2024 CVEs (page 106)
Page 106 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52508 | High | 8.2 | 2024-11-15 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like us… |
CVE-2024-52507 | Low | 3.5 | 2024-11-15 | Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and t… |
CVE-2024-50800 | Medium | 5.4 | 2024-11-15 | Cross Site Scripting vulnerability in M2000 Smart4Web before v.5.020241004 allows a remote attacker to execute arbitrary code via the error parameter in URL |
CVE-2024-47759 | Medium | 4.8 | 2024-11-15 | GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a malicious script. The script will then be executed when an… |
CVE-2024-46467 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical files and make them perform tasks with h… |
CVE-2024-46466 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by other users to misu… |
CVE-2024-46465 | High | 7.8 | 2024-11-15 | By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with high… |
CVE-2024-46463 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with high… |
CVE-2024-46462 | High | 7.8 | 2024-11-15 | By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with hig… |
CVE-2024-46383 | Low | 2.4 | 2024-11-15 | Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintext. |
CVE-2024-41678 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflec… |
CVE-2024-40638 | High | 8.1 | 2024-11-15 | GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to a… |
CVE-2024-24450 | Medium | 5.3 | 2024-11-15 | Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 allows a remote attacke… |
CVE-2024-24449 | Medium | 6.5 | 2024-11-15 | An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (D… |
CVE-2024-24447 | Medium | 5.3 | 2024-11-15 | A buffer overflow in the ngap_amf_handle_pdu_session_resource_setup_response function of oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Servic… |
CVE-2024-11251 | Medium | 6.3 | 2024-11-15 | A vulnerability was found in erzhongxmu Jeewms up to 20241108. It has been rated as critical. This issue affects some unknown processing of the file cgReportCo… |
CVE-2024-11250 | Medium | 6.3 | 2024-11-15 | A vulnerability was found in code-projects Inventory Management up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-52528 | | 2024-11-15 | Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway… | |
CVE-2024-52525 | Low | 1.8 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The sessio… |
CVE-2024-52523 | Medium | 4.6 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API retu… |
CVE-2024-52521 | Low | 2.6 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a ba… |
CVE-2024-52520 | Medium | 5.7 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigg… |
CVE-2024-52519 | Low | 2.7 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a b… |
CVE-2024-52518 | Medium | 4.4 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to… |
CVE-2024-52517 | Medium | 4.6 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend… |
CVE-2024-52516 | Low | 3.0 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user… |
CVE-2024-52515 | Medium | 5.7 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a mani… |
CVE-2024-50655 | Medium | 5.4 | 2024-11-15 | emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write malicious JavaScript code in published articles. |
CVE-2024-50654 | High | 7.5 | 2024-11-15 | lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturing and sending the… |
CVE-2024-50653 | High | 7.5 | 2024-11-15 | CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packe… |
CVE-2024-44625 | High | 8.8 | 2024-11-15 | Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go. |
CVE-2024-39726 | High | 8.2 | 2024-11-15 | IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XM… |
CVE-2024-11248 | High | 8.8 | 2024-11-15 | A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. Affected by this issue is the function formSetRebootTimer of the file /goform/S… |
CVE-2024-11247 | Low | 3.5 | 2024-11-15 | A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2024-52555 | Medium | 6.3 | 2024-11-15 | In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script |
CVE-2024-52526 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" tab of the Devi… |
CVE-2024-51497 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Custom OID" tab of a devi… |
CVE-2024-51496 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "metric" parameter of t… |
CVE-2024-51495 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allow… |
CVE-2024-51494 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allow… |
CVE-2024-51164 | Critical | 9.1 | 2024-11-15 | Multiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog/insertBtnLog, which could allow a remote user to submit a specially c… |
CVE-2024-50724 | Critical | 9.8 | 2024-11-15 | KASO v9.0 was discovered to contain a SQL injection vulnerability via the person_id parameter at /cardcase/editcard.jsp. |
CVE-2024-50652 | Medium | 4.3 | 2024-11-15 | A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by modifying the avatar function. |
CVE-2024-50651 | Medium | 6.5 | 2024-11-15 | java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID… |
CVE-2024-50650 | High | 7.5 | 2024-11-15 | python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the… |
CVE-2024-50649 | Critical | 9.8 | 2024-11-15 | The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability. |
CVE-2024-50648 | Critical | 9.8 | 2024-11-15 | yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files. |
CVE-2024-50647 | High | 7.5 | 2024-11-15 | The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through… |
CVE-2024-50355 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can edit the Display Name of a device, the application did not… |
CVE-2024-50352 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" section of the… |
CVE-2024-50351 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "section" parameter of… |
CVE-2024-50350 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allow… |
CVE-2024-49764 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Capture Debug Information… |
CVE-2024-49759 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page… |
CVE-2024-49758 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application did not properly sa… |
CVE-2024-49754 | High | 7.5 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows aut… |
CVE-2024-41784 | High | 7.5 | 2024-11-15 | IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, and 6.1.0.0 could allow a remote attacker to traverse directories on the system. An attacker coul… |
CVE-2024-11246 | Low | 3.5 | 2024-11-15 | A vulnerability, which was classified as problematic, was found in code-projects Farmacia 1.0. Affected is an unknown function of the file /adicionar-cliente.p… |
CVE-2024-11245 | Medium | 6.3 | 2024-11-15 | A vulnerability, which was classified as critical, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /editar… |
CVE-2024-11244 | Medium | 6.3 | 2024-11-15 | A vulnerability classified as critical was found in code-projects Farmacia 1.0. This vulnerability affects unknown code of the file /editar-cliente.php. The ma… |
CVE-2024-50986 | High | 7.3 | 2024-11-15 | An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file. |
CVE-2024-48068 | Medium | 6.1 | 2024-11-15 | A cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbitrary web scripts o… |
CVE-2024-43189 | Medium | 5.9 | 2024-11-15 | IBM Concert Software 1.0.0 through 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Tr… |
CVE-2024-41785 | Medium | 6.1 | 2024-11-15 | IBM Concert Software 1.0.0 through 1.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaSc… |
CVE-2024-20373 | Medium | 5.3 | 2024-11-15 | A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) IPv4 access control list (ACL) feature of Cisco IOS Software and Cisco I… |
CVE-2024-11243 | Medium | 4.3 | 2024-11-15 | A vulnerability classified as problematic has been found in code-projects Online Shop Store 1.0. This affects an unknown part of the file /signup.php. The mani… |
CVE-2024-11242 | Medium | 4.7 | 2024-11-15 | A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ad_list.php?act… |
CVE-2024-11241 | High | 7.3 | 2024-11-15 | A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-11240 | Low | 3.5 | 2024-11-15 | A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /database.p… |
CVE-2024-11239 | Medium | 5.4 | 2024-11-15 | A vulnerability has been found in Landray EKP up to 16.0 and classified as critical. This vulnerability affects the function deleteFile of the file /sys/common… |
CVE-2024-11238 | Medium | 6.5 | 2024-11-15 | A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_com… |
CVE-2024-11237 | High | 7.5 | 2024-11-15 | A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of… |
CVE-2024-1240 | Medium | 6.1 | 2024-11-15 | An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login fun… |
CVE-2024-1097 | Medium | 5.4 | 2024-11-15 | A stored cross-site scripting (XSS) vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while… |
CVE-2024-11182 | Medium | 6.1 | 2024-11-15 | An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This… |
CVE-2024-10534 | Critical | 9.8 | 2024-11-15 | Origin Validation Error vulnerability in Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) allows Traff… |
CVE-2024-10443 | Critical | 9.8 | 2024-11-15 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before… |
CVE-2024-0875 | Medium | 4.8 | 2024-11-15 | A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field… |
CVE-2024-0787 | Medium | 5.9 | 2024-11-15 | phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded… |
CVE-2024-8979 | High | 8.0 | 2024-11-15 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Info… |
CVE-2024-8978 | Medium | 5.7 | 2024-11-15 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Info… |
CVE-2024-10311 | High | 7.5 | 2024-11-15 | The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing… |
CVE-2024-45784 | High | 7.5 | 2024-11-15 | Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG a… |
CVE-2024-9529 | Medium | 6.6 | 2024-11-15 | The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin befor… |
CVE-2024-8961 | Medium | 6.4 | 2024-11-15 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-S… |
CVE-2024-10825 | Medium | 6.1 | 2024-11-15 | The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and includin… |
CVE-2024-10104 | Medium | 5.9 | 2024-11-15 | The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users such as contributor to… |
CVE-2024-9356 | Medium | 6.1 | 2024-11-15 | The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpo_user_email' and 'yotpo_u… |
CVE-2024-42499 | Medium | 5.3 | 2024-11-15 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is ex… |
CVE-2024-39610 | Medium | 6.1 | 2024-11-15 | Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script may be executed on th… |
CVE-2024-10793 | High | 7.2 | 2024-11-15 | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due… |
CVE-2024-10582 | Medium | 4.3 | 2024-11-15 | The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil… |
CVE-2024-10260 | High | 7.2 | 2024-11-15 | The Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 8.0.11 due to insufficien… |
CVE-2024-10113 | Medium | 6.4 | 2024-11-15 | The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpadcenter_ad shortcode in all ve… |
CVE-2024-9609 | Medium | 6.1 | 2024-11-15 | The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_impo… |
CVE-2024-10897 | Medium | 4.3 | 2024-11-15 | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_de… |
CVE-2024-10924 | Critical | 9.8 | 2024-11-15 | The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is d… |
CVE-2024-11120 | Critical | 9.8 | 2024-11-15 | Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute… |
CVE-2024-52613 | Medium | 5.5 | 2024-11-14 | A heap-based buffer under-read in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) via a crafted MOV video file. |
CVE-2024-52308 | High | 8.0 | 2024-11-14 | The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh… |