2024 CVEs (page 108)
Page 108 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50833 | Critical | 9.8 | 2024-11-14 | A SQL Injection vulnerability was found in /login.php in KASHIPARA E-learning Management System Project 1.0 via the username and password parameters. |
CVE-2024-50832 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/edit_class.php in kashipara E-learning Management System Project 1.0 via the class_name parameter. |
CVE-2024-37285 | Critical | 9.1 | 2024-11-14 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful… |
CVE-2024-52505 | Medium | 5.4 | 2024-11-14 | matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 c… |
CVE-2024-52302 | | 2024-11-14 | common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. There is a critical… | |
CVE-2024-42188 | Low | 3.7 | 2024-11-14 | HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios. |
CVE-2024-11214 | Medium | 4.7 | 2024-11-14 | A vulnerability has been found in SourceCodester Best Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-11213 | Medium | 4.7 | 2024-11-14 | A vulnerability, which was classified as critical, was found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /a… |
CVE-2024-11136 | | 2024-11-14 | The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delet… | |
CVE-2024-10921 | Medium | 6.8 | 2024-11-14 | An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malfo… |
CVE-2024-7124 | | 2024-11-14 | Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software in the parameter 'filter' in the endpoint 'indexsearch' allo… | |
CVE-2024-50838 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/department.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability… |
CVE-2024-50837 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/admin_user.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability… |
CVE-2024-11212 | Medium | 6.3 | 2024-11-14 | A vulnerability, which was classified as critical, has been found in SourceCodester Best Employee Management System 1.0. Affected by this issue is some unknown… |
CVE-2024-11211 | Medium | 4.7 | 2024-11-14 | A vulnerability classified as critical has been found in EyouCMS up to 1.6.7. Affected is an unknown function of the component Website Logo Handler. The manipu… |
CVE-2024-11210 | Medium | 5.4 | 2024-11-14 | A vulnerability was found in EyouCMS 1.51. It has been rated as critical. This issue affects the function editFile of the file application/admin/logic/Filemana… |
CVE-2024-9633 | Low | 3.1 | 2024-11-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versio… |
CVE-2024-50843 | Medium | 5.3 | 2024-11-14 | A Directory listing issue was found in PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers attacker to access se… |
CVE-2024-50842 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/school_year.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability… |
CVE-2024-50841 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/calendar_of_events.php in KASHIPARA E-learning Management System Project 1.0. This vulner… |
CVE-2024-50840 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/class.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allow… |
CVE-2024-50839 | Medium | 5.4 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/add_subject.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability… |
CVE-2024-11215 | Medium | 6.5 | 2024-11-14 | Absolute path traversal (incorrect restriction of a path to a restricted directory) vulnerability in the EasyPHP web server, affecting version 14.1. This vulne… |
CVE-2024-11209 | Medium | 6.3 | 2024-11-14 | A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA… |
CVE-2024-11208 | Low | 3.7 | 2024-11-14 | A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The… |
CVE-2024-10962 | High | 8.8 | 2024-11-14 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deseriali… |
CVE-2024-8648 | Medium | 6.1 | 2024-11-14 | An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could… |
CVE-2024-7404 | Medium | 6.8 | 2024-11-14 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 pr… |
CVE-2024-11207 | Medium | 4.3 | 2024-11-14 | A vulnerability has been found in Apereo CAS 6.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login… |
CVE-2024-10979 | High | 8.8 | 2024-11-14 | Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. P… |
CVE-2024-10978 | Medium | 4.2 | 2024-11-14 | Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack require… |
CVE-2024-10977 | Low | 3.1 | 2024-11-14 | Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq… |
CVE-2024-10976 | Medium | 4.2 | 2024-11-14 | Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CV… |
CVE-2024-7730 | High | 7.4 | 2024-11-14 | A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the functio… |
CVE-2024-45670 | Medium | 5.6 | 2024-11-14 | IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user… |
CVE-2024-45642 | Medium | 5.3 | 2024-11-14 | IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI th… |
CVE-2024-45099 | Low | 3.1 | 2024-11-14 | IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI th… |
CVE-2024-3447 | Medium | 6.0 | 2024-11-14 | A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer`… |
CVE-2024-9693 | High | 8.5 | 2024-11-14 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 p… |
CVE-2024-8180 | Medium | 5.4 | 2024-11-14 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encodi… |
CVE-2024-10571 | Critical | 9.8 | 2024-11-14 | The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' p… |
CVE-2024-9472 | | 2024-11-14 | A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when D… | |
CVE-2024-5920 | Medium | 4.8 | 2024-11-14 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially… |
CVE-2024-5919 | Medium | 6.5 | 2024-11-14 | A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary… |
CVE-2024-5918 | Medium | 4.3 | 2024-11-14 | An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate t… |
CVE-2024-5917 | Medium | 4.9 | 2024-11-14 | A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a… |
CVE-2024-50306 | Critical | 9.1 | 2024-11-14 | Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, fr… |
CVE-2024-50305 | High | 7.5 | 2024-11-14 | Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users… |
CVE-2024-47916 | High | 7.5 | 2024-11-14 | Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2024-47915 | High | 7.5 | 2024-11-14 | VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-47914 | Medium | 4.5 | 2024-11-14 | VaeMendis - CWE-352: Cross-Site Request Forgery (CSRF) |
CVE-2024-45254 | High | 7.5 | 2024-11-14 | VaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2024-45253 | High | 7.5 | 2024-11-14 | Avigilon – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVE-2024-38479 | High | 7.5 | 2024-11-14 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2… |
CVE-2024-2552 | Medium | 6.0 | 2024-11-14 | A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management… |
CVE-2024-2551 | High | 7.5 | 2024-11-14 | A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewal… |
CVE-2024-2550 | High | 7.5 | 2024-11-14 | A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the Glo… |
CVE-2024-7787 | | 2024-11-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ITG Computer Technology vSRM Supplier Relationship… | |
CVE-2024-11206 | High | 7.5 | 2024-11-14 | Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information. |
CVE-2024-9186 | High | 8.6 | 2024-11-14 | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and es… |
CVE-2024-10146 | Medium | 5.4 | 2024-11-14 | The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflec… |
CVE-2024-5082 | | 2024-11-14 | A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. This issue affects Nexus Repository 2 OSS/Pro versions up to and in… | |
CVE-2024-5083 | | 2024-11-14 | A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to an… | |
CVE-2024-40410 | Medium | 4.8 | 2024-11-13 | Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption. |
CVE-2024-40408 | High | 7.3 | 2024-11-13 | Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allo… |
CVE-2024-40407 | High | 7.5 | 2024-11-13 | A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified ve… |
CVE-2024-40405 | High | 8.1 | 2024-11-13 | Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request. |
CVE-2024-40404 | Critical | 9.8 | 2024-11-13 | Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are… |
CVE-2024-51027 | Medium | 6.5 | 2024-11-13 | Ruijie NBR800G gateway NBR_RGOS_11.1(6)B4P9 is vulnerable to command execution in /itbox_pi/networksafe.php via the province parameter. |
CVE-2024-50956 | Medium | 6.5 | 2024-11-13 | A buffer overflow in the RecvSocketData function of Inovance HCPLC_AM401-CPU1608TPTN 21.38.0.0, HCPLC_AM402-CPU1608TPTN 41.38.0.0, and HCPLC_AM403-CPU1608TN 81… |
CVE-2024-50955 | High | 7.5 | 2024-11-13 | An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service (DoS) via a crafted TCP message. |
CVE-2024-52554 | High | 8.8 | 2024-11-13 | Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed i… |
CVE-2024-52553 | High | 8.8 | 2024-11-13 | Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login. |
CVE-2024-52552 | High | 8.0 | 2024-11-13 | Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored… |
CVE-2024-52551 | High | 8.0 | 2024-11-13 | Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a… |
CVE-2024-52550 | High | 8.0 | 2024-11-13 | Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebu… |
CVE-2024-52549 | Medium | 4.3 | 2024-11-13 | Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission c… |
CVE-2024-45879 | Medium | 5.4 | 2024-11-13 | The file upload function in the "QWKalkulation" tool of baltic-it TOPqw Webportal v1.35.287.1 (fixed in version 1.35.291), in /Apps/TOPqw/QWKalkulation/QWKalku… |
CVE-2024-45878 | Medium | 5.4 | 2024-11-13 | The "Stammdaten" menu of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.291), in /Apps/TOPqw/qwStammdaten.aspx, is vulnerable to persistent Cross… |
CVE-2024-45877 | Medium | 6.5 | 2024-11-13 | baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. This al… |
CVE-2024-45876 | Medium | 6.5 | 2024-11-13 | The login form of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.283.4) at /Apps/TOPqw/Login.aspx is vulnerable to SQL injection. The vulnerabili… |
CVE-2024-45875 | Medium | 5.4 | 2024-11-13 | The create user function in baltic-it TOPqw Webportal 1.35.287.1 (fixed in version1.35.291), in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser, is vulnerable… |
CVE-2024-41167 | High | 7.5 | 2024-11-13 | Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user to potentially enable escalation of privi… |
CVE-2024-40885 | Medium | 6.4 | 2024-11-13 | Use after free in the UEFI firmware of some Intel(R) Server M20NTP BIOS may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2024-39811 | Medium | 6.3 | 2024-11-13 | Improper input validation in firmware for some Intel(R) Server M20NTP Family UEFI may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2024-39766 | High | 7.0 | 2024-11-13 | Improper neutralization of special elements used in SQL command in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user… |
CVE-2024-39609 | High | 7.5 | 2024-11-13 | Improper Access Control in UEFI firmware for some Intel(R) Server Board M70KLP may allow a privileged user to potentially enable escalation of privilege via lo… |
CVE-2024-39368 | High | 8.0 | 2024-11-13 | Improper neutralization of special elements used in an SQL command ('SQL Injection') in some Intel(R) Neural Compressor software before version v3.0 may allow… |
CVE-2024-39285 | Medium | 5.3 | 2024-11-13 | Improper access control in UEFI firmware in some Intel(R) Server M20NTP Family may allow a privileged user to potentially enable information disclosure via loc… |
CVE-2024-38668 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path for some Intel(R) Quartus(R) Prime Standard Edition software for Windows before version 23.1.1 may allow an authenticated user to pote… |
CVE-2024-38665 | High | 8.4 | 2024-11-13 | Out-of-bounds write in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2024-38660 | Low | 3.8 | 2024-11-13 | Protection mechanism failure in the SPP for some Intel(R) Xeon(R) processor family (E-Core) may allow an authenticated user to potentially enable escalation of… |
CVE-2024-38387 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path in the Intel(R) Graphics Driver installers for versions 15.40 and 15.45 may allow an authenticated user to potentially enable escalati… |
CVE-2024-38383 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition software for Windows before version 24.2 may allow an authenticated user to potentially… |
CVE-2024-37027 | Medium | 6.1 | 2024-11-13 | Improper Input validation in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentially enable denial of… |
CVE-2024-37025 | Medium | 6.7 | 2024-11-13 | Incorrect execution-assigned permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installer before version 23.1.1 may allow an authent… |
CVE-2024-37024 | Medium | 6.7 | 2024-11-13 | Uncontrolled search path for some ACAT software maintained by Intel(R) for Windows before version 3.11.0 may allow an authenticated user to potentially enable… |
CVE-2024-36488 | High | 7.3 | 2024-11-13 | Improper Access Control in some Intel(R) DSA before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of privilege via local a… |
CVE-2024-36482 | High | 8.2 | 2024-11-13 | Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalation of privilege via… |
CVE-2024-36294 | Medium | 6.7 | 2024-11-13 | Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of priv… |