Skip to content
OpenAdvisories

Archive

April 2024

Vulnerabilities first published in this month (UTC), newest first.

← March 2024 2024 / April May 2024 →
  1. 1103
  2. 2173
  3. 3232
  4. 4139
  5. 5102
  6. 640
  7. 762
  8. 8119
  9. 9387
  10. 10218
  11. 1181
  12. 12128
  13. 1316
  14. 1414
  15. 15221
  16. 16243
  17. 17298
  18. 18124
  19. 19115
  20. 206
  21. 215
  22. 2281
  23. 2364
  24. 24131
  25. 2595
  26. 26138
  27. 2727
  28. 2844
  29. 29150
  30. 3074
All Critical High Medium Low Exploited only Public exploit

54 results · Clear filters · Feed

  • High 8.8
    CVE-2024-28741 Public exploit EPSS 78%

    Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code…

  • High 7.5
    CVE-2024-27620 Public exploit

    An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request…

  • High 8.8
    CVE-2024-3217 Public exploit

    WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection

    The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient pre…

    Wp Directory Kit WP Directory Kit Web / CMS
  • High 8.8
    CVE-2023-52235 Public exploit

    SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow…

  • High 7.8
    CVE-2024-29863 Public exploit

    A race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 S…

  • High 7.5
    CVE-2024-22363 Public exploit

    SheetJS Regular Expression Denial of Service (ReDoS)

    SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).

    sqlpad xlsx Wolfi npm
  • High 7.5
    CVE-2023-45288 Public exploit EPSS 89%

    HTTP/2 CONTINUATION flood in net/http

    An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2024-27316 Public exploit EPSS 89%

    Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

    HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  • High 7.3
    CVE-2023-38709 Public exploit

    Apache HTTP Server: HTTP response splitting

    Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  • High 7.4
    CVE-2024-3116 Public exploit EPSS 66%

    Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

    pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system…

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • High 7.3
    CVE-2024-3273 Exploited Public exploit Scanner template EPSS 100%

    D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

    ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Requ…

    D-Link DNS-340L DNS-325 DNS-327L Network devices
    KEV Apr 11, 2024
  • High 7.5
    CVE-2023-36643 Public exploit

    Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop …

  • High 7.5
    CVE-2023-36644 Public exploit

    Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the…

  • High 7.8
    CVE-2024-27674 Public exploit

    Macro Expert through 4.9.4 allows BUILTIN\Users:(OI)(CI)(M) access to the "%PROGRAMFILES(X86)%\GrassSoft\Macro Expert" …