2024 CVEs (page 107)
Page 107 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-49778 | High | 8.8 | 2024-11-14 | A heap-based buffer overflow in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) and Code Execution via a crafted… |
CVE-2024-49777 | High | 8.8 | 2024-11-14 | A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS), Information Disclosure and Code… |
CVE-2024-49776 | Medium | 6.5 | 2024-11-14 | A negative-size-param in tsMuxer version nightly-2024-04-05-01-53-02 allows attackers to cause Denial of Service (DoS) via a crafted TS video file. |
CVE-2024-41217 | Medium | 6.5 | 2024-11-14 | A heap-based buffer overflow in tsMuxer version nightly-2024-05-10-02-00-45 allows attackers to cause Denial of Service (DoS) via a crafted MKV video file. |
CVE-2024-41209 | High | 8.8 | 2024-11-14 | A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS) and Code Execution via a crafted… |
CVE-2024-41206 | Medium | 6.5 | 2024-11-14 | A stack-based buffer over-read in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Information Disclosure via a crafted TS video file. |
CVE-2024-51679 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in gentlesource Appointmind appointmind allows Stored XSS.This issue affects Appointmind: from n/a through <= 4… |
CVE-2024-51659 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in GeekRMX Twitter @Anywhere Plus twitter-anywhere-plus allows Stored XSS.This issue affects Twitter @Anywhere… |
CVE-2024-51658 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from… |
CVE-2024-51156 | Medium | 4.7 | 2024-11-14 | 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component 'erp.07fly.net:80/admin/SysNotifyUser/del.html?id=93'. |
CVE-2024-50968 | High | 7.5 | 2024-11-14 | A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to man… |
CVE-2024-48974 | Critical | 9.3 | 2024-11-14 | The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized chang… |
CVE-2024-48973 | Critical | 9.3 | 2024-11-14 | The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which… |
CVE-2024-48971 | Critical | 9.3 | 2024-11-14 | The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the pa… |
CVE-2024-48970 | Critical | 9.3 | 2024-11-14 | The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an o… |
CVE-2024-48967 | Critical | 10.0 | 2024-11-14 | The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination… |
CVE-2024-48966 | Critical | 10.0 | 2024-11-14 | The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC w… |
CVE-2024-40579 | Medium | 5.4 | 2024-11-14 | Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive information via modifi… |
CVE-2024-39707 | Medium | 5.3 | 2024-11-14 | Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible ro… |
CVE-2024-31695 | Critical | 9.8 | 2024-11-14 | A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authentication when adding… |
CVE-2024-9834 | Critical | 9.3 | 2024-11-14 | Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of in… |
CVE-2024-9832 | Critical | 9.3 | 2024-11-14 | There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execu… |
CVE-2024-51687 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in Platform.ly Platform.ly Official platformly allows Stored XSS.This issue affects Platform.ly Official: from… |
CVE-2024-51684 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu W3P SEO wp-perfect-plugin allows Stored XSS.This issue affects W3P SEO: from n/a through < 1… |
CVE-2024-51688 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in fraudlabspro FraudLabs Pro SMS Verification fraudlabs-pro-sms-verification allows Stored XSS.This issue affe… |
CVE-2024-49025 | Medium | 5.4 | 2024-11-14 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-10397 | High | 7.8 | 2024-11-14 | A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code. |
CVE-2024-10396 | Medium | 6.5 | 2024-11-14 | An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and… |
CVE-2024-10394 | High | 7.8 | 2024-11-14 | A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existin… |
CVE-2024-52370 | Critical | 9.9 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Hive Support Hive Support hive-support allows Upload a Web Shell to a Web Server.This issue af… |
CVE-2024-52369 | Critical | 9.9 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Optimal Access KBucket kbucket allows Upload a Web Shell to a Web Server.This issue affects KB… |
CVE-2024-3760 | High | 7.5 | 2024-11-14 | In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bombing vulnerability. Attackers can explo… |
CVE-2024-5125 | High | 7.3 | 2024-11-14 | parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files… |
CVE-2024-52524 | | 2024-11-14 | Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub… | |
CVE-2024-52396 | Medium | 4.9 | 2024-11-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue af… |
CVE-2024-52393 | Critical | 9.1 | 2024-11-14 | Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Po… |
CVE-2024-52384 | Critical | 9.9 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in wpmonks Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation ai-content-gen… |
CVE-2024-52383 | High | 7.5 | 2024-11-14 | Missing Authorization vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Exploiting Incorr… |
CVE-2024-52382 | Critical | 9.8 | 2024-11-14 | Missing Authorization vulnerability in medmatech Matix Popup Builder medma-matix allows Privilege Escalation.This issue affects Matix Popup Builder: from n/a t… |
CVE-2024-52381 | High | 8.1 | 2024-11-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Shoaib Rehmat ZIJ KART zij-kart allows… |
CVE-2024-52380 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in softpulseinfotech Picsmize picsmize allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2024-52379 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in faizalbahasan kineticPay for WooCommerce kineticpay-for-woocommerce allows Upload a Web Shell… |
CVE-2024-52378 | High | 7.5 | 2024-11-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 DigiPass digipass allows Absolute Path Traversal.This is… |
CVE-2024-52377 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in bdthemes Instant Image Generator ai-image allows Upload a Web Shell to a Web Server.This issue… |
CVE-2024-52376 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress boat-rental-system allows Upload a Web Shell to a We… |
CVE-2024-52375 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Arttia Creative Datasets Manager by Arttia Creative datasets-manager-by-arttia-creative.This i… |
CVE-2024-52374 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in DoThatTask Do That Task do-that-task allows Upload a Web Shell to a Web Server.This issue affe… |
CVE-2024-52373 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Team Devexhub Devexhub Gallery devexhub-gallery allows Upload a Web Shell to a Web Server.This… |
CVE-2024-52372 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in WebTechGlobal Easy CSV Importer BETA easy-csv-importer allows Upload a Web Shell to a Web Serv… |
CVE-2024-52371 | High | 8.6 | 2024-11-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway | globe-gateway-e4… |
CVE-2024-50831 | High | 7.2 | 2024-11-14 | A SQL Injection was found in /admin/admin_user.php in kashipara E-learning Management System Project 1.0 via the username and password parameters. |
CVE-2024-50830 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/calendar_of_events.php in kashipara E-learning Management System Project 1.0 via the date_start, date_end, an… |
CVE-2024-50829 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/edit_subject.php in kashipara E-learning Management System Project 1.0 via the unit parameter. |
CVE-2024-50828 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/edit_department.php in kashipara E-learning Management System Project 1.0 via the d parameter. |
CVE-2024-50827 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/add_subject.php in kashipara E-learning Management System Project 1.0 via the subject_code parameter. |
CVE-2024-50826 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/add_content.php in kashipara E-learning Management System Project 1.0 via the title and content parameters. |
CVE-2024-50825 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/school_year.php in kashipara E-learning Management System Project 1.0 via the school_year parameter. |
CVE-2024-50824 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/class.php in kashipara E-learning Management System Project 1.0 via the class_name parameter. |
CVE-2024-50823 | Critical | 9.8 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/login.php in kashipara E-learning Management System Project 1.0 via the username and password parameters. |
CVE-2024-4343 | Critical | 9.8 | 2024-11-14 | A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of… |
CVE-2024-4311 | Medium | 5.4 | 2024-11-14 | zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-forc… |
CVE-2024-49362 | High | 7.7 | 2024-11-14 | Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user click… |
CVE-2024-48284 | Medium | 4.8 | 2024-11-14 | A Reflected Cross-Site Scripting (XSS) vulnerability was found in the /search-result.php page of the PHPGurukul User Registration & Login and User Management S… |
CVE-2024-3502 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently… |
CVE-2024-3501 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the respons… |
CVE-2024-3379 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged users to re-generate the private key for project… |
CVE-2024-1682 | Medium | 4.3 | 2024-11-14 | An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external… |
CVE-2024-6068 | High | 7.3 | 2024-11-14 | A memory corruption vulnerability exists in the affected products when parsing DFT files. Local threat actors can exploit this issue to disclose information a… |
CVE-2024-50836 | Medium | 4.8 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability al… |
CVE-2024-50835 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/edit_student.php in KASHIPARA E-learning Management System Project 1.0 via the cys, un, ln, fn, and id parame… |
CVE-2024-50834 | High | 7.2 | 2024-11-14 | A SQL Injection was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0 via the firstname and lastname parameters. |
CVE-2024-50833 | Critical | 9.8 | 2024-11-14 | A SQL Injection vulnerability was found in /login.php in KASHIPARA E-learning Management System Project 1.0 via the username and password parameters. |
CVE-2024-50832 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/edit_class.php in kashipara E-learning Management System Project 1.0 via the class_name parameter. |
CVE-2024-37285 | Critical | 9.1 | 2024-11-14 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful… |
CVE-2024-52505 | Medium | 5.4 | 2024-11-14 | matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 c… |
CVE-2024-52302 | | 2024-11-14 | common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. There is a critical… | |
CVE-2024-42188 | Low | 3.7 | 2024-11-14 | HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios. |
CVE-2024-11214 | Medium | 4.7 | 2024-11-14 | A vulnerability has been found in SourceCodester Best Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-11213 | Medium | 4.7 | 2024-11-14 | A vulnerability, which was classified as critical, was found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /a… |
CVE-2024-11136 | | 2024-11-14 | The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delet… | |
CVE-2024-10921 | Medium | 6.8 | 2024-11-14 | An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malfo… |
CVE-2024-7124 | | 2024-11-14 | Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software in the parameter 'filter' in the endpoint 'indexsearch' allo… | |
CVE-2024-50838 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/department.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability… |
CVE-2024-50837 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/admin_user.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability… |
CVE-2024-11212 | Medium | 6.3 | 2024-11-14 | A vulnerability, which was classified as critical, has been found in SourceCodester Best Employee Management System 1.0. Affected by this issue is some unknown… |
CVE-2024-11211 | Medium | 4.7 | 2024-11-14 | A vulnerability classified as critical has been found in EyouCMS up to 1.6.7. Affected is an unknown function of the component Website Logo Handler. The manipu… |
CVE-2024-11210 | Medium | 5.4 | 2024-11-14 | A vulnerability was found in EyouCMS 1.51. It has been rated as critical. This issue affects the function editFile of the file application/admin/logic/Filemana… |
CVE-2024-9633 | Low | 3.1 | 2024-11-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versio… |
CVE-2024-50843 | Medium | 5.3 | 2024-11-14 | A Directory listing issue was found in PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers attacker to access se… |
CVE-2024-50842 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/school_year.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability… |
CVE-2024-50841 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/calendar_of_events.php in KASHIPARA E-learning Management System Project 1.0. This vulner… |
CVE-2024-50840 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/class.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allow… |
CVE-2024-50839 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/add_subject.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability… |
CVE-2024-11215 | Medium | 6.5 | 2024-11-14 | Absolute path traversal (incorrect restriction of a path to a restricted directory) vulnerability in the EasyPHP web server, affecting version 14.1. This vulne… |
CVE-2024-11209 | Medium | 6.3 | 2024-11-14 | A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA… |
CVE-2024-11208 | Low | 3.7 | 2024-11-14 | A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The… |
CVE-2024-10962 | High | 8.8 | 2024-11-14 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deseriali… |
CVE-2024-8648 | Medium | 6.1 | 2024-11-14 | An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could… |
CVE-2024-7404 | Medium | 6.8 | 2024-11-14 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 pr… |
CVE-2024-11207 | Medium | 4.3 | 2024-11-14 | A vulnerability has been found in Apereo CAS 6.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login… |