Low-severity CVEs (page 56)
Page 56 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-40455 | Low | 2.7 | 2024-07-16 | An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request. |
CVE-2022-48852 | Low | 3.3 | 2024-07-16 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Unregister codec device on unbind On bind we will register the HDMI codec… |
CVE-2024-6780 | Low | 3.3 | 2024-07-16 | Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks. |
CVE-2024-40632 | Low | 3.7 | 2024-07-15 | Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptibl… |
CVE-2024-39919 | Low | 3.1 | 2024-07-15 | @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, o… |
CVE-2024-32945 | Low | 2.6 | 2024-07-15 | Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a… |
CVE-2023-41093 | Low | 3.1 | 2024-07-12 | Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of… |
CVE-2024-5470 | Low | 3.8 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_… |
CVE-2024-2880 | Low | 2.7 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-23194 | Low | 3.3 | 2024-07-11 | Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Cent… |
CVE-2024-6650 | Low | 2.4 | 2024-07-10 | A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this issue is the func… |
CVE-2024-39886 | Low | 3.7 | 2024-07-10 | TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in clear… |
CVE-2024-36452 | Low | 3.1 | 2024-07-10 | Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerability is exploited, unintended operations… |
CVE-2024-22018 | Low | 2.9 | 2024-07-10 | A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises fr… |
CVE-2024-22477 | Low | 1.8 | 2024-07-09 | A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only. |
CVE-2024-21832 | Low | 3.5 | 2024-07-09 | A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body. |
CVE-2024-6501 | Low | 3.1 | 2024-07-09 | A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a maliciou… |
CVE-2024-26015 | Low | 3.4 | 2024-07-09 | An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17… |
CVE-2024-37996 | Low | 3.3 | 2024-07-09 | A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0.014), Teamcenter V… |
CVE-2024-37442 | Low | 3.8 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays all… |
CVE-2024-37253 | Low | 2.7 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code… |
CVE-2024-35777 | Low | 3.5 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Automattic WooCommerce allows Content Spoof… |
CVE-2024-34692 | Low | 3.3 | 2024-07-09 | Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files include executables… |
CVE-2024-38372 | Low | 2.0 | 2024-07-08 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` mi… |
CVE-2024-34602 | Low | 3.3 | 2024-07-08 | Use of implicit intent for sensitive communication in Samsung Messages prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. Use… |
CVE-2024-6539 | Low | 3.5 | 2024-07-07 | A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the file /guestbook of t… |
CVE-2024-37234 | Low | 3.5 | 2024-07-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4. |
CVE-2024-40594 | Low | 2.3 | 2024-07-06 | The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps. |
CVE-2024-6526 | Low | 3.5 | 2024-07-05 | A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This af… |
CVE-2024-6525 | Low | 2.7 | 2024-07-05 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20230922. It has been rated as problematic. Affected by this issue is some u… |
CVE-2024-6523 | Low | 3.5 | 2024-07-05 | A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-a… |
CVE-2024-6511 | Low | 3.5 | 2024-07-04 | A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the compone… |
CVE-2024-32754 | Low | 3.1 | 2024-07-04 | Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firm… |
CVE-2024-6434 | Low | 3.1 | 2024-07-04 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10… |
CVE-2024-36122 | Low | 2.4 | 2024-07-03 | Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branche… |
CVE-2024-29508 | Low | 3.3 | 2024-07-03 | Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc. |
CVE-2024-6126 | Low | 3.2 | 2024-07-03 | A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which lead… |
CVE-2024-6470 | Low | 2.7 | 2024-07-03 | A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=m… |
CVE-2024-6469 | Low | 2.7 | 2024-07-03 | A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index… |
CVE-2024-39807 | Low | 3.1 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to… |
CVE-2024-39361 | Low | 3.1 | 2024-07-03 | Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an a… |
CVE-2024-39353 | Low | 2.7 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker… |
CVE-2024-36257 | Low | 2.7 | 2024-07-03 | Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A request… |
CVE-2024-39324 | Low | 3.8 | 2024-07-02 | aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, imp… |
CVE-2024-36278 | Low | 3.3 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2024-31071 | Low | 3.3 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2023-35022 | Low | 3.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254. |
CVE-2024-6415 | Low | 2.4 | 2024-06-30 | A vulnerability classified as problematic was found in Ingenico Estate Manager 2023. Affected by this vulnerability is an unknown functionality of the file /em… |
CVE-2024-39846 | Low | 3.5 | 2024-06-29 | NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitive information. NOT… |
CVE-2024-39307 | Low | 3.5 | 2024-06-28 | Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't s… |
CVE-2024-39302 | Low | 3.7 | 2024-06-28 | BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated fi… |
CVE-2024-38531 | Low | 3.6 | 2024-06-28 | Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change… |
CVE-2024-30135 | Low | 3.3 | 2024-06-28 | HCL DRYiCE AEX is potentially impacted by disclosure of sensitive information in the mobile application when a snapshot is taken. |
CVE-2024-30111 | Low | 3.3 | 2024-06-28 | HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. The mobile app can be installed in the rooted device due… |
CVE-2024-30110 | Low | 3.7 | 2024-06-28 | HCL DRYiCE AEX product is impacted by lack of input validation vulnerability in a particular web application. A malicious script can be injected into a system… |
CVE-2024-30109 | Low | 3.7 | 2024-06-28 | HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick… |
CVE-2024-37137 | Low | 3.8 | 2024-06-28 | Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnerability. A local privileged attacker cou… |
CVE-2024-6374 | Low | 3.5 | 2024-06-27 | A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as problematic. This issue affects some unknown processing of t… |
CVE-2024-39157 | Low | 3.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=del&dataType=&dataID=1. |
CVE-2024-39156 | Low | 3.8 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=add. |
CVE-2024-6370 | Low | 3.5 | 2024-06-27 | A vulnerability classified as problematic was found in LabVantage LIMS 2017. Affected by this vulnerability is an unknown functionality of the file /labvantage… |
CVE-2024-6369 | Low | 3.5 | 2024-06-27 | A vulnerability classified as problematic has been found in LabVantage LIMS 2017. Affected is an unknown function of the file /labvantage/rc?command=page&sdcid… |
CVE-2024-6368 | Low | 3.5 | 2024-06-27 | A vulnerability was found in LabVantage LIMS 2017. It has been rated as problematic. This issue affects some unknown processing of the file /labvantage/rc?comm… |
CVE-2024-6367 | Low | 3.5 | 2024-06-27 | A vulnerability was found in LabVantage LIMS 2017. It has been declared as problematic. This vulnerability affects unknown code of the file /labvantage/rc?comm… |
CVE-2024-4011 | Low | 3.1 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-39458 | Low | 3.1 | 2024-06-26 | When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that m… |
CVE-2024-25637 | Low | 3.1 | 2024-06-26 | October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allo… |
CVE-2024-6344 | Low | 2.4 | 2024-06-26 | A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the component Push Conf… |
CVE-2024-28830 | Low | 2.7 | 2024-06-26 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p7, <2.2.0p28, <2.1.0p45 and <=2.0.0p39 (EOL) causes automation user… |
CVE-2024-37141 | Low | 3.5 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an open redirect vulnerability. A remote low privileged attacker… |
CVE-2024-29177 | Low | 2.7 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a disclosure of temporary sensitive information vulnerability. A… |
CVE-2024-24764 | Low | 3.5 | 2024-06-26 | October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted… |
CVE-2024-38364 | Low | 2.6 | 2024-06-26 | DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable acces… |
CVE-2023-37541 | Low | 3.5 | 2024-06-25 | HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. |
CVE-2024-6300 | Low | 3.7 | 2024-06-25 | Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction |
CVE-2024-32855 | Low | 3.8 | 2024-06-25 | Dell Client Platform BIOS contains an Out-of-bounds Write vulnerability in an externally developed component. A high privileged attacker with local access coul… |
CVE-2024-6295 | Low | 3.9 | 2024-06-25 | udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical… |
CVE-2024-6294 | Low | 3.9 | 2024-06-25 | udn News Android APP stores the user session in logcat file when user log into the APP. A malicious APP or an attacker with physical access to the Android devi… |
CVE-2024-4839 | Low | 3.3 | 2024-06-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The… |
CVE-2024-3121 | Low | 3.3 | 2024-06-24 | A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from t… |
CVE-2024-4841 | Low | 3.3 | 2024-06-23 | A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input san… |
CVE-2024-6267 | Low | 2.4 | 2024-06-23 | A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown func… |
CVE-2024-6252 | Low | 2.4 | 2024-06-22 | A vulnerability has been found in Zorlan SkyCaiji up to 2.8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2024-6251 | Low | 2.4 | 2024-06-22 | A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_p… |
CVE-2022-44593 | Low | 3.7 | 2024-06-21 | Use of Less Trusted Source vulnerability in SolidWP Solid Security allows HTTP DoS.This issue affects Solid Security: from n/a through 9.3.1. |
CVE-2024-6212 | Low | 3.5 | 2024-06-21 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as problematic. Affected by this issue is the function get_stud… |
CVE-2024-38361 | Low | 3.7 | 2024-06-20 | Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion un… |
CVE-2024-6182 | Low | 3.5 | 2024-06-20 | A vulnerability was found in LabVantage LIMS 2017. It has been rated as problematic. This issue affects some unknown processing of the file /labvantage/rc?comm… |
CVE-2024-6181 | Low | 3.5 | 2024-06-20 | A vulnerability was found in LabVantage LIMS 2017. It has been declared as problematic. This vulnerability affects unknown code of the file /labvantage/rc?comm… |
CVE-2024-38358 | Low | 2.9 | 2024-06-19 | Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can tra… |
CVE-2024-6129 | Low | 3.7 | 2024-06-18 | A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login of the component Use… |
CVE-2024-5967 | Low | 2.7 | 2024-06-18 | A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured… |
CVE-2024-38507 | Low | 3.5 | 2024-06-18 | In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible |
CVE-2024-5899 | Low | 3.3 | 2024-06-18 | When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This com… |
CVE-2024-6082 | Low | 2.4 | 2024-06-17 | A vulnerability, which was classified as problematic, has been found in PHPVibe 11.0.46. This issue affects some unknown processing of the file functionalities… |
CVE-2024-6063 | Low | 3.3 | 2024-06-17 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the fi… |
CVE-2024-6062 | Low | 3.3 | 2024-06-17 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample… |
CVE-2024-6061 | Low | 3.3 | 2024-06-17 | A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_p… |
CVE-2024-6059 | Low | 2.4 | 2024-06-17 | A vulnerability, which was classified as problematic, has been found in Ingenico Estate Manager 2023. This issue affects some unknown processing of the file /e… |
CVE-2024-6058 | Low | 3.5 | 2024-06-17 | A vulnerability classified as problematic has been found in LabVantage LIMS 2017. This affects an unknown part of the file /labvantage/rc?command=page&page=Sam… |