2024 CVEs (page 126)
Page 126 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27525 | Medium | 4.6 | 2024-11-01 | Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of t… |
CVE-2024-27524 | High | 7.1 | 2024-11-01 | Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of t… |
CVE-2024-10658 | Medium | 6.3 | 2024-11-01 | A vulnerability classified as critical was found in Tongda OA up to 11.10. Affected by this vulnerability is an unknown functionality of the file /pda/approve_… |
CVE-2024-10657 | Medium | 6.3 | 2024-11-01 | A vulnerability classified as critical has been found in Tongda OA up to 11.10. Affected is an unknown function of the file /pda/approve_center/prcs_info.php… |
CVE-2024-10656 | Medium | 6.3 | 2024-11-01 | A vulnerability was found in Tongda OA 2017 up to 11.9. It has been rated as critical. This issue affects some unknown processing of the file /pda/meeting/appl… |
CVE-2024-51407 | Medium | 6.2 | 2024-11-01 | Floodlight SDN OpenFlow Controller v.1.2 has an issue that allows local hosts to construct false broadcast ports causing inter-host communication anomalies. |
CVE-2024-51406 | Medium | 6.2 | 2024-11-01 | Floodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP packets that allow specific clusters to be missed by Floodlig… |
CVE-2024-48270 | High | 7.5 | 2024-11-01 | An issue in the component /logins of oasys v1.1 allows attackers to access sensitive information via a burst attack. |
CVE-2024-37094 | High | 8.2 | 2024-11-01 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affe… |
CVE-2024-10655 | Medium | 6.3 | 2024-11-01 | A vulnerability was found in Tongda OA 2017 up to 11.9. It has been declared as critical. This vulnerability affects unknown code of the file /pda/reportshop/n… |
CVE-2024-7456 | Critical | 9.8 | 2024-11-01 | A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2. The `order by` clause of the SQL query uses `sql… |
CVE-2024-10654 | Medium | 5.3 | 2024-11-01 | A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-10367 | Medium | 6.4 | 2024-11-01 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG… |
CVE-2024-10653 | High | 7.2 | 2024-11-01 | IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with ad… |
CVE-2024-10652 | Medium | 6.1 | 2024-11-01 | IDExpert from CHANGING Information Technology does not properly validate a parameter for a specific functionality, allowing unauthenticated remote attackers to… |
CVE-2024-10651 | Medium | 4.9 | 2024-11-01 | IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with ad… |
CVE-2024-10232 | Medium | 6.4 | 2024-11-01 | The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atomchat shortcode in all versions u… |
CVE-2024-9655 | Medium | 6.4 | 2024-11-01 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon widg… |
CVE-2024-7424 | Medium | 5.4 | 2024-11-01 | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability chec… |
CVE-2024-0106 | High | 8.7 | 2024-11-01 | NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker may cause an improper handling of insuffi… |
CVE-2024-0105 | High | 8.9 | 2024-11-01 | NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of th… |
CVE-2024-49501 | Medium | 5.7 | 2024-11-01 | Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. If this vulnerability is exploited, an attacker may access the p… |
CVE-2024-47939 | High | 7.7 | 2024-11-01 | Stack-based buffer overflow vulnerability exists in multiple laser printers and MFPs which implement Ricoh Web Image Monitor. If this vulnerability is exploite… |
CVE-2024-21510 | Medium | 5.4 | 2024-11-01 | Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When ma… |
CVE-2024-10620 | Medium | 5.3 | 2024-11-01 | A vulnerability was found in knightliao Disconf 2.6.36. It has been classified as critical. This affects an unknown part of the file /api/config/list of the co… |
CVE-2024-10619 | Medium | 6.3 | 2024-11-01 | A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /pda/reportshop/next_de… |
CVE-2024-10618 | Medium | 6.3 | 2024-11-01 | A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.10. This issue affects some unknown processing of the file /pda/re… |
CVE-2024-10617 | Medium | 6.3 | 2024-11-01 | A vulnerability classified as critical was found in Tongda OA up to 11.10. This vulnerability affects unknown code of the file /pda/workflow/check_seal.php. Th… |
CVE-2024-10616 | Medium | 6.3 | 2024-11-01 | A vulnerability classified as critical has been found in Tongda OA up to 11.9. This affects an unknown part of the file /pda/workflow/webSignSubmit.php. The ma… |
CVE-2024-10615 | Medium | 6.3 | 2024-11-01 | A vulnerability was found in Tongda OA 2017 up to 11.10. It has been rated as critical. Affected by this issue is some unknown functionality of the file /gener… |
CVE-2024-10613 | Medium | 6.3 | 2024-11-01 | A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. Affected by this vulnerability is the function delSystemEncryptPolicy of the fil… |
CVE-2024-10612 | Medium | 6.3 | 2024-11-01 | A vulnerability was found in ESAFENET CDG 5. It has been classified as critical. Affected is the function removeHookInvalidCourse of the file /com/esafenet/ser… |
CVE-2024-10611 | Medium | 6.3 | 2024-11-01 | A vulnerability was found in ESAFENET CDG 5 and classified as critical. This issue affects the function delProtocol of the file /com/esafenet/servlet/system/Pr… |
CVE-2024-10610 | Medium | 6.3 | 2024-11-01 | A vulnerability has been found in ESAFENET CDG 5 and classified as critical. This vulnerability affects the function delProtocol of the file /com/esafenet/serv… |
CVE-2024-10609 | Medium | 6.3 | 2024-11-01 | A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System Project 1.0. This affects an unknown part of the file… |
CVE-2024-10608 | High | 7.3 | 2024-11-01 | A vulnerability was found in code-projects Courier Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2024-10607 | High | 7.3 | 2024-11-01 | A vulnerability was found in code-projects Courier Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2024-10605 | Medium | 4.3 | 2024-11-01 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /f… |
CVE-2024-10602 | Medium | 6.3 | 2024-11-01 | A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file /general/ap… |
CVE-2024-10601 | Medium | 6.3 | 2024-10-31 | A vulnerability has been found in Tongda OA 2017 up to 11.10 and classified as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-10600 | High | 7.3 | 2024-10-31 | A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.6. Affected is an unknown function of the file pda/appcenter/submenu.ph… |
CVE-2024-6480 | Medium | 6.4 | 2024-10-31 | The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'no_of_reviews' attribute in the woocommerc… |
CVE-2024-6479 | Medium | 6.5 | 2024-10-31 | The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'no_of_reviews' attribute in the woocommerce_reviews shor… |
CVE-2024-10599 | Medium | 5.3 | 2024-10-31 | A vulnerability, which was classified as problematic, has been found in Tongda OA 2017 up to 11.7. This issue affects some unknown processing of the file /inc/… |
CVE-2024-10598 | Medium | 5.3 | 2024-10-31 | A vulnerability classified as critical was found in Tongda OA 11.2/11.3/11.4/11.5/11.6. This vulnerability affects unknown code of the file general/hr/setting/… |
CVE-2024-10597 | Medium | 6.3 | 2024-10-31 | A vulnerability classified as critical has been found in ESAFENET CDG 5. This affects the function delPolicyAction of the file /com/esafenet/servlet/system/Pol… |
CVE-2024-10596 | Medium | 6.3 | 2024-10-31 | A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. Affected by this issue is the function delEntryptPolicySort of the file /com/esafen… |
CVE-2024-10595 | Medium | 6.3 | 2024-10-31 | A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. Affected by this vulnerability is the function delFile/delDifferCourseList of th… |
CVE-2024-10594 | Medium | 6.3 | 2024-10-31 | A vulnerability was found in ESAFENET CDG 5. It has been classified as critical. Affected is the function docHistory of the file /com/esafenet/servlet/fileMana… |
CVE-2024-48360 | High | 7.5 | 2024-10-31 | Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php. |
CVE-2024-48359 | Critical | 9.8 | 2024-10-31 | Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter. |
CVE-2024-39722 | High | 7.5 | 2024-10-31 | An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in the api/push route. |
CVE-2024-39721 | High | 7.5 | 2024-10-31 | An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path parameter is user-c… |
CVE-2024-39720 | High | 8.2 | 2024-10-31 | An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with th… |
CVE-2024-39719 | High | 7.5 | 2024-10-31 | An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter… |
CVE-2024-51066 | High | 7.5 | 2024-10-31 | An Insecure Direct Object Reference (IDOR) vulnerability in appointment-detail.php in Phpgurukul's Beauty Parlour Management System v1.1 allows unauthorized ac… |
CVE-2024-51065 | Critical | 9.8 | 2024-10-31 | Phpgurukul Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in admin/index.php via the the username parameter. |
CVE-2024-51064 | Critical | 9.8 | 2024-10-31 | Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection via the tid parameter to admin/queries.php. |
CVE-2024-51063 | Critical | 9.1 | 2024-10-31 | Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection in add-teacher.php via the mobile number or email parameter. |
CVE-2024-51060 | Critical | 9.1 | 2024-10-31 | Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter. |
CVE-2024-50802 | Medium | 6.0 | 2024-10-31 | A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function in public_html/admin/controller/responses/listing_grid/email_template… |
CVE-2024-50801 | Medium | 6.0 | 2024-10-31 | A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function in public_html/admin/controller/responses/listing_grid/collections.ph… |
CVE-2024-48200 | High | 8.4 | 2024-10-31 | An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXterm MSI is spawning… |
CVE-2024-42515 | Critical | 9.9 | 2024-10-31 | Glossarizer through 1.5.2 improperly tries to convert text into HTML. Even though the application itself escapes special characters (e.g., <>), the underlying… |
CVE-2024-39332 | Critical | 9.8 | 2024-10-31 | Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execution via modificati… |
CVE-2024-10573 | Medium | 6.7 | 2024-10-31 | An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer… |
CVE-2024-51482 | Critical | 9.9 | 2024-10-31 | ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in… |
CVE-2024-50356 | Unrated | | 2024-10-31 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). The password could be r… |
CVE-2024-50347 | | 2024-10-31 | Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures f… | |
CVE-2024-7883 | Low | 3.7 | 2024-10-31 | When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non… |
CVE-2024-51481 | | 2024-10-31 | Nix is a package manager for Linux and other Unix systems. On macOS, built-in builders (such as `builtin:fetchurl`, exposed to users with `import <nix/fetchurl… | |
CVE-2024-51478 | Critical | 9.9 | 2024-10-31 | YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows… |
CVE-2024-51430 | Medium | 6.4 | 2024-10-31 | Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test N… |
CVE-2024-8185 | High | 7.5 | 2024-10-31 | Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through mem… |
CVE-2024-51260 | Critical | 9.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process functi… |
CVE-2024-51255 | Critical | 9.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificat… |
CVE-2024-50354 | Medium | 5.5 | 2024-10-31 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys all… |
CVE-2024-8553 | Medium | 6.3 | 2024-10-31 | A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view an… |
CVE-2024-48910 | Critical | 9.1 | 2024-10-31 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability… |
CVE-2024-51259 | Critical | 9.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate… |
CVE-2024-51254 | High | 8.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate… |
CVE-2024-42835 | Critical | 9.8 | 2024-10-31 | langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component. |
CVE-2024-8934 | Medium | 6.5 | 2024-10-31 | A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which t… |
CVE-2024-10454 | Medium | 6.1 | 2024-10-31 | Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the absence of an X-Fra… |
CVE-2024-49685 | Medium | 5.4 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Custom Twitter Feeds (Tweets Widget) custom-twitter-feeds allows Cross Site Request Forgery.This… |
CVE-2024-49674 | Critical | 9.6 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a Web Shell to a Web Server.This issu… |
CVE-2024-43984 | Critical | 9.6 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher allows Code Injection.This issue affects Podlove Podcast Publisher: from n… |
CVE-2024-43933 | Medium | 4.3 | 2024-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja allows Stored XSS.This iss… |
CVE-2024-43930 | Medium | 4.3 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in eyecix JobSearch allows Cross Site Request Forgery.This issue affects JobSearch: from n/a through 2.5.3. |
CVE-2024-43383 | High | 8.0 | 2024-10-31 | Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta000… |
CVE-2024-30149 | Medium | 4.8 | 2024-10-31 | HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable. |
CVE-2024-9446 | Medium | 6.4 | 2024-10-31 | The WP Simple Anchors Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpanchor shortcode in all versions up to, and in… |
CVE-2024-9434 | Medium | 6.1 | 2024-10-31 | The WPGlobus Translate Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to mis… |
CVE-2024-9430 | Medium | 5.3 | 2024-10-31 | The Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress is vulnerable to unauthorized access of Quote data due to a missing capabi… |
CVE-2024-9165 | Medium | 6.4 | 2024-10-31 | The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in a… |
CVE-2024-9700 | Medium | 5.3 | 2024-10-31 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2024-10392 | Critical | 9.8 | 2024-10-31 | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_image_upload' fu… |
CVE-2024-21537 | High | 8.8 | 2024-10-31 | Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport… |
CVE-2024-9708 | Medium | 6.4 | 2024-10-31 | The Easy SVG Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due to ins… |
CVE-2024-48311 | High | 8.8 | 2024-10-31 | Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function. |