2024 CVEs (page 134)
Page 134 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-48870 | Medium | 6.2 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input… |
CVE-2024-47801 | High | 7.4 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a craf… |
CVE-2024-47549 | High | 7.4 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Ac… |
CVE-2024-47406 | Critical | 9.1 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability. |
CVE-2024-47005 | High | 8.1 | 2024-10-25 | Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A n… |
CVE-2024-45842 | Medium | 5.3 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internal files may be retr… |
CVE-2024-45829 | Medium | 4.9 | 2024-10-25 | Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-b… |
CVE-2024-43424 | High | 7.5 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected… |
CVE-2024-42420 | High | 7.5 | 2024-10-25 | Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of S… |
CVE-2024-10148 | Medium | 6.4 | 2024-10-25 | The Awesome buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn2 shortcode in all versions up to, and including, 1.0… |
CVE-2024-10011 | High | 8.1 | 2024-10-25 | The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possi… |
CVE-2024-9488 | Critical | 9.8 | 2024-10-25 | The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is due to insufficient v… |
CVE-2024-9109 | Medium | 4.3 | 2024-10-25 | The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2024-9686 | Medium | 5.3 | 2024-10-25 | The Order Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nktgnfw_s… |
CVE-2024-10372 | Medium | 4.5 | 2024-10-25 | A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function download_model of the file buzz/model_… |
CVE-2024-10371 | Medium | 6.3 | 2024-10-25 | A vulnerability classified as critical has been found in SourceCodester Payroll Management System 1.0. This affects the function login of the file main. The ma… |
CVE-2024-10370 | High | 7.3 | 2024-10-25 | A vulnerability was found in Codezips Sales Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-10369 | High | 7.3 | 2024-10-25 | A vulnerability was found in Codezips Sales Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2024-10368 | High | 7.3 | 2024-10-25 | A vulnerability was found in Codezips Sales Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /addstock.ph… |
CVE-2024-10355 | Medium | 4.7 | 2024-10-25 | A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. Affected by this issue is some unknown… |
CVE-2024-10354 | Medium | 4.7 | 2024-10-25 | A vulnerability classified as critical was found in SourceCodester Petrol Pump Management Software 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2024-10353 | Medium | 6.3 | 2024-10-25 | A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file /admin-dashboard. T… |
CVE-2024-10351 | High | 8.8 | 2024-10-25 | A vulnerability was found in Tenda RX9 Pro 22.03.02.20. It has been rated as critical. This issue affects the function sub_424CE0 of the file /goform/setMacFil… |
CVE-2024-10350 | Medium | 4.7 | 2024-10-24 | A vulnerability was found in code-projects Hospital Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-49762 | Medium | 4.6 | 2024-10-24 | Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their cu… |
CVE-2024-49760 | High | 7.1 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of t… |
CVE-2024-49750 | Medium | 5.5 | 2024-10-24 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2024-49359 | High | 7.5 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http… |
CVE-2024-49358 | Medium | 5.3 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http… |
CVE-2024-49357 | High | 7.5 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in Zi… |
CVE-2024-41618 | Critical | 9.8 | 2024-10-24 | Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to SQL Injection in the `transaction_delete_group` function. The vulnerability is due to imp… |
CVE-2024-41617 | Critical | 9.8 | 2024-10-24 | Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control. The `redirect_if_not_loggedin` function in `functions_security… |
CVE-2024-10349 | Medium | 6.3 | 2024-10-24 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as critical. Affected by this issue is the function delete_t… |
CVE-2024-10348 | Low | 3.5 | 2024-10-24 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0. It has been classified as problematic. This affects an unknown part of the… |
CVE-2024-7763 | Critical | 9.8 | 2024-10-24 | In WhatsUp Gold versions released before 2024.0.0, an Authentication Bypass issue exists which allows an attacker to obtain encrypted user credentials. |
CVE-2024-48932 | Medium | 5.3 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint `http://<Server-ip>/v1… |
CVE-2024-48931 | High | 7.5 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the ZimaOS API endpoint… |
CVE-2024-48426 | Medium | 6.2 | 2024-10-24 | A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressSanitizer. The crash… |
CVE-2024-48425 | Medium | 5.5 | 2024-10-24 | A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing usi… |
CVE-2024-48424 | Medium | 5.5 | 2024-10-24 | A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the proce… |
CVE-2024-48423 | High | 7.8 | 2024-10-24 | An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library. |
CVE-2024-48208 | High | 8.6 | 2024-10-24 | pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file. |
CVE-2024-47883 | Critical | 9.1 | 2024-10-24 | The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the `java.net.URL` class to refer t… |
CVE-2024-47882 | Medium | 5.9 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the except… |
CVE-2024-47881 | High | 8.1 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `database` extension, the "… |
CVE-2024-47880 | High | 8.1 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that it reflect… |
CVE-2024-47879 | High | 7.6 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expre… |
CVE-2024-47878 | High | 8.1 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET… |
CVE-2024-45263 | High | 8.8 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of a… |
CVE-2024-45262 | High | 8.8 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the… |
CVE-2024-45261 | High | 8.0 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not t… |
CVE-2024-45260 | High | 8.0 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can in… |
CVE-2024-10327 | High | 8.1 | 2024-10-24 | A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension f… |
CVE-2024-45259 | Medium | 6.5 | 2024-10-24 | An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing t… |
CVE-2024-45242 | High | 7.8 | 2024-10-24 | EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping or Speed Test utilit… |
CVE-2024-48454 | High | 7.2 | 2024-10-24 | An issue in SourceCodester Purchase Order Management System v1.0 allows a remote attacker to execute arbitrary code via the /admin?page=user component |
CVE-2024-48427 | High | 8.8 | 2024-10-24 | A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands v… |
CVE-2024-48145 | Critical | 9.1 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and s… |
CVE-2024-48144 | Critical | 9.1 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exfiltrate all previou… |
CVE-2024-48143 | Critical | 9.1 | 2024-10-24 | A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the ordering system an… |
CVE-2024-48142 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access and exfiltrate all pr… |
CVE-2024-48141 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subsequent chat data be… |
CVE-2024-48140 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and ex… |
CVE-2024-48139 | High | 7.5 | 2024-10-24 | A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent chat data between… |
CVE-2024-47173 | Medium | 5.5 | 2024-10-24 | Aimeos is an e-commerce framework. All SaaS and marketplace setups using the Aimeos GraphQL API admin interface version from 2024.04 up to 2024.07.1 are affect… |
CVE-2024-46998 | High | 7.1 | 2024-10-24 | baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Edit Email Form Settings Feature. Version… |
CVE-2024-46996 | Medium | 6.3 | 2024-10-24 | baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Blog posts feature. Version 5.1.2 fixes t… |
CVE-2024-46995 | Medium | 6.1 | 2024-10-24 | baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in HTTP 400 Bad Request. Version 5.1.2 fixes thi… |
CVE-2024-46994 | Medium | 5.4 | 2024-10-24 | baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in Blog posts and Contents list Feature. Version… |
CVE-2024-48514 | Critical | 9.8 | 2024-10-24 | php-heic-to-jpg <= 1.0.5 is vulnerable to code injection (fixed in 1.0.6). An attacker who can upload heic images is able to execute code on the remote server… |
CVE-2024-48442 | Medium | 6.5 | 2024-10-24 | Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows attackers to access… |
CVE-2024-48441 | High | 8.8 | 2024-10-24 | Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injection vulnerability via… |
CVE-2024-48440 | High | 8.8 | 2024-10-24 | Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerabi… |
CVE-2024-46478 | Critical | 9.8 | 2024-10-24 | HTMLDOC v1.9.18 contains a buffer overflow in parse_pre function,ps-pdf.cxx:5681. |
CVE-2024-38314 | Medium | 5.9 | 2024-10-24 | IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker… |
CVE-2024-10338 | Medium | 4.7 | 2024-10-24 | A vulnerability classified as critical was found in SourceCodeHero Clothes Recommendation System 1.0. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-10337 | Medium | 4.7 | 2024-10-24 | A vulnerability classified as critical has been found in SourceCodeHero Clothes Recommendation System 1.0. Affected is an unknown function of the file /admin/h… |
CVE-2024-10313 | High | 8.0 | 2024-10-24 | iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability. When the software loads a malicious ‘ems' project template file constr… |
CVE-2024-10295 | High | 7.5 | 2024-10-24 | A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed bas… |
CVE-2024-9692 | | 2024-10-24 | VIMESA VHF/FM Transmitter Blue Plus is suffering from a Denial-of-Service (DoS) vulnerability. An unauthenticated attacker can issue an unauthorized HTTP GET r… | |
CVE-2024-48548 | Critical | 9.3 | 2024-10-24 | The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitraril… |
CVE-2024-48547 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to access sensitive information by analyzin… |
CVE-2024-48546 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access sensitive information by analyzing the co… |
CVE-2024-48545 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information by analyzing the co… |
CVE-2024-48544 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive information by analyz… |
CVE-2024-48542 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sensitive information… |
CVE-2024-48541 | High | 8.4 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive information by analyzing th… |
CVE-2024-48540 | Medium | 6.2 | 2024-10-24 | Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the APK file. |
CVE-2024-48539 | Critical | 9.8 | 2024-10-24 | Neye3C v4.5.2.0 was discovered to contain a hardcoded encryption key in the firmware update mechanism. |
CVE-2024-44206 | Critical | 9.3 | 2024-10-24 | An issue in the handling of URL protocols was addressed with improved logic. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, t… |
CVE-2024-44205 | Medium | 5.5 | 2024-10-24 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17… |
CVE-2024-44185 | Medium | 5.5 | 2024-10-24 | The issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS… |
CVE-2024-44141 | Medium | 6.8 | 2024-10-24 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. A person with physical access to an unlocked Mac may be able to gain ro… |
CVE-2024-40810 | Medium | 5.5 | 2024-10-24 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.6. An app may be able to cause a coprocessor… |
CVE-2024-10336 | High | 7.3 | 2024-10-24 | A vulnerability was found in SourceCodeHero Clothes Recommendation System 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2024-10335 | High | 7.3 | 2024-10-24 | A vulnerability was found in SourceCodester Garbage Collection Management System 1.0. It has been declared as critical. This vulnerability affects unknown code… |
CVE-2024-48538 | Critical | 9.8 | 2024-10-24 | Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information by analyzing the cod… |
CVE-2024-45031 | Medium | 6.1 | 2024-10-24 | When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payload… |
CVE-2024-49702 | Medium | 6.5 | 2024-10-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred Elementor mycred-for-elementor allows S… |
CVE-2024-49696 | Medium | 5.9 | 2024-10-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robosoft Robo Gallery robo-gallery allows Stored XSS.This… |