2024 CVEs (page 106)
Page 106 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24452 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB Release Indication messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Den… |
CVE-2024-11259 | Low | 3.5 | 2024-11-15 | A vulnerability, which was classified as problematic, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /for… |
CVE-2024-11258 | High | 7.3 | 2024-11-15 | A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. This vulnerability affects unknown code of the file /ad… |
CVE-2024-11257 | High | 7.3 | 2024-11-15 | A vulnerability classified as critical has been found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/fo… |
CVE-2024-11256 | High | 7.3 | 2024-11-15 | A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the fi… |
CVE-2024-10934 | Critical | 9.8 | 2024-11-15 | In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninit… |
CVE-2024-51330 | Medium | 5.1 | 2024-11-15 | An issue in UltiMaker Cura v.4.41 and 5.8.1 and before allows a local attacker to execute arbitrary code via Inter-process communication (IPC) mechanism betwee… |
CVE-2024-51142 | Medium | 5.4 | 2024-11-15 | Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows an attacker to execute arbitrary code via the svkey parameter of the storageapi.php file. |
CVE-2024-51141 | High | 7.8 | 2024-11-15 | An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll compo… |
CVE-2024-51037 | Medium | 5.3 | 2024-11-15 | An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function. |
CVE-2024-45971 | Critical | 9.8 | 2024-11-15 | Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to cau… |
CVE-2024-45970 | Critical | 9.8 | 2024-11-15 | Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to cau… |
CVE-2024-45969 | High | 7.5 | 2024-11-15 | NULL pointer dereference in the MMS Client in MZ Automation LibIEC1850 before commit 7afa40390b26ad1f4cf93deaa0052fe7e357ef33 allows a malicious server to Caus… |
CVE-2024-45608 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17. |
CVE-2024-43418 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflec… |
CVE-2024-43417 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflec… |
CVE-2024-41679 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0… |
CVE-2024-24446 | Medium | 6.5 | 2024-11-15 | An uninitialized pointer dereference in OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted InitialContext… |
CVE-2024-24431 | High | 7.5 | 2024-11-15 | A reachable assertion in the ogs_nas_emm_decode function of Open5GS v2.7.0 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet with a… |
CVE-2024-24426 | High | 7.5 | 2024-11-15 | Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0 allow attackers to cause a Denia… |
CVE-2024-24425 | Medium | 6.5 | 2024-11-15 | Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amf/amf_as.cpp. This… |
CVE-2024-23169 | Medium | 4.6 | 2024-11-15 | The web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule creation. |
CVE-2024-52522 | | 2024-11-15 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --… | |
CVE-2024-52514 | Medium | 4.1 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the us… |
CVE-2024-52513 | Low | 2.6 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to downloa… |
CVE-2024-52512 | Low | 3.3 | 2024-11-15 | user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided UR… |
CVE-2024-52511 | Medium | 6.3 | 2024-11-15 | Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly ins… |
CVE-2024-52510 | Medium | 4.2 | 2024-11-15 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed… |
CVE-2024-52509 | Low | 3.5 | 2024-11-15 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without do… |
CVE-2024-52508 | High | 8.2 | 2024-11-15 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like us… |
CVE-2024-52507 | Low | 3.5 | 2024-11-15 | Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and t… |
CVE-2024-50800 | Medium | 5.4 | 2024-11-15 | Cross Site Scripting vulnerability in M2000 Smart4Web before v.5.020241004 allows a remote attacker to execute arbitrary code via the error parameter in URL |
CVE-2024-47759 | Medium | 4.8 | 2024-11-15 | GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a malicious script. The script will then be executed when an… |
CVE-2024-46467 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical files and make them perform tasks with h… |
CVE-2024-46466 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by other users to misu… |
CVE-2024-46465 | High | 7.8 | 2024-11-15 | By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with high… |
CVE-2024-46463 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with high… |
CVE-2024-46462 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with hig… |
CVE-2024-46383 | Low | 2.4 | 2024-11-15 | Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintext. |
CVE-2024-41678 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflec… |
CVE-2024-40638 | High | 8.1 | 2024-11-15 | GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to a… |
CVE-2024-24450 | Medium | 5.3 | 2024-11-15 | Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 allows a remote attacke… |
CVE-2024-24449 | Medium | 6.5 | 2024-11-15 | An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (D… |
CVE-2024-24447 | Medium | 5.3 | 2024-11-15 | A buffer overflow in the ngap_amf_handle_pdu_session_resource_setup_response function of oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Servic… |
CVE-2024-11251 | Medium | 6.3 | 2024-11-15 | A vulnerability was found in erzhongxmu Jeewms up to 20241108. It has been rated as critical. This issue affects some unknown processing of the file cgReportCo… |
CVE-2024-11250 | Medium | 6.3 | 2024-11-15 | A vulnerability was found in code-projects Inventory Management up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-52528 | | 2024-11-15 | Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway… | |
CVE-2024-52525 | Low | 1.8 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The sessio… |
CVE-2024-52523 | Medium | 4.6 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API retu… |
CVE-2024-52521 | Low | 2.6 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a ba… |
CVE-2024-52520 | Medium | 5.7 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigg… |
CVE-2024-52519 | Low | 2.7 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a b… |
CVE-2024-52518 | Medium | 4.4 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to… |
CVE-2024-52517 | Medium | 4.6 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend… |
CVE-2024-52516 | Low | 3.0 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user… |
CVE-2024-52515 | Medium | 5.7 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a mani… |
CVE-2024-50655 | Medium | 5.4 | 2024-11-15 | emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write malicious JavaScript code in published articles. |
CVE-2024-50654 | High | 7.5 | 2024-11-15 | lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturing and sending the… |
CVE-2024-50653 | High | 7.5 | 2024-11-15 | CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packe… |
CVE-2024-44625 | High | 8.8 | 2024-11-15 | Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go. |
CVE-2024-39726 | High | 8.2 | 2024-11-15 | IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XM… |
CVE-2024-11248 | High | 8.8 | 2024-11-15 | A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. Affected by this issue is the function formSetRebootTimer of the file /goform/S… |
CVE-2024-11247 | Low | 3.5 | 2024-11-15 | A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2024-52555 | Medium | 6.3 | 2024-11-15 | In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script |
CVE-2024-52526 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" tab of the Devi… |
CVE-2024-51497 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Custom OID" tab of a devi… |
CVE-2024-51496 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "metric" parameter of t… |
CVE-2024-51495 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allow… |
CVE-2024-51494 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allow… |
CVE-2024-51164 | Critical | 9.1 | 2024-11-15 | Multiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog/insertBtnLog, which could allow a remote user to submit a specially c… |
CVE-2024-50724 | Critical | 9.8 | 2024-11-15 | KASO v9.0 was discovered to contain a SQL injection vulnerability via the person_id parameter at /cardcase/editcard.jsp. |
CVE-2024-50652 | Medium | 4.3 | 2024-11-15 | A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by modifying the avatar function. |
CVE-2024-50651 | Medium | 6.5 | 2024-11-15 | java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID… |
CVE-2024-50650 | High | 7.5 | 2024-11-15 | python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the… |
CVE-2024-50649 | Critical | 9.8 | 2024-11-15 | The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability. |
CVE-2024-50648 | Critical | 9.8 | 2024-11-15 | yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files. |
CVE-2024-50647 | High | 7.5 | 2024-11-15 | The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through… |
CVE-2024-50355 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can edit the Display Name of a device, the application did not… |
CVE-2024-50352 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" section of the… |
CVE-2024-50351 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "section" parameter of… |
CVE-2024-50350 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allow… |
CVE-2024-49764 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Capture Debug Information… |
CVE-2024-49759 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page… |
CVE-2024-49758 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application did not properly sa… |
CVE-2024-49754 | High | 7.5 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows aut… |
CVE-2024-41784 | High | 7.5 | 2024-11-15 | IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, and 6.1.0.0 could allow a remote attacker to traverse directories on the system. An attacker coul… |
CVE-2024-11246 | Low | 3.5 | 2024-11-15 | A vulnerability, which was classified as problematic, was found in code-projects Farmacia 1.0. Affected is an unknown function of the file /adicionar-cliente.p… |
CVE-2024-11245 | Medium | 6.3 | 2024-11-15 | A vulnerability, which was classified as critical, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /editar… |
CVE-2024-11244 | Medium | 6.3 | 2024-11-15 | A vulnerability classified as critical was found in code-projects Farmacia 1.0. This vulnerability affects unknown code of the file /editar-cliente.php. The ma… |
CVE-2024-50986 | High | 7.3 | 2024-11-15 | An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file. |
CVE-2024-48068 | Medium | 6.1 | 2024-11-15 | A cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbitrary web scripts o… |
CVE-2024-43189 | Medium | 5.9 | 2024-11-15 | IBM Concert Software 1.0.0 through 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Tr… |
CVE-2024-41785 | Medium | 6.1 | 2024-11-15 | IBM Concert Software 1.0.0 through 1.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaSc… |
CVE-2024-20373 | Medium | 5.3 | 2024-11-15 | A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) IPv4 access control list (ACL) feature of Cisco IOS Software and Cisco I… |
CVE-2024-11243 | Medium | 4.3 | 2024-11-15 | A vulnerability classified as problematic has been found in code-projects Online Shop Store 1.0. This affects an unknown part of the file /signup.php. The mani… |
CVE-2024-11242 | Medium | 4.7 | 2024-11-15 | A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ad_list.php?act… |
CVE-2024-11241 | High | 7.3 | 2024-11-15 | A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-11240 | Low | 3.5 | 2024-11-15 | A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /database.p… |
CVE-2024-11239 | Medium | 5.4 | 2024-11-15 | A vulnerability has been found in Landray EKP up to 16.0 and classified as critical. This vulnerability affects the function deleteFile of the file /sys/common… |
CVE-2024-11238 | Medium | 6.5 | 2024-11-15 | A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_com… |