Low-severity CVEs (page 47)
Page 47 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-40795 | Low | 3.3 | 2024-07-29 | This issue was addressed with improved data protection. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, watchOS 10.6. An app may… |
CVE-2024-40778 | Low | 3.3 | 2024-07-29 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sono… |
CVE-2024-27862 | Low | 2.4 | 2024-07-29 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.6. Enabling Lockdown Mode while setting up a Mac may cause F… |
CVE-2023-42957 | Low | 3.3 | 2024-07-29 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10. An app may be able to… |
CVE-2023-42949 | Low | 3.3 | 2024-07-29 | This issue was addressed with improved data protection. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17. An app may be able t… |
CVE-2023-42948 | Low | 3.3 | 2024-07-29 | This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14. A Wi-Fi password may not be deleted when activating a Mac i… |
CVE-2023-42925 | Low | 3.3 | 2024-07-29 | The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to… |
CVE-2024-6620 | Low | 3.5 | 2024-07-29 | Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerability. A(n) attacker could potentially inje… |
CVE-2024-41027 | Low | 3.3 | 2024-07-29 | In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfd_api to return EINVAL as expected Currently if we request a feature that i… |
CVE-2024-7200 | Low | 3.5 | 2024-07-29 | A vulnerability, which was classified as problematic, has been found in SourceCodester Complaints Report Management System 1.0. This issue affects some unknown… |
CVE-2024-7170 | Low | 3.5 | 2024-07-28 | A vulnerability was found in TOTOLINK A3000RU 5.9c.5185. It has been rated as problematic. This issue affects some unknown processing of the file /web_cste/cgi… |
CVE-2024-7163 | Low | 3.5 | 2024-07-28 | A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php… |
CVE-2024-7162 | Low | 3.5 | 2024-07-28 | A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0. Affected by this issue is some unknown functionality of the file js/p… |
CVE-2024-7155 | Low | 2.5 | 2024-07-28 | A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2024-4786 | Low | 2.8 | 2024-07-26 | An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted application to keep the device on. |
CVE-2024-27358 | Low | 3.3 | 2024-07-26 | An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security through 23.x for macOS. Local users can blo… |
CVE-2024-41686 | Low | 3.3 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could exploit this by cre… |
CVE-2024-4811 | Low | 2.2 | 2024-07-25 | In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts. |
CVE-2024-7060 | Low | 2.6 | 2024-07-24 | An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17… |
CVE-2024-0231 | Low | 2.7 | 2024-07-24 | A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft… |
CVE-2024-37533 | Low | 2.4 | 2024-07-24 | IBM InfoSphere Information Server 11.7 could disclose sensitive user information to another user with physical access to the machine. IBM X-Force ID: 294727. |
CVE-2024-7068 | Low | 3.5 | 2024-07-24 | A vulnerability classified as problematic has been found in SourceCodester Insurance Management System 1.0. This affects an unknown part of the file /Script/ad… |
CVE-2024-3454 | Low | 3.5 | 2024-07-24 | An implementation issue in the Connectivity Standards Alliance Matter 1.2 protocol as used in the connectedhomeip SDK allows a third party to disclose informat… |
CVE-2024-41663 | Low | 3.5 | 2024-07-23 | Canarytokens help track activity and actions on a network. A Cross-Site Scripting vulnerability was identified in the "Cloned Website" Canarytoken, whereby th… |
CVE-2024-41839 | Low | 3.5 | 2024-07-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. A… |
CVE-2024-41829 | Low | 3.5 | 2024-07-22 | In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection |
CVE-2024-41828 | Low | 2.6 | 2024-07-22 | In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time |
CVE-2024-41826 | Low | 3.5 | 2024-07-22 | In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page |
CVE-2024-32152 | Low | 3.1 | 2024-07-22 | A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary fi… |
CVE-2024-6955 | Low | 3.5 | 2024-07-21 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file so… |
CVE-2024-6954 | Low | 3.5 | 2024-07-21 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2024-6942 | Low | 3.5 | 2024-07-21 | A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of t… |
CVE-2024-6941 | Low | 3.5 | 2024-07-21 | A vulnerability, which was classified as problematic, has been found in ThinkSAAS 3.7.0. This issue affects some unknown processing of the file app/system/acti… |
CVE-2024-6939 | Low | 3.5 | 2024-07-21 | A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic. Affected by this issue is the function okla of the file /webmain/public/upload/t… |
CVE-2024-6938 | Low | 3.5 | 2024-07-21 | A vulnerability has been found in SiYuan 3.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PDF.js of… |
CVE-2024-6937 | Low | 2.7 | 2024-07-21 | A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curl_exec of the file /admin/forms/… |
CVE-2024-6936 | Low | 2.7 | 2024-07-21 | A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1. This issue affects some unknown processing of the file… |
CVE-2024-6935 | Low | 2.4 | 2024-07-21 | A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1. This vulnerability affects unknown code of the file /admin/clients/ of t… |
CVE-2024-6934 | Low | 2.4 | 2024-07-21 | A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. This affects an unknown part of the file /admin/forms/add/step2.php… |
CVE-2024-6932 | Low | 3.5 | 2024-07-20 | A vulnerability was found in ClassCMS 4.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/?… |
CVE-2024-6694 | Low | 2.7 | 2024-07-20 | The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SM… |
CVE-2024-6907 | Low | 3.5 | 2024-07-19 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file so… |
CVE-2024-30130 | Low | 3.7 | 2024-07-19 | HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sens… |
CVE-2024-38806 | Low | 3.9 | 2024-07-18 | Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40… |
CVE-2024-40640 | Low | 2.9 | 2024-07-17 | vodozemac is an open source implementation of Olm and Megolm in pure Rust. Versions before 0.7.0 of vodozemac use a non-constant time base64 implementation fo… |
CVE-2023-42010 | Low | 3.1 | 2024-07-17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 could disclose sensitive information in the HTTP response usin… |
CVE-2024-38870 | Low | 3.5 | 2024-07-17 | Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247… |
CVE-2024-30471 | Low | 3.7 | 2024-07-17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request… |
CVE-2024-6807 | Low | 2.4 | 2024-07-17 | A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0 and classified as problematic. Affected by this issue is some unkno… |
CVE-2024-6595 | Low | 3.0 | 2024-07-17 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-21174 | Low | 3.1 | 2024-07-16 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.23, 21.3-21.14 and 23.4. Difficult to expl… |
CVE-2024-21164 | Low | 2.5 | 2024-07-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Diffic… |
CVE-2024-21151 | Low | 3.3 | 2024-07-16 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Easily exploitable vulne… |
CVE-2024-21144 | Low | 3.7 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). Supported versions that are affecte… |
CVE-2024-21138 | Low | 3.7 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-21131 | Low | 3.7 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-21123 | Low | 2.3 | 2024-07-16 | Vulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily exploitable vulnera… |
CVE-2024-40455 | Low | 2.7 | 2024-07-16 | An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request. |
CVE-2022-48852 | Low | 3.3 | 2024-07-16 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Unregister codec device on unbind On bind we will register the HDMI codec… |
CVE-2024-6780 | Low | 3.3 | 2024-07-16 | Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks. |
CVE-2024-40632 | Low | 3.7 | 2024-07-15 | Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptibl… |
CVE-2024-39919 | Low | 3.1 | 2024-07-15 | @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, o… |
CVE-2024-32945 | Low | 2.6 | 2024-07-15 | Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a… |
CVE-2023-41093 | Low | 3.1 | 2024-07-12 | Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of… |
CVE-2024-5470 | Low | 3.8 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_… |
CVE-2024-2880 | Low | 2.7 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-23194 | Low | 3.3 | 2024-07-11 | Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Cent… |
CVE-2024-6650 | Low | 2.4 | 2024-07-10 | A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this issue is the func… |
CVE-2024-39886 | Low | 3.7 | 2024-07-10 | TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in clear… |
CVE-2024-36452 | Low | 3.1 | 2024-07-10 | Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerability is exploited, unintended operations… |
CVE-2024-22018 | Low | 2.9 | 2024-07-10 | A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises fr… |
CVE-2024-22477 | Low | 1.8 | 2024-07-09 | A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only. |
CVE-2024-21832 | Low | 3.5 | 2024-07-09 | A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body. |
CVE-2024-6501 | Low | 3.1 | 2024-07-09 | A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a maliciou… |
CVE-2024-26015 | Low | 3.4 | 2024-07-09 | An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17… |
CVE-2024-37996 | Low | 3.3 | 2024-07-09 | A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0.014), Teamcenter V… |
CVE-2024-37442 | Low | 3.8 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays all… |
CVE-2024-37253 | Low | 2.7 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code… |
CVE-2024-35777 | Low | 3.5 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Automattic WooCommerce allows Content Spoof… |
CVE-2024-34692 | Low | 3.3 | 2024-07-09 | Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files include executables… |
CVE-2024-38372 | Low | 2.0 | 2024-07-08 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` mi… |
CVE-2024-34602 | Low | 3.3 | 2024-07-08 | Use of implicit intent for sensitive communication in Samsung Messages prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. Use… |
CVE-2024-6539 | Low | 3.5 | 2024-07-07 | A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the file /guestbook of t… |
CVE-2024-37234 | Low | 3.5 | 2024-07-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4. |
CVE-2024-40594 | Low | 2.3 | 2024-07-06 | The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps. |
CVE-2024-6526 | Low | 3.5 | 2024-07-05 | A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This af… |
CVE-2024-6525 | Low | 2.7 | 2024-07-05 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20230922. It has been rated as problematic. Affected by this issue is some u… |
CVE-2024-6523 | Low | 3.5 | 2024-07-05 | A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-a… |
CVE-2024-6511 | Low | 3.5 | 2024-07-04 | A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the compone… |
CVE-2024-32754 | Low | 3.1 | 2024-07-04 | Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firm… |
CVE-2024-6434 | Low | 3.1 | 2024-07-04 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10… |
CVE-2024-36122 | Low | 2.4 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branche… |
CVE-2024-29508 | Low | 3.3 | 2024-07-03 | Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc. |
CVE-2024-6126 | Low | 3.2 | 2024-07-03 | A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which lead… |
CVE-2024-6470 | Low | 2.7 | 2024-07-03 | A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=m… |
CVE-2024-6469 | Low | 2.7 | 2024-07-03 | A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index… |
CVE-2024-39807 | Low | 3.1 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to… |
CVE-2024-39361 | Low | 3.1 | 2024-07-03 | Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an a… |
CVE-2024-39353 | Low | 2.7 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker… |
CVE-2024-36257 | Low | 2.7 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A request… |