Low-severity CVEs (page 63)
Page 63 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1784 | Low | 3.9 | 2024-02-23 | A vulnerability classified as problematic was found in Limbas 5.2.14. Affected by this vulnerability is an unknown functionality of the file main_admin.php. Th… |
CVE-2024-1749 | Low | 2.4 | 2024-02-22 | A vulnerability, which was classified as problematic, has been found in Bdtask Bhojon Best Restaurant Management Software 2.9. This issue affects some unknown… |
CVE-2024-25129 | Low | 2.7 | 2024-02-22 | The CodeQL CLI repo holds binaries for the CodeQL command line interface (CLI). Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various a… |
CVE-2023-3509 | Low | 3.7 | 2024-02-21 | An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 bef… |
CVE-2024-1706 | Low | 3.5 | 2024-02-21 | A vulnerability was determined in ZKTeco ZKBio Access IVS up to 3.3.2. This impacts an unknown function of the component Department Name Search Bar. This manip… |
CVE-2024-1703 | Low | 3.5 | 2024-02-21 | A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been classified as problematic. This affects the function openfile of the file /adminapi/system/… |
CVE-2023-50955 | Low | 2.4 | 2024-02-21 | IBM InfoSphere Information Server 11.7 could allow an authenticated privileged user to obtain the absolute path of the web server installation which could aid… |
CVE-2023-42939 | Low | 3.3 | 2024-02-21 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. A user's private browsing activity may be unexpectedly saved… |
CVE-2024-25196 | Low | 3.3 | 2024-02-20 | Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_controller process. This vu… |
CVE-2024-1661 | Low | 2.5 | 2024-02-20 | A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-25983 | Low | 3.5 | 2024-02-19 | Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e… |
CVE-2024-1633 | Low | 2.0 | 2024-02-19 | During the secure boot, bl2 (the second stage of the bootloader) loops over images defined in the table “bl2_mem_params_descs”. For each image, the bl2 reads t… |
CVE-2023-52371 | Low | 3.5 | 2024-02-18 | Vulnerability of null references in the motor module.Successful exploitation of this vulnerability may affect availability. |
CVE-2022-42443 | Low | 2.2 | 2024-02-17 | An undisclosed issue in Trusteer iOS SDK for mobile versions prior to 5.7 and Trusteer Android SDK for mobile versions prior to 5.7 may allow uploading of file… |
CVE-2024-20925 | Low | 3.1 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-20923 | Low | 3.1 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-20911 | Low | 2.6 | 2024-02-17 | Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Difficult to exploit vuln… |
CVE-2024-20905 | Low | 2.7 | 2024-02-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affec… |
CVE-2024-24758 | Low | 3.9 | 2024-02-16 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Prox… |
CVE-2024-25627 | Low | 3.5 | 2024-02-16 | Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaS… |
CVE-2024-1591 | Low | 3.3 | 2024-02-16 | Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them… |
CVE-2024-23591 | Low | 2.0 | 2024-02-16 | ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privile… |
CVE-2024-0037 | Low | 3.3 | 2024-02-16 | In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could le… |
CVE-2023-40122 | Low | 3.3 | 2024-02-16 | In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information di… |
CVE-2024-25941 | Low | 3.3 | 2024-02-15 | The jail(2) system call has not limited a visiblity of allocated TTYs (the kern.ttys sysctl). This gives rise to an information leak about processes outside t… |
CVE-2024-25619 | Low | 3.1 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed… |
CVE-2024-23603 | Low | 3.8 | 2024-02-14 | An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Note: Software versions which have reached End of Techn… |
CVE-2023-42776 | Low | 3.8 | 2024-02-14 | Improper input validation in some Intel(R) SGX DCAP software for Windows before version 1.19.100.3 may allow an authenticateed user to potentially enable infor… |
CVE-2023-41090 | Low | 1.8 | 2024-02-14 | Race condition in some Intel(R) MAS software before version 2.3 may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2023-27307 | Low | 3.8 | 2024-02-14 | Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable i… |
CVE-2023-27303 | Low | 3.8 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable inform… |
CVE-2023-27300 | Low | 3.8 | 2024-02-14 | Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable i… |
CVE-2023-26596 | Low | 2.5 | 2024-02-14 | Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable denial… |
CVE-2023-26592 | Low | 3.8 | 2024-02-14 | Deserialization of untrusted data in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially ena… |
CVE-2023-26591 | Low | 2.0 | 2024-02-14 | Unchecked return value in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable denia… |
CVE-2023-20570 | Low | 3.3 | 2024-02-13 | Insufficient verification of data authenticity in the configuration state machine may allow a local attacker to potentially load arbitrary bitstreams. |
CVE-2024-23801 | Low | 3.3 | 2024-02-13 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The aff… |
CVE-2024-23800 | Low | 3.3 | 2024-02-13 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The aff… |
CVE-2024-23799 | Low | 3.3 | 2024-02-13 | A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The aff… |
CVE-2024-22043 | Low | 3.3 | 2024-02-13 | A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.251), Parasolid V35.1 (All versions < V35.1.170). The affected applications contai… |
CVE-2024-1454 | Low | 3.4 | 2024-02-12 | The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or… |
CVE-2024-23760 | Low | 2.7 | 2024-02-12 | Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json and legacy-error-handl… |
CVE-2021-4437 | Low | 3.5 | 2024-02-12 | A vulnerability, which was classified as problematic, has been found in dbartholomae lambda-middleware frameguard up to 1.0.4. Affected by this issue is some u… |
CVE-2024-22226 | Low | 3.3 | 2024-02-12 | Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploi… |
CVE-2024-1433 | Low | 3.1 | 2024-02-11 | A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlu… |
CVE-2023-45718 | Low | 3.9 | 2024-02-09 | Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. W… |
CVE-2023-45716 | Low | 1.7 | 2024-02-09 | Sametime is impacted by sensitive information passed in URL. |
CVE-2024-1246 | Low | 2.0 | 2024-02-09 | Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided… |
CVE-2024-1245 | Low | 2.4 | 2024-02-09 | Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not suf… |
CVE-2024-1247 | Low | 2.0 | 2024-02-09 | Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data… |
CVE-2024-24776 | Low | 3.1 | 2024-02-09 | Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a use… |
CVE-2024-24774 | Low | 3.4 | 2024-02-09 | Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription… |
CVE-2024-23319 | Low | 3.5 | 2024-02-09 | Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connec… |
CVE-2024-0628 | Low | 3.8 | 2024-02-07 | The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the RSS feed source in… |
CVE-2024-1269 | Low | 2.4 | 2024-02-07 | A vulnerability has been found in SourceCodester Product Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the fi… |
CVE-2024-1267 | Low | 3.5 | 2024-02-07 | A vulnerability, which was classified as problematic, has been found in CodeAstro Restaurant POS System 1.0. Affected by this issue is some unknown functionali… |
CVE-2024-1266 | Low | 2.4 | 2024-02-07 | A vulnerability classified as problematic was found in CodeAstro University Management System 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-1265 | Low | 2.4 | 2024-02-07 | A vulnerability classified as problematic has been found in CodeAstro University Management System 1.0. Affected is an unknown function of the file /att_add.ph… |
CVE-2024-1258 | Low | 3.1 | 2024-02-06 | A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-1257 | Low | 3.5 | 2024-02-06 | A vulnerability was found in Jspxcms 10.2.0. It has been classified as problematic. Affected is an unknown function of the file /ext/collect/find_text.do. The… |
CVE-2024-1256 | Low | 3.5 | 2024-02-06 | A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. This issue affects some unknown processing of the file /ext/collect/filter_text.do… |
CVE-2024-1048 | Low | 3.3 | 2024-02-06 | A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grub… |
CVE-2024-24940 | Low | 2.8 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives |
CVE-2024-24939 | Low | 3.3 | 2024-02-06 | In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible |
CVE-2024-20828 | Low | 2.4 | 2024-02-06 | Improper authorization verification vulnerability in Samsung Internet prior to version 24.0 allows physical attackers to access files downloaded in SecretMode… |
CVE-2024-20810 | Low | 3.3 | 2024-02-06 | Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-1075 | Low | 3.7 | 2024-02-05 | The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all versions up to, and… |
CVE-2024-24807 | Low | 2.7 | 2024-02-05 | Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name… |
CVE-2024-24559 | Low | 3.7 | 2024-02-05 | Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `heig… |
CVE-2024-24861 | Low | 3.3 | 2024-02-05 | A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000_get_frequency() function. This can result in return value overflow… |
CVE-2015-10129 | Low | 3.7 | 2024-02-04 | A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/i… |
CVE-2024-1215 | Low | 3.5 | 2024-02-03 | A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been rated as problematic. Affected by this issue is some unknown functionalit… |
CVE-2024-23553 | Low | 3.0 | 2024-02-02 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute. |
CVE-2024-1194 | Low | 3.3 | 2024-02-02 | A vulnerability classified as problematic has been found in Armcode AlienIP 2.41. Affected is an unknown function of the component Locate Host Handler. The man… |
CVE-2024-1193 | Low | 3.3 | 2024-02-02 | A vulnerability was found in Navicat 12.0.29. It has been rated as problematic. This issue affects some unknown processing of the component MySQL Conecction Ha… |
CVE-2024-1190 | Low | 3.3 | 2024-02-02 | A vulnerability was found in Global Scape CuteFTP 9.3.0.3 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation… |
CVE-2024-1188 | Low | 3.3 | 2024-02-02 | A vulnerability, which was classified as problematic, was found in Rizone Soft Notepad3 1.0.2.350. Affected is an unknown function of the component Encryption… |
CVE-2024-1187 | Low | 3.3 | 2024-02-02 | A vulnerability, which was classified as problematic, has been found in Munsoft Easy Outlook Express Recovery 2.0. This issue affects some unknown processing o… |
CVE-2024-24560 | Low | 3.7 | 2024-02-02 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at… |
CVE-2024-1186 | Low | 3.3 | 2024-02-02 | A vulnerability classified as problematic was found in Munsoft Easy Archive Recovery 2.0. This vulnerability affects unknown code of the component Registration… |
CVE-2024-1185 | Low | 3.3 | 2024-02-02 | A vulnerability classified as problematic has been found in Nsasoft NBMonitor Network Bandwidth Monitor 1.6.5.0. This affects an unknown part of the component… |
CVE-2023-50359 | Low | 3.4 | 2024-02-02 | An unchecked return value vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local a… |
CVE-2023-45037 | Low | 3.8 | 2024-02-02 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-45036 | Low | 3.8 | 2024-02-02 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-45035 | Low | 3.8 | 2024-02-02 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2023-41292 | Low | 3.8 | 2024-02-02 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-1184 | Low | 3.3 | 2024-02-02 | A vulnerability was found in Nsasoft Network Sleuth 3.0.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the comp… |
CVE-2024-21851 | Low | 2.9 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through integer overflow. |
CVE-2024-21845 | Low | 2.9 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through integer overflow. |
CVE-2023-49118 | Low | 2.9 | 2024-02-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read. |
CVE-2023-43756 | Low | 2.9 | 2024-02-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read. |
CVE-2023-46159 | Low | 2.6 | 2024-02-02 | IBM Storage Ceph 5.3z1, 5.3z5, and 6.1z1 could allow an authenticated user on the network to cause a denial of service from RGW. IBM X-Force ID: 268906. |
CVE-2023-50328 | Low | 3.7 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings. IBM X-Force ID: 275110. |
CVE-2024-0325 | Low | 3.6 | 2024-02-01 | In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins. |
CVE-2024-24754 | Low | 3.7 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lam… |
CVE-2024-1103 | Low | 3.5 | 2024-01-31 | A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionalit… |
CVE-2023-7043 | Low | 3.3 | 2024-01-31 | Unquoted service path in ESET products allows to drop a prepared program to a specific location and run on boot with the NT AUTHORITY\NetworkService permis… |
CVE-2024-1099 | Low | 3.5 | 2024-01-31 | A vulnerability was found in Rebuild up to 3.5.5. It has been classified as problematic. Affected is the function getFileOfData of the file /filex/read-raw. Th… |
CVE-2024-22236 | Low | 3.3 | 2024-01-31 | In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to loc… |
CVE-2024-23825 | Low | 3.0 | 2024-01-30 | TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by the user. That use… |