2024 CVEs (page 114)
Page 114 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52530 | High | 7.5 | 2024-11-11 | GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transf… |
CVE-2024-52288 | Medium | 5.1 | 2024-11-11 | libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3. In affec… |
CVE-2024-52286 | | 2024-11-11 | Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes… | |
CVE-2024-51992 | Medium | 4.1 | 2024-11-11 | Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. This vulnerability i… |
CVE-2024-51748 | Critical | 9.1 | 2024-11-11 | Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in com… |
CVE-2024-51747 | Critical | 9.1 | 2024-11-11 | Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the se… |
CVE-2024-51490 | Medium | 5.5 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. This vulnerability exists in the interface section of the Ampache menu, where users… |
CVE-2024-51489 | Medium | 5.4 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens… |
CVE-2024-51488 | Medium | 5.4 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens… |
CVE-2024-51487 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-51486 | Medium | 5.5 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The vulnerability exists in the interface section of the Ampache menu, where users c… |
CVE-2024-51485 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-51484 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-51190 | Medium | 4.8 | 2024-11-11 | TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the ptRule_Applicati… |
CVE-2024-51189 | Medium | 4.8 | 2024-11-11 | TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the macList_Name_1.1… |
CVE-2024-51188 | Medium | 4.8 | 2024-11-11 | TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the vsRule_VirtualSe… |
CVE-2024-51187 | Medium | 4.8 | 2024-11-11 | TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the firewallRule_Nam… |
CVE-2024-51186 | High | 8.0 | 2024-11-11 | D-Link DIR-820L 1.05b03 was discovered to contain a remote code execution (RCE) vulnerability via the ping_addr parameter in the ping_v4 and ping_v6 functions. |
CVE-2024-48322 | High | 8.1 | 2024-11-11 | UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability. |
CVE-2024-46965 | Medium | 5.4 | 2024-11-11 | The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execute arbitrary JavaScr… |
CVE-2024-36061 | Critical | 9.8 | 2024-11-11 | EnGenius EWS356-FIT devices through 1.1.30 allow blind OS command injection. This allows an attacker to execute arbitrary OS commands via shell metacharacters… |
CVE-2024-11078 | Low | 3.5 | 2024-11-11 | A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-10315 | | 2024-11-11 | In Gliffy Online an insecure configuration was discovered in versions before 4.14.0-6. Reported by Alpha Inferno PVT LTD. | |
CVE-2024-51135 | Critical | 9.8 | 2024-11-11 | An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensitive information o… |
CVE-2024-50667 | Critical | 9.8 | 2024-11-11 | The boa httpd of Trendnet TEW-820AP 1.01.B01 has a stack overflow vulnerability in /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, /boafrm/formDnsv6. The reason i… |
CVE-2024-11077 | High | 7.3 | 2024-11-11 | A vulnerability, which was classified as critical, was found in code-projects Job Recruitment 1.0. Affected is an unknown function of the file /index.php. The… |
CVE-2024-11076 | Medium | 6.3 | 2024-11-11 | A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file… |
CVE-2024-11074 | Medium | 6.3 | 2024-11-11 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file /incadd.p… |
CVE-2024-45087 | Medium | 4.8 | 2024-11-11 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript c… |
CVE-2024-11073 | Medium | 4.3 | 2024-11-11 | A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient… |
CVE-2024-10917 | Low | 3.7 | 2024-11-11 | In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is corre… |
CVE-2024-45088 | Medium | 6.4 | 2024-11-11 | IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript c… |
CVE-2024-43439 | Medium | 5.4 | 2024-11-11 | A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk. |
CVE-2024-51054 | Medium | 4.8 | 2024-11-11 | A Cross Site Scriptng (XSS) vulnerability was found in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System 1.0, which allows remote attack… |
CVE-2024-50991 | Medium | 4.8 | 2024-11-11 | A Cross Site Scripting (XSS) vulnerability was found in /ums-sp/admin/registered-users.php in PHPGurukul User Management System v1.0, which allows remote attac… |
CVE-2024-50990 | Medium | 6.1 | 2024-11-11 | A Reflected Cross Site Scriptng (XSS) vulnerability was found in /omrs/user/search.php in PHPGurukul Online Marriage Registration System v1.0, which allows rem… |
CVE-2024-50989 | Critical | 9.8 | 2024-11-11 | A SQL injection vulnerability in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System v1.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-47131 | High | 7.8 | 2024-11-11 | If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjec… |
CVE-2024-39605 | High | 7.8 | 2024-11-11 | If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParam… |
CVE-2024-39354 | High | 7.8 | 2024-11-11 | If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTag… |
CVE-2024-11070 | Low | 3.5 | 2024-11-11 | A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /a… |
CVE-2024-50263 | High | 7.8 | 2024-11-11 | In the Linux kernel, the following vulnerability has been resolved: fork: only invoke khugepaged, ksm hooks if no error There is no reason to invoke these ho… |
CVE-2024-34015 | Low | 3.3 | 2024-11-11 | Sensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cP… |
CVE-2024-34014 | Medium | 5.5 | 2024-11-11 | Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (L… |
CVE-2024-10345 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Więsek. | |
CVE-2024-10344 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Więsek. | |
CVE-2024-10314 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the auto-generation function was identified. Reported by Karol W… | |
CVE-2024-43437 | Medium | 5.4 | 2024-11-11 | A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup f… |
CVE-2024-43435 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the glo… |
CVE-2024-43433 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users. |
CVE-2024-43432 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request header… |
CVE-2024-43430 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. External API access to Quiz can override contained insufficient access control. |
CVE-2024-43429 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields"… |
CVE-2024-43427 | Low | 3.7 | 2024-11-11 | A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, whi… |
CVE-2024-11068 | Critical | 9.8 | 2024-11-11 | The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user’s password by lev… |
CVE-2024-11067 | High | 7.5 | 2024-11-11 | The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system… |
CVE-2024-11066 | High | 7.2 | 2024-11-11 | The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary sy… |
CVE-2024-11065 | High | 7.2 | 2024-11-11 | The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary sy… |
CVE-2024-11064 | High | 7.2 | 2024-11-11 | The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary sy… |
CVE-2024-11063 | High | 7.2 | 2024-11-11 | The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary sy… |
CVE-2024-11062 | High | 7.2 | 2024-11-11 | The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary sy… |
CVE-2024-11021 | Medium | 5.4 | 2024-11-11 | Webopac from Grand Vice info has Stored Cross-site Scripting vulnerability. Remote attackers with regular privileges can inject arbitrary JavaScript code into… |
CVE-2024-11020 | Critical | 9.8 | 2024-11-11 | Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and d… |
CVE-2024-52355 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MiKa OSM osm.This issue affects OSM: from n/a through <=… |
CVE-2024-52354 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cool Plugins Web Stories Widgets For Elementor shortcodes… |
CVE-2024-52353 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gabriel Serafini Christian Science Bible Lesson Subjects… |
CVE-2024-52352 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miloandrew Postcasa Shortcode postcasa allows DOM-Based X… |
CVE-2024-52351 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BU Web Team BU Slideshow bu-slideshow allows Stored XSS.T… |
CVE-2024-52350 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nrmendez CRM 2go crm2go allows DOM-Based XSS.This issue a… |
CVE-2024-11019 | Medium | 6.1 | 2024-11-11 | Webopac from Grand Vice info has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code… |
CVE-2024-11018 | Critical | 9.8 | 2024-11-11 | Webopac from Grand Vice info does not properly validate uploaded file types, allowing unauthenticated remote attackers to upload and execute webshells, which c… |
CVE-2024-11017 | High | 8.8 | 2024-11-11 | Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells… |
CVE-2024-11016 | Critical | 9.8 | 2024-11-11 | Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and d… |
CVE-2024-52358 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-ad… |
CVE-2024-52357 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lqd LIQUID BLOCKS liquid-blocks allows Stored XSS.This is… |
CVE-2024-52356 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows… |
CVE-2024-51882 | High | 8.5 | 2024-11-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopalkumar315 Gboy Custom Google Map gboy-custom-google-m… |
CVE-2024-51845 | High | 8.5 | 2024-11-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-butt… |
CVE-2024-51843 | High | 8.5 | 2024-11-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fruitcakestudios Horsemanager fruitcake-horsemanager allo… |
CVE-2024-51837 | High | 8.5 | 2024-11-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sophia M Williams WP Contest wp-contest allows SQL Inject… |
CVE-2024-51820 | High | 8.5 | 2024-11-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wplsquared L Squared Hub WP l-squared-hub-wp-virtual-devi… |
CVE-2024-51793 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Upload a Web Shell to a Web Server.This i… |
CVE-2024-51792 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in Dang Ngoc Binh Audio Record audio-record allows Upload a Web Shell to a Web Server.This issue… |
CVE-2024-51791 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects… |
CVE-2024-51790 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in HB WEBSOL HB AUDIO GALLERY hb-audio-gallery allows Upload a Web Shell to a Web Server.This iss… |
CVE-2024-51789 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in UjW0L Image Classify image-classify allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2024-51788 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Wolfe The Novel Design Store Directory noveldesign-store-directory allows Upload a Web… |
CVE-2024-51575 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Abdullah Al Masum Extender All In One For Elementor e… |
CVE-2024-51574 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Goods Simple Goods simple-goods allows Stored XSS… |
CVE-2024-51573 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ersatzpole ML Responsive Audio player with playlist Short… |
CVE-2024-51572 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH QR Codes lh-qr-codes allows Stored XSS.This… |
CVE-2024-51571 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masterbip MasterBip para Elementor masterbip-for-elemento… |
CVE-2024-38826 | | 2024-11-11 | Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack aga… | |
CVE-2024-48939 | High | 7.5 | 2024-11-11 | Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with an invalid License… |
CVE-2024-41992 | High | 8.8 | 2024-11-11 | Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library function is used. For ex… |
CVE-2024-11061 | High | 8.8 | 2024-11-11 | A vulnerability classified as critical was found in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function FUN_0044db3c of the file /goform/fas… |
CVE-2024-11060 | Medium | 6.3 | 2024-11-11 | A vulnerability classified as critical has been found in Jinher Network Collaborative Management Platform 金和数字化智能办公平台 1.0. Affected is an unknown function of t… |
CVE-2024-11059 | Medium | 6.3 | 2024-11-11 | A vulnerability was found in Project Worlds Free Download Online Shopping System up to 192.168.1.88. It has been rated as critical. This issue affects some unk… |
CVE-2024-11058 | Medium | 4.7 | 2024-11-10 | A vulnerability was found in CodeAstro Real Estate Management System up to 1.0. It has been declared as critical. This vulnerability affects unknown code of th… |
CVE-2024-46956 | High | 7.8 | 2024-11-10 | An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution. |