2024 CVEs (page 133)
Page 133 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8036 | Medium | 5.9 | 2024-10-25 | ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exploit these vulnerabilities by sending a… |
CVE-2024-48743 | Medium | 6.5 | 2024-10-25 | Cross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parameter. |
CVE-2024-48655 | High | 8.8 | 2024-10-25 | An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file. |
CVE-2024-48654 | Medium | 6.1 | 2024-10-25 | Cross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted script to the login.php component. |
CVE-2024-48459 | High | 7.3 | 2024-10-25 | A command execution vulnerability exists in the AX2 Pro home router produced by Shenzhen Tenda Technology Co., Ltd. (Jixiang Tenda) v.DI_7003G-19.12.24A1V16.03… |
CVE-2024-10387 | High | 7.5 | 2024-10-25 | CVE-2024-10387 IMPACT A Denial-of-Service vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to… |
CVE-2024-10386 | Critical | 9.8 | 2024-10-25 | CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to se… |
CVE-2024-48581 | Critical | 9.8 | 2024-10-25 | File Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the admin_class.php component. |
CVE-2024-48580 | Critical | 9.8 | 2024-10-25 | SQL Injection vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the email parameter of the lo… |
CVE-2024-48579 | Critical | 9.8 | 2024-10-25 | SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to execute arbitrary code via the username par… |
CVE-2024-48204 | Critical | 9.8 | 2024-10-25 | SQL injection vulnerability in Hanzhou Haobo network management system 1.0 allows a remote attacker to execute arbitrary code via a crafted script. |
CVE-2024-49757 | High | 7.5 | 2024-10-25 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versio… |
CVE-2024-48428 | Critical | 9.8 | 2024-10-25 | An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function. |
CVE-2024-49753 | Medium | 5.9 | 2024-10-25 | Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL va… |
CVE-2024-49381 | High | 7.5 | 2024-10-25 | Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitra… |
CVE-2024-49380 | High | 7.5 | 2024-10-25 | Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary… |
CVE-2024-9991 | | 2024-10-25 | This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical a… | |
CVE-2024-49378 | Medium | 6.1 | 2024-10-25 | smartUp, a web browser mouse gestures extension, has a universal cross-site scripting issue in the Edge and Firefox versions of smartUp 7.2.622.1170. The vulne… |
CVE-2024-49376 | High | 8.8 | 2024-10-25 | Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email… |
CVE-2024-10381 | Critical | 9.8 | 2024-10-25 | This vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management at the web-based management interface… |
CVE-2024-10380 | Medium | 6.3 | 2024-10-25 | A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. Affected by this issue is some unknown… |
CVE-2024-10379 | Medium | 4.3 | 2024-10-25 | A vulnerability classified as problematic was found in ESAFENET CDG 5. Affected by this vulnerability is the function actionViewDecyptFile of the file /com/esa… |
CVE-2024-10378 | Medium | 6.3 | 2024-10-25 | A vulnerability classified as critical has been found in ESAFENET CDG 5. Affected is the function actionViewCDGRenewFile of the file /com/esafenet/servlet/clie… |
CVE-2024-10374 | Medium | 6.4 | 2024-10-25 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_loginout shortcode in all versions up… |
CVE-2024-47483 | Low | 2.9 | 2024-10-25 | Dell Data Lakehouse, version(s) 1.0.0.0 and 1.1.0.0, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnera… |
CVE-2024-47481 | Medium | 6.5 | 2024-10-25 | Dell Data Lakehouse, version(s) 1.0.0.0, 1.1.0., contain(s) an Improper Access Control vulnerability. An unauthenticated attacker with adjacent network access… |
CVE-2024-47041 | High | 7.8 | 2024-10-25 | In valid_address of syscall.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with n… |
CVE-2024-47035 | High | 7.8 | 2024-10-25 | In vring_init of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to a logic error in the code. This could lead to lo… |
CVE-2024-47034 | Medium | 5.5 | 2024-10-25 | there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges n… |
CVE-2024-47033 | High | 7.8 | 2024-10-25 | In lwis_allocator_free of lwis_allocator.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege wit… |
CVE-2024-47031 | High | 7.4 | 2024-10-25 | Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-329163861. |
CVE-2024-47030 | Medium | 5.1 | 2024-10-25 | Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-315191818. |
CVE-2024-47029 | Medium | 5.5 | 2024-10-25 | In TrustySharedMemoryManager::GetSharedMemory of ondevice/trusty/trusty_shared_memory_manager.cc, there is a possible out of bounds read due to an incorrect bo… |
CVE-2024-47028 | Medium | 4.4 | 2024-10-25 | In ffu_flash_pack of ffu.c, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System exec… |
CVE-2024-47027 | High | 7.8 | 2024-10-25 | In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory access due to improper input validation. This could lead to… |
CVE-2024-47026 | Medium | 5.5 | 2024-10-25 | In gsc_gsa_rescue of gsc_gsa.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with n… |
CVE-2024-47025 | Medium | 5.5 | 2024-10-25 | In ppmp_protect_buf of drm_fw.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure w… |
CVE-2024-47024 | High | 7.8 | 2024-10-25 | In vring_size of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to an integer overflow. This could lead to local es… |
CVE-2024-47023 | High | 8.1 | 2024-10-25 | there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution p… |
CVE-2024-47022 | High | 7.5 | 2024-10-25 | Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-331255656. |
CVE-2024-47021 | High | 7.5 | 2024-10-25 | In sms_ExtractCbLanguage of sms_CellBroadcast.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information di… |
CVE-2024-47020 | High | 7.5 | 2024-10-25 | Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ABL component, A-331966488. |
CVE-2024-47019 | Medium | 5.5 | 2024-10-25 | In ProtocolEmbmsSaiListAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to lo… |
CVE-2024-47018 | Medium | 5.5 | 2024-10-25 | In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclo… |
CVE-2024-47017 | High | 7.8 | 2024-10-25 | In ufshc_scsi_cmd of ufs.c, there is a possible stack variable use after free due to a use after free. This could lead to local escalation of privilege with no… |
CVE-2024-47016 | High | 7.8 | 2024-10-25 | there is a possible privilege escalation due to an insecure default value. This could lead to local escalation of privilege with no additional execution privil… |
CVE-2024-47015 | Medium | 5.5 | 2024-10-25 | In ProtocolMiscHwConfigChangeAdapter::GetData() of protocolmiscadapter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could le… |
CVE-2024-47014 | High | 8.8 | 2024-10-25 | Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292. |
CVE-2024-47013 | High | 7.8 | 2024-10-25 | In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible arbitrary write due to uninitialized data. This could lead to local escalation of privil… |
CVE-2024-47012 | High | 7.8 | 2024-10-25 | In mm_GetMobileIdIndexForNsUpdate of mm_GmmPduCodec.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escal… |
CVE-2024-44101 | High | 7.5 | 2024-10-25 | there is a possible Null Pointer Dereference (modem crash) due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2024-44100 | High | 7.5 | 2024-10-25 | Android before 2024-10-05 on Google Pixel devices allows information disclosure in the modem component, A-299774545. |
CVE-2024-44099 | Medium | 5.5 | 2024-10-25 | There is a possible Local bypass of user interaction due to an insecure default value. This could lead to local information disclosure with no additional execu… |
CVE-2024-44098 | High | 7.4 | 2024-10-25 | In lwis_device_event_states_clear_locked of lwis_event.c, there is a possible privilege escalation due to a double free. This could lead to local escalation of… |
CVE-2024-10377 | Medium | 6.3 | 2024-10-25 | A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. This issue affects the function actionPassDecryptApplication1 of the file /com/esaf… |
CVE-2024-10376 | Medium | 6.3 | 2024-10-25 | A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. This vulnerability affects the function actionPassOrNotAutoSign of the file /com… |
CVE-2024-8666 | Medium | 6.4 | 2024-10-25 | The Shoutcast Icecast HTML5 Radio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'html5radio' shortcode in all versi… |
CVE-2024-10343 | Medium | 6.4 | 2024-10-25 | The Beek Widget Extention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 0.9.5 due to insuf… |
CVE-2024-10112 | Medium | 6.4 | 2024-10-25 | The Simple News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'news' shortcode in all versions up to, and including, 2.8 d… |
CVE-2024-10016 | Medium | 6.4 | 2024-10-25 | The File Upload Types by WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1… |
CVE-2024-9630 | Medium | 5.4 | 2024-10-25 | The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, a… |
CVE-2024-9628 | Medium | 6.3 | 2024-10-25 | The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Wps_Te… |
CVE-2024-9598 | High | 8.8 | 2024-10-25 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This… |
CVE-2024-47158 | Medium | 5.4 | 2024-10-25 | N-LINE 2.0.6 and prior versions contain a code injection vulnerability. If this vulnerability is exploited, arbitrary code may be executed on the instructor's… |
CVE-2024-45785 | High | 7.5 | 2024-10-25 | MUSASI version 3 contains an issue with use of client-side authentication. If this vulnerability is exploited, other users' credential and sensitive informatio… |
CVE-2024-10342 | Medium | 6.4 | 2024-10-25 | The League of Legends Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.0.1 due t… |
CVE-2024-10341 | Medium | 6.5 | 2024-10-25 | The League of Legends Shortcodes plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.1 due to… |
CVE-2024-10150 | Medium | 6.4 | 2024-10-25 | The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs shortcode in all versions up to, and incl… |
CVE-2024-9607 | Medium | 6.1 | 2024-10-25 | The 10Web Social Post Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on… |
CVE-2024-9302 | High | 8.1 | 2024-10-25 | The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all version… |
CVE-2024-9235 | High | 8.8 | 2024-10-25 | The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to an insufficient capabi… |
CVE-2024-50583 | Medium | 6.3 | 2024-10-25 | Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to improper permission settings. |
CVE-2024-48870 | Medium | 6.2 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input… |
CVE-2024-47801 | High | 7.4 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a craf… |
CVE-2024-47549 | High | 7.4 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Ac… |
CVE-2024-47406 | Critical | 9.1 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability. |
CVE-2024-47005 | High | 8.1 | 2024-10-25 | Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A n… |
CVE-2024-45842 | Medium | 5.3 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internal files may be retr… |
CVE-2024-45829 | Medium | 4.9 | 2024-10-25 | Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-b… |
CVE-2024-43424 | High | 7.5 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected… |
CVE-2024-42420 | High | 7.5 | 2024-10-25 | Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of S… |
CVE-2024-10148 | Medium | 6.4 | 2024-10-25 | The Awesome buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn2 shortcode in all versions up to, and including, 1.0… |
CVE-2024-10011 | High | 8.1 | 2024-10-25 | The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possi… |
CVE-2024-9488 | Critical | 9.8 | 2024-10-25 | The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is due to insufficient v… |
CVE-2024-9109 | Medium | 4.3 | 2024-10-25 | The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2024-9686 | Medium | 5.3 | 2024-10-25 | The Order Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nktgnfw_s… |
CVE-2024-10372 | Medium | 4.5 | 2024-10-25 | A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function download_model of the file buzz/model_… |
CVE-2024-10371 | Medium | 6.3 | 2024-10-25 | A vulnerability classified as critical has been found in SourceCodester Payroll Management System 1.0. This affects the function login of the file main. The ma… |
CVE-2024-10370 | High | 7.3 | 2024-10-25 | A vulnerability was found in Codezips Sales Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-10369 | High | 7.3 | 2024-10-25 | A vulnerability was found in Codezips Sales Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2024-10368 | High | 7.3 | 2024-10-25 | A vulnerability was found in Codezips Sales Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /addstock.ph… |
CVE-2024-10355 | Medium | 4.7 | 2024-10-25 | A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. Affected by this issue is some unknown… |
CVE-2024-10354 | Medium | 4.7 | 2024-10-25 | A vulnerability classified as critical was found in SourceCodester Petrol Pump Management Software 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2024-10353 | Medium | 6.3 | 2024-10-25 | A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file /admin-dashboard. T… |
CVE-2024-10351 | High | 8.8 | 2024-10-25 | A vulnerability was found in Tenda RX9 Pro 22.03.02.20. It has been rated as critical. This issue affects the function sub_424CE0 of the file /goform/setMacFil… |
CVE-2024-10350 | Medium | 4.7 | 2024-10-24 | A vulnerability was found in code-projects Hospital Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-49762 | Medium | 4.6 | 2024-10-24 | Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their cu… |
CVE-2024-49760 | High | 7.1 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of t… |
CVE-2024-49750 | Medium | 5.5 | 2024-10-24 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2024-49359 | High | 7.5 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http… |