2024 CVEs (page 114)
Page 114 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11099 | High | 7.3 | 2024-11-12 | A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. T… |
CVE-2024-11097 | Low | 3.3 | 2024-11-12 | A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as problematic. This vulnerability affects unknown code of… |
CVE-2024-47595 | Medium | 6.3 | 2024-11-12 | An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacke… |
CVE-2024-47593 | Medium | 4.3 | 2024-11-12 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted… |
CVE-2024-47592 | Medium | 5.3 | 2024-11-12 | SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impac… |
CVE-2024-47590 | High | 8.8 | 2024-11-12 | An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, inp… |
CVE-2024-47588 | Medium | 4.7 | 2024-11-12 | In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext t… |
CVE-2024-47587 | Low | 3.5 | 2024-11-12 | Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confident… |
CVE-2024-47586 | Medium | 5.3 | 2024-11-12 | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a n… |
CVE-2024-42372 | Medium | 6.5 | 2024-11-12 | Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD co… |
CVE-2024-11096 | Medium | 6.3 | 2024-11-12 | A vulnerability, which was classified as critical, was found in code-projects Task Manager 1.0. This affects an unknown part of the file /newProject.php. The m… |
CVE-2024-11079 | Medium | 5.5 | 2024-11-12 | A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute t… |
CVE-2024-52533 | Critical | 9.8 | 2024-11-11 | gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trail… |
CVE-2024-51213 | Medium | 6.1 | 2024-11-11 | Cross Site Scripting vulnerability in Online Shop Store v.1.0 allows a remote attacker to execute arbitrary code via the login.php component. |
CVE-2024-50636 | Critical | 9.8 | 2024-11-11 | PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files. Attackers ca… |
CVE-2024-50601 | Medium | 6.1 | 2024-11-11 | Persistent and reflected XSS vulnerabilities in the themeMode cookie and _h URL parameter of Axigen Mail Server up to version 10.5.28 allow attackers to execut… |
CVE-2024-25255 | Critical | 9.8 | 2024-11-11 | Sublime Text 4 was discovered to contain a command injection vulnerability via the New Build System module. NOTE: multiple third parties report that this is in… |
CVE-2024-25254 | Critical | 9.8 | 2024-11-11 | SuperScan v4.1 was discovered to contain a buffer overflow via the Hostname/IP parameter. |
CVE-2024-25253 | High | 7.5 | 2024-11-11 | Driver Booster v10.6 was discovered to contain a buffer overflow via the Host parameter under the Customize proxy module. |
CVE-2024-23983 | | 2024-11-11 | Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules. | |
CVE-2024-51026 | Medium | 5.4 | 2024-11-11 | The NetAdmin IAM system (version 4.0.30319) has a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx endpoint, where it is possible to inject a… |
CVE-2024-46966 | High | 8.1 | 2024-11-11 | The Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbitrary JavaScript cod… |
CVE-2024-46964 | High | 8.1 | 2024-11-11 | The com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaScript code via the c… |
CVE-2024-46963 | High | 8.1 | 2024-11-11 | The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attacker to execute arbi… |
CVE-2024-46962 | Critical | 9.1 | 2024-11-11 | The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary JavaScript code via… |
CVE-2024-44546 | Critical | 9.8 | 2024-11-11 | Powerjob >= 3.20 is vulnerable to SQL injection via the version parameter. |
CVE-2024-52532 | High | 7.5 | 2024-11-11 | GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. |
CVE-2024-52531 | Medium | 6.5 | 2024-11-11 | GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausib… |
CVE-2024-52530 | High | 7.5 | 2024-11-11 | GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transf… |
CVE-2024-52288 | Medium | 5.1 | 2024-11-11 | libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3. In affec… |
CVE-2024-52286 | | 2024-11-11 | Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes… | |
CVE-2024-51992 | Medium | 4.1 | 2024-11-11 | Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. This vulnerability i… |
CVE-2024-51748 | Critical | 9.1 | 2024-11-11 | Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in com… |
CVE-2024-51747 | Critical | 9.1 | 2024-11-11 | Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the se… |
CVE-2024-51490 | Medium | 5.5 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. This vulnerability exists in the interface section of the Ampache menu, where users… |
CVE-2024-51489 | Medium | 5.4 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens… |
CVE-2024-51488 | Medium | 5.4 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens… |
CVE-2024-51487 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-51486 | Medium | 5.5 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The vulnerability exists in the interface section of the Ampache menu, where users c… |
CVE-2024-51485 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-51484 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-51190 | Medium | 4.8 | 2024-11-11 | TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the ptRule_Applicati… |
CVE-2024-51189 | Medium | 4.8 | 2024-11-11 | TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the macList_Name_1.1… |
CVE-2024-51188 | Medium | 4.8 | 2024-11-11 | TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the vsRule_VirtualSe… |
CVE-2024-51187 | Medium | 4.8 | 2024-11-11 | TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the firewallRule_Nam… |
CVE-2024-51186 | High | 8.0 | 2024-11-11 | D-Link DIR-820L 1.05b03 was discovered to contain a remote code execution (RCE) vulnerability via the ping_addr parameter in the ping_v4 and ping_v6 functions. |
CVE-2024-48322 | High | 8.1 | 2024-11-11 | UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability. |
CVE-2024-46965 | Medium | 5.4 | 2024-11-11 | The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execute arbitrary JavaScr… |
CVE-2024-36061 | Critical | 9.8 | 2024-11-11 | EnGenius EWS356-FIT devices through 1.1.30 allow blind OS command injection. This allows an attacker to execute arbitrary OS commands via shell metacharacters… |
CVE-2024-11078 | Low | 3.5 | 2024-11-11 | A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-10315 | | 2024-11-11 | In Gliffy Online an insecure configuration was discovered in versions before 4.14.0-6. Reported by Alpha Inferno PVT LTD. | |
CVE-2024-51135 | Critical | 9.8 | 2024-11-11 | An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensitive information o… |
CVE-2024-50667 | Critical | 9.8 | 2024-11-11 | The boa httpd of Trendnet TEW-820AP 1.01.B01 has a stack overflow vulnerability in /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, /boafrm/formDnsv6. The reason i… |
CVE-2024-11077 | High | 7.3 | 2024-11-11 | A vulnerability, which was classified as critical, was found in code-projects Job Recruitment 1.0. Affected is an unknown function of the file /index.php. The… |
CVE-2024-11076 | Medium | 6.3 | 2024-11-11 | A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file… |
CVE-2024-11074 | Medium | 6.3 | 2024-11-11 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file /incadd.p… |
CVE-2024-45087 | Medium | 4.8 | 2024-11-11 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript c… |
CVE-2024-11073 | Medium | 4.3 | 2024-11-11 | A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient… |
CVE-2024-10917 | Low | 3.7 | 2024-11-11 | In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is corre… |
CVE-2024-45088 | Medium | 6.4 | 2024-11-11 | IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript c… |
CVE-2024-43439 | Medium | 5.4 | 2024-11-11 | A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk. |
CVE-2024-51054 | Medium | 4.8 | 2024-11-11 | A Cross Site Scriptng (XSS) vulnerability was found in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System 1.0, which allows remote attack… |
CVE-2024-50991 | Medium | 4.8 | 2024-11-11 | A Cross Site Scripting (XSS) vulnerability was found in /ums-sp/admin/registered-users.php in PHPGurukul User Management System v1.0, which allows remote attac… |
CVE-2024-50990 | Medium | 6.1 | 2024-11-11 | A Reflected Cross Site Scriptng (XSS) vulnerability was found in /omrs/user/search.php in PHPGurukul Online Marriage Registration System v1.0, which allows rem… |
CVE-2024-50989 | Critical | 9.8 | 2024-11-11 | A SQL injection vulnerability in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System v1.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-47131 | High | 7.8 | 2024-11-11 | If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjec… |
CVE-2024-39605 | High | 7.8 | 2024-11-11 | If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParam… |
CVE-2024-39354 | High | 7.8 | 2024-11-11 | If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTag… |
CVE-2024-11070 | Low | 3.5 | 2024-11-11 | A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /a… |
CVE-2024-50263 | High | 7.8 | 2024-11-11 | In the Linux kernel, the following vulnerability has been resolved: fork: only invoke khugepaged, ksm hooks if no error There is no reason to invoke these ho… |
CVE-2024-34015 | Low | 3.3 | 2024-11-11 | Sensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cP… |
CVE-2024-34014 | Medium | 5.5 | 2024-11-11 | Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (L… |
CVE-2024-10345 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Więsek. | |
CVE-2024-10344 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Więsek. | |
CVE-2024-10314 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the auto-generation function was identified. Reported by Karol W… | |
CVE-2024-43437 | Medium | 5.4 | 2024-11-11 | A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup f… |
CVE-2024-43435 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the glo… |
CVE-2024-43433 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users. |
CVE-2024-43432 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request header… |
CVE-2024-43430 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. External API access to Quiz can override contained insufficient access control. |
CVE-2024-43429 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields"… |
CVE-2024-43427 | Low | 3.7 | 2024-11-11 | A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, whi… |
CVE-2024-11068 | Critical | 9.8 | 2024-11-11 | The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user’s password by lev… |
CVE-2024-11067 | High | 7.5 | 2024-11-11 | The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system… |
CVE-2024-11066 | High | 7.2 | 2024-11-11 | The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary sy… |
CVE-2024-11065 | High | 7.2 | 2024-11-11 | The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary sy… |
CVE-2024-11064 | High | 7.2 | 2024-11-11 | The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary sy… |
CVE-2024-11063 | High | 7.2 | 2024-11-11 | The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary sy… |
CVE-2024-11062 | High | 7.2 | 2024-11-11 | The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary sy… |
CVE-2024-11021 | Medium | 5.4 | 2024-11-11 | Webopac from Grand Vice info has Stored Cross-site Scripting vulnerability. Remote attackers with regular privileges can inject arbitrary JavaScript code into… |
CVE-2024-11020 | Critical | 9.8 | 2024-11-11 | Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and d… |
CVE-2024-52355 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MiKa OSM osm.This issue affects OSM: from n/a through <=… |
CVE-2024-52354 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cool Plugins Web Stories Widgets For Elementor shortcodes… |
CVE-2024-52353 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gabriel Serafini Christian Science Bible Lesson Subjects… |
CVE-2024-52352 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miloandrew Postcasa Shortcode postcasa allows DOM-Based X… |
CVE-2024-52351 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BU Web Team BU Slideshow bu-slideshow allows Stored XSS.T… |
CVE-2024-52350 | Medium | 6.5 | 2024-11-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nrmendez CRM 2go crm2go allows DOM-Based XSS.This issue a… |
CVE-2024-11019 | Medium | 6.1 | 2024-11-11 | Webopac from Grand Vice info has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code… |
CVE-2024-11018 | Critical | 9.8 | 2024-11-11 | Webopac from Grand Vice info does not properly validate uploaded file types, allowing unauthenticated remote attackers to upload and execute webshells, which c… |
CVE-2024-11017 | High | 8.8 | 2024-11-11 | Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells… |