2024 CVEs (page 128)
Page 128 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51568 | Critical | 10.0 | 2024-10-29 | CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upl… |
CVE-2024-51567 | Critical | 10.0 | 2024-10-29 | upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary… |
CVE-2024-51378 | Critical | 10.0 | 2024-10-29 | getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arb… |
CVE-2024-50348 | Medium | 5.4 | 2024-10-29 | InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due… |
CVE-2024-9997 | High | 7.8 | 2024-10-29 | A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage t… |
CVE-2024-9996 | High | 7.8 | 2024-10-29 | A maliciously crafted DWG file, when parsed in acdb25.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may lever… |
CVE-2024-9827 | High | 7.8 | 2024-10-29 | A maliciously crafted CATPART file when parsed in CC5Dll.dll through Autodesk AutoCAD can force an Out-of-Bounds Read vulnerability. A malicious actor can lev… |
CVE-2024-9826 | High | 7.8 | 2024-10-29 | A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage thi… |
CVE-2024-9489 | High | 7.8 | 2024-10-29 | A maliciously crafted DWG file when parsed in ACAD.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage thi… |
CVE-2024-8896 | High | 7.8 | 2024-10-29 | A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A malicious actor can… |
CVE-2024-8600 | High | 7.8 | 2024-10-29 | A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can lev… |
CVE-2024-8599 | High | 7.8 | 2024-10-29 | A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can lev… |
CVE-2024-8598 | High | 7.8 | 2024-10-29 | A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can lev… |
CVE-2024-8597 | High | 7.8 | 2024-10-29 | A maliciously crafted STP file when parsed in ASMDATAX230A.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leve… |
CVE-2024-8596 | High | 7.8 | 2024-10-29 | A maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may… |
CVE-2024-8595 | High | 7.8 | 2024-10-29 | A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage… |
CVE-2024-8594 | High | 7.8 | 2024-10-29 | A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Heap-Based Overflow vulnerability. A malicious actor can lev… |
CVE-2024-8593 | High | 7.8 | 2024-10-29 | A maliciously crafted CATPART file, when parsed in ASMKERN230A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor… |
CVE-2024-8592 | High | 7.8 | 2024-10-29 | A maliciously crafted CATPART file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor ca… |
CVE-2024-8591 | High | 7.8 | 2024-10-29 | A maliciously crafted 3DM file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Heap-Based Buffer Overflow vulnerability. A malicious act… |
CVE-2024-8590 | High | 7.8 | 2024-10-29 | A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage th… |
CVE-2024-8589 | High | 7.8 | 2024-10-29 | A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can le… |
CVE-2024-8588 | High | 7.8 | 2024-10-29 | A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can le… |
CVE-2024-7992 | High | 7.8 | 2024-10-29 | A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force a Stack-based Buffer Overflow. A malicious a… |
CVE-2024-7991 | High | 7.8 | 2024-10-29 | A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, may force an Out-of-Bounds Write vulnerability. A mali… |
CVE-2024-50454 | Medium | 5.3 | 2024-10-29 | Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2024-50428 | Medium | 4.3 | 2024-10-29 | Missing Authorization vulnerability in mondula2016 Multi Step Form multi-step-form allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2024-50425 | Medium | 6.5 | 2024-10-29 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Murg WP Booking System wp-booking-system.This issue affects… |
CVE-2024-50424 | Medium | 6.5 | 2024-10-29 | Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2024-50423 | Medium | 5.4 | 2024-10-29 | Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2024-50422 | Medium | 5.3 | 2024-10-29 | Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breez… |
CVE-2024-50421 | Medium | 5.3 | 2024-10-29 | Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrect… |
CVE-2024-48573 | Critical | 9.8 | 2024-10-29 | A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Res… |
CVE-2024-48572 | Medium | 5.3 | 2024-10-29 | A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The v… |
CVE-2024-48138 | Critical | 9.8 | 2024-10-29 | A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute… |
CVE-2024-44081 | Critical | 9.8 | 2024-10-29 | In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrar… |
CVE-2024-44080 | High | 7.5 | 2024-10-29 | In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients loading GIFs from any a… |
CVE-2024-10488 | High | 8.8 | 2024-10-29 | Use after free in WebRTC in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2024-10487 | High | 8.8 | 2024-10-29 | Out of bounds write in Dawn in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (… |
CVE-2024-10228 | Low | 3.8 | 2024-10-29 | The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing p… |
CVE-2024-8587 | High | 7.8 | 2024-10-29 | A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Heap Based Buffer Overflow vulnerability. A malicious acto… |
CVE-2024-50456 | Medium | 5.4 | 2024-10-29 | Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2024-50455 | Medium | 4.3 | 2024-10-29 | Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2024-48461 | Medium | 4.8 | 2024-10-29 | Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New Journey field. |
CVE-2024-48206 | Critical | 9.8 | 2024-10-29 | A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code. |
CVE-2024-48063 | Critical | 9.8 | 2024-10-29 | In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distribut… |
CVE-2024-48955 | High | 8.1 | 2024-10-29 | Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the return of this cal… |
CVE-2024-9990 | High | 8.8 | 2024-10-29 | The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This is due to missing nonce validation in… |
CVE-2024-9989 | Critical | 9.8 | 2024-10-29 | The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18. This is due to a limited arbitrary method call t… |
CVE-2024-9988 | Critical | 9.8 | 2024-10-29 | The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19. This is due to missing validation on the user be… |
CVE-2024-8924 | High | 7.5 | 2024-10-29 | ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user t… |
CVE-2024-50466 | Medium | 4.3 | 2024-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite – Advanced Dark Mode Plugin for WordPress darkmysite allows Cross Site Request Forgery… |
CVE-2024-50459 | Medium | 5.3 | 2024-10-29 | Missing Authorization vulnerability in Hossni Mubarak AidWP wp-stripe-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2024-10491 | Medium | 4.0 | 2024-10-29 | A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data… |
CVE-2024-8923 | Critical | 9.8 | 2024-10-29 | ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to… |
CVE-2024-7985 | High | 7.5 | 2024-10-29 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… |
CVE-2024-25566 | Medium | 6.1 | 2024-10-29 | An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to red… |
CVE-2024-10452 | Low | 2.2 | 2024-10-29 | Organization admins can delete pending invites created in an organization they are not part of. |
CVE-2024-50334 | Medium | 5.3 | 2024-10-29 | Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a sem… |
CVE-2024-49769 | High | 7.5 | 2024-10-29 | Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to cal… |
CVE-2024-49768 | Critical | 9.1 | 2024-10-29 | Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, fo… |
CVE-2024-48921 | Low | 2.7 | 2024-10-29 | Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a Polic… |
CVE-2024-9505 | Medium | 6.4 | 2024-10-29 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up… |
CVE-2024-51076 | Medium | 6.1 | 2024-10-29 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /odms/admin/booking-search.php in PHPGurukul Online DJ Booking Management System 1.0, which a… |
CVE-2024-51075 | Medium | 6.1 | 2024-10-29 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /odms/admin/user-search.php in PHPGurukul Online DJ Booking Management System v1.0, which all… |
CVE-2024-49634 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rimon Habib BP Member Type Manager bp-member-type-manager… |
CVE-2024-49632 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Senthil Vel CWD 3D Image Gallery cwd-3d-image-gallery all… |
CVE-2024-47640 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP ERP erp allows Reflected XSS.This issue affects… |
CVE-2024-10226 | Medium | 6.4 | 2024-10-29 | The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including… |
CVE-2024-8309 | Critical | 9.8 | 2024-10-29 | A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability c… |
CVE-2024-8143 | Medium | 4.3 | 2024-10-29 | In the latest version (20240628) of gaizhenbiao/chuanhuchatgpt, an issue exists in the /file endpoint that allows authenticated users to access the chat histor… |
CVE-2024-7962 | High | 7.5 | 2024-10-29 | An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. A… |
CVE-2024-7807 | High | 7.5 | 2024-10-29 | A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240628 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a lar… |
CVE-2024-7783 | High | 7.5 | 2024-10-29 | mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSO… |
CVE-2024-7774 | Critical | 9.1 | 2024-10-29 | A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files… |
CVE-2024-7475 | Critical | 9.1 | 2024-10-29 | An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without authorization. This vuln… |
CVE-2024-7474 | High | 8.1 | 2024-10-29 | In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external users by manipulating… |
CVE-2024-7473 | Medium | 6.5 | 2024-10-29 | An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2. This vulnerability allows an aut… |
CVE-2024-7472 | Medium | 6.5 | 2024-10-29 | lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/sign… |
CVE-2024-7042 | Critical | 9.8 | 2024-10-29 | A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leadin… |
CVE-2024-7010 | Medium | 5.9 | 2024-10-29 | mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing… |
CVE-2024-6868 | Critical | 9.8 | 2024-10-29 | mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify addit… |
CVE-2024-6674 | High | 7.1 | 2024-10-29 | A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settin… |
CVE-2024-6673 | Medium | 6.5 | 2024-10-29 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the `install_comfyui` endpoint of the `lollms_comfyui.py` file in the parisneo/lollms-webui reposit… |
CVE-2024-6581 | Critical | 9.0 | 2024-10-29 | A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filte… |
CVE-2024-5982 | Critical | 9.8 | 2024-10-29 | A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability arises from unsanitized input handling in multiple… |
CVE-2024-5823 | Critical | 9.1 | 2024-10-29 | A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to… |
CVE-2024-51181 | Medium | 6.1 | 2024-10-29 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/admin/profile.php in PHPGurukul IFSC Code Finder Project v1.0, which allows remot… |
CVE-2024-51180 | Medium | 6.1 | 2024-10-29 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/index.php in PHPGurukul IFSC Code Finder Project v1.0, which allows remote attack… |
CVE-2024-49645 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ilias Gomatos Affiliate Platform smdp-affiliate-platform… |
CVE-2024-49643 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifthsegment Whitelist fifthsegment-whitelist allows Refl… |
CVE-2024-49641 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tidaweb Tida URL Screenshot tida-url-screenshot allows Re… |
CVE-2024-49640 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AmaderCode Lab ACL Floating Cart for WooCommerce acl-floa… |
CVE-2024-49639 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Stoever Monitor.chat monitor-chat allows Reflected… |
CVE-2024-49638 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ventureharbour Risk Warning Bar risk-warning-bar allows R… |
CVE-2024-49637 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foxskav Bet WC 2018 Russia bet-wc-2018-russia allows Refl… |
CVE-2024-49636 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woracal Agile Video Player Lite agile-video-player allows… |
CVE-2024-49635 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manjurul.cis Banner Slider banner-slider allows Reflected… |
CVE-2024-41156 | Low | 2.7 | 2024-10-29 | Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers valuable configuratio… |
CVE-2024-41153 | High | 7.2 | 2024-10-29 | Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited… |