vulnerability9.8 Critical
- eazyplugins eazy plugin managerWordPress Eazy Plugin Manager plugin <= 4.1.2 - Auth. Arbitrary Options Update lead to RCE vulnerability9.9 Critical
- abdul hakeem build app onlineWordPress Build App Online plugin <= 1.0.19 - Unauthenticated Account Takeover vulnerability9.8 Critical
- shaonsina sina extension for elementorSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting…6.4 Medium
- radiustheme classified listing, techlabpro1 classified listing – ai-powered classified ads & business directory plugin, classified listing plugin +2 moreClassified Listing – Classified ads & Business Directory Plugin <= 3.0.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion4.3 Medium
- pt-guy content views – post grid & filter, recent posts, category posts … (shortcode, gutenberg blocks, and widgets for elementor)Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Post Overlay6.4 Medium
- broadcom brocade sannav, brocade sannav +1 moreSANnav versions exposes Kafka in the wan interface.7.6 High
- unknown agca, cusmin absolutely glamorous custom admin +1 moreAGCA – Custom Dashboard & Login Page < 7.2.2 - Admin+ Stored XSS via Image URL6.8 Medium
- broadcom brocade sannav, brocade sannav +1 moreSyslog traffic sent in clear-text8.6 High
- broadcom brocade sannav, brocade sannav +1 moreProtection mechanisms4.3 Medium
- mpdavis python-josepython-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret9.3 Critical
- python-jose project python-josepython-jose denial of service via compressed JWE content5.3 Medium
- python-jose project python-josepython-jose algorithm confusion with OpenSSH ECDSA keys6.5 Medium
- Show moreLoading…