2024 CVEs (page 104)
Page 104 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52426 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linear Oy Linear linear allows DOM-Based XSS.This issue a… |
CVE-2024-52425 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladislav Urchenko Drozd – Addons for Elementor drozd-add… |
CVE-2024-52424 | High | 7.1 | 2024-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in sureshdsk wp-login customizer wp-login-customizer allows Stored XSS.This issue affects wp-login customizer… |
CVE-2024-52423 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Stored X… |
CVE-2024-52422 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. WP Githuber MD wp-githuber-md allows Stored XSS… |
CVE-2024-52419 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clipboard Agency Copy Anything to Clipboard copy-the-code… |
CVE-2024-0012 | Critical | 9.8 | 2024-11-18 | An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain… |
CVE-2024-52436 | High | 7.6 | 2024-11-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal Post SMTP post-smtp allows Blind SQL Injection… |
CVE-2024-52435 | High | 7.6 | 2024-11-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages.Th… |
CVE-2024-52434 | Critical | 9.1 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsyst… |
CVE-2024-52433 | Critical | 9.8 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free my-geo-posts-free allows Object Injection.This issue affects My Geo… |
CVE-2024-52432 | Critical | 9.8 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Object Injection.This issue affects NIX Ant… |
CVE-2024-52431 | Critical | 9.3 | 2024-11-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressaholic WordPress Video Robot - The Ultimate Video Im… |
CVE-2024-52430 | Critical | 9.8 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in bublick Lis Video Gallery lis-video-gallery allows Object Injection.This issue affects Lis Video Gallery: fr… |
CVE-2024-52429 | Critical | 9.9 | 2024-11-18 | Unrestricted Upload of File with Dangerous Type vulnerability in AntonHoelstad WP Quick Setup wp-quick-setup allows Upload a Web Shell to a Web Server.This iss… |
CVE-2024-52428 | High | 8.1 | 2024-11-18 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Peter Ads Booster by Ads Pro free-wp-b… |
CVE-2024-52427 | Critical | 9.9 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Server Side Include (SS… |
CVE-2024-37155 | Medium | 6.5 | 2024-11-18 | OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the rege… |
CVE-2024-28058 | High | 7.5 | 2024-11-18 | In RSA NetWitness (NW) Platform before 12.5.1, even when an administrator revokes the access of a specific user with an active session, an internal threat acto… |
CVE-2024-11304 | | 2024-11-18 | Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows store… | |
CVE-2024-9526 | Medium | 5.4 | 2024-11-18 | There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it… |
CVE-2024-8781 | | 2024-11-18 | Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) allows Privilege Escala… | |
CVE-2024-11318 | High | 7.5 | 2024-11-18 | An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could allow a remote atta… |
CVE-2024-11303 | | 2024-11-18 | The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects… | |
CVE-2024-52318 | Medium | 6.1 | 2024-11-18 | Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgr… |
CVE-2024-3370 | High | 8.6 | 2024-11-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egebilgi Software Website Template allows SQL Injection. … |
CVE-2024-52317 | Medium | 6.5 | 2024-11-18 | Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to r… |
CVE-2024-52316 | Critical | 9.8 | 2024-11-18 | Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext co… |
CVE-2024-48901 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit th… |
CVE-2024-48898 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permiss… |
CVE-2024-48897 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify. |
CVE-2024-48896 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have ac… |
CVE-2024-11319 | Medium | 4.8 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Sit… |
CVE-2024-11023 | Medium | 6.1 | 2024-11-18 | Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronizat… |
CVE-2024-42392 | Medium | 4.0 | 2024-11-18 | Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains un… |
CVE-2024-42391 | Medium | 4.3 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applica… |
CVE-2024-42390 | Medium | 4.3 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applica… |
CVE-2024-42389 | Medium | 5.3 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applica… |
CVE-2024-42388 | Medium | 5.3 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applica… |
CVE-2024-42387 | Medium | 5.3 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applica… |
CVE-2024-42386 | High | 8.2 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segment… |
CVE-2024-42385 | Medium | 4.0 | 2024-11-18 | Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate… |
CVE-2024-42384 | High | 7.5 | 2024-11-18 | Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentatio… |
CVE-2024-42383 | Medium | 4.2 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for t… |
CVE-2024-41974 | High | 7.1 | 2024-11-18 | A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS… |
CVE-2024-41973 | High | 8.1 | 2024-11-18 | A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges. |
CVE-2024-41972 | Medium | 6.5 | 2024-11-18 | A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges. |
CVE-2024-41971 | High | 8.1 | 2024-11-18 | A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss. |
CVE-2024-41970 | Medium | 5.7 | 2024-11-18 | A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources. |
CVE-2024-48962 | High | 8.8 | 2024-11-18 | Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template… |
CVE-2024-47208 | Critical | 9.8 | 2024-11-18 | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz… |
CVE-2024-45791 | High | 7.5 | 2024-11-18 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are re… |
CVE-2024-45505 | High | 8.8 | 2024-11-18 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vulnerability can onl… |
CVE-2024-41969 | High | 8.8 | 2024-11-18 | A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full… |
CVE-2024-41968 | Medium | 5.4 | 2024-11-18 | A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS. |
CVE-2024-41967 | High | 8.1 | 2024-11-18 | A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denia… |
CVE-2024-41151 | High | 8.8 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Ap… |
CVE-2024-49574 | High | 8.3 | 2024-11-18 | Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module. |
CVE-2024-22067 | Medium | 6.8 | 2024-11-18 | ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker… |
CVE-2024-11315 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11314 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11313 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11312 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11311 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-5030 | Low | 3.8 | 2024-11-18 | The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a lo… |
CVE-2024-52947 | Medium | 5.4 | 2024-11-18 | A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.20.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter… |
CVE-2024-52946 | High | 8.8 | 2024-11-18 | An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticated user to raise their authentication lev… |
CVE-2024-52945 | High | 7.8 | 2024-11-18 | An issue was discovered in Veritas NetBackup before 10.5. This only applies to NetBackup components running on a Windows Operating System. If a user executes s… |
CVE-2024-52944 | Medium | 5.4 | 2024-11-18 | An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24698. It allows an authenticated remote attacker to inject a parameter into… |
CVE-2024-52943 | Medium | 5.4 | 2024-11-18 | An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24697. It allows an authenticated remote attacker to inject a parameter into… |
CVE-2024-52942 | Medium | 5.4 | 2024-11-18 | An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24696. It allows an authenticated remote attacker to inject a parameter into… |
CVE-2024-52941 | Medium | 5.4 | 2024-11-18 | An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24695. It allows an authenticated remote attacker to inject a parameter into… |
CVE-2024-11310 | High | 7.5 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. |
CVE-2024-11309 | High | 7.5 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. |
CVE-2024-11308 | Medium | 6.2 | 2024-11-18 | The DVC from TRCore encrypts files using a hardcoded key. Attackers can use this key to decrypt the files and restore the original content. |
CVE-2024-52940 | High | 7.5 | 2024-11-18 | AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must… |
CVE-2024-43704 | High | 8.4 | 2024-11-18 | Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent process. |
CVE-2024-52926 | Medium | 6.5 | 2024-11-18 | Delinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent. |
CVE-2024-52922 | Medium | 6.5 | 2024-11-18 | In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stall… |
CVE-2024-52921 | Medium | 5.3 | 2024-11-18 | In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block. |
CVE-2024-52920 | High | 7.5 | 2024-11-18 | Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message. |
CVE-2024-52919 | Medium | 6.5 | 2024-11-18 | Bitcoin Core before 22.0 has a CAddrMan nIdCount integer overflow and resultant assertion failure (and daemon exit) via a flood of addr messages. |
CVE-2024-52918 | Medium | 6.5 | 2024-11-18 | Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) via a BIP21 r paramete… |
CVE-2024-52917 | Medium | 6.5 | 2024-11-18 | Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH… |
CVE-2024-52916 | High | 7.5 | 2024-11-18 | Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers. |
CVE-2024-52915 | High | 7.5 | 2024-11-18 | Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message. |
CVE-2024-52914 | High | 7.5 | 2024-11-18 | In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction. |
CVE-2024-52913 | Medium | 5.3 | 2024-11-18 | In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled. |
CVE-2024-52912 | High | 7.5 | 2024-11-18 | Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an ab… |
CVE-2024-38828 | Medium | 5.3 | 2024-11-18 | Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack. |
CVE-2024-11306 | Medium | 5.3 | 2024-11-18 | A vulnerability, which was classified as critical, has been found in Altenergy Power Control Software up to 20241108. This issue affects some unknown processin… |
CVE-2024-11305 | Medium | 6.3 | 2024-11-18 | A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function get_status_zigbee… |
CVE-2024-0793 | High | 7.7 | 2024-11-17 | A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes… |
CVE-2024-52876 | High | 7.5 | 2024-11-17 | Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions… |
CVE-2024-52872 | High | 7.5 | 2024-11-17 | In Flagsmith before 2.134.1, the get_document endpoint is not correctly protected by permissions. |
CVE-2024-52871 | High | 7.5 | 2024-11-17 | In Flagsmith before 2.134.1, it is possible to bypass the ALLOW_REGISTRATION_WITHOUT_INVITE setting. |
CVE-2024-52867 | High | 8.1 | 2024-11-17 | guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns (e.g., for… |
CVE-2024-52397 | Critical | 9.1 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Davor Zeljkovic Convert Docx2post convert-docx2post allows Upload a Web Shell to a Web Server… |
CVE-2024-52416 | Critical | 10.0 | 2024-11-16 | Missing Authorization vulnerability in Eugen Bobrowski Debug Tool debug-tool allows Upload a Web Shell to a Web Server.This issue affects Debug Tool: from n/a… |
CVE-2024-52415 | High | 8.8 | 2024-11-16 | Cross-Site Request Forgery (CSRF) vulnerability in skipstorm SK WP Settings Backup sk-wp-settings-backup allows Object Injection.This issue affects SK WP Setti… |