2024 CVEs (page 136)
Page 136 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10278 | Medium | 6.3 | 2024-10-23 | A vulnerability was found in ESAFENET CDG 5. It has been classified as critical. This affects an unknown part of the file /com/esafenet/servlet/user/ReUserOrga… |
CVE-2024-10289 | Medium | 6.1 | 2024-10-23 | Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user… |
CVE-2024-10288 | Medium | 6.1 | 2024-10-23 | Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user… |
CVE-2024-10287 | Medium | 6.1 | 2024-10-23 | Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user… |
CVE-2024-10286 | Medium | 6.1 | 2024-10-23 | Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user… |
CVE-2024-10277 | Medium | 6.3 | 2024-10-23 | A vulnerability was found in ESAFENET CDG 5 and classified as critical. Affected by this issue is some unknown functionality of the file /com/esafenet/servlet/… |
CVE-2024-8500 | Medium | 5.4 | 2024-10-23 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up… |
CVE-2024-10276 | Low | 3.5 | 2024-10-23 | A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-9530 | Medium | 4.3 | 2024-10-23 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templa… |
CVE-2024-43924 | Medium | 5.3 | 2024-10-23 | Missing Authorization vulnerability in dFactory Responsive Lightbox allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Responsi… |
CVE-2024-10045 | Medium | 4.3 | 2024-10-23 | The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or… |
CVE-2024-9947 | High | 8.1 | 2024-10-23 | The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient veri… |
CVE-2024-9583 | Medium | 4.3 | 2024-10-23 | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functionality due to a mi… |
CVE-2024-9829 | Medium | 6.5 | 2024-10-23 | The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwap_handle_download_user' an… |
CVE-2024-50066 | High | 7.8 | 2024-10-23 | In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix move_normal_pmd/retract_page_tables race In mremap(), move_page_tables() l… |
CVE-2024-9927 | High | 7.2 | 2024-10-23 | The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and including 2.0.5. This is… |
CVE-2024-31880 | Medium | 5.3 | 2024-10-23 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service, under specific configurations, as… |
CVE-2024-7587 | High | 7.8 | 2024-10-22 | Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, M… |
CVE-2024-48657 | High | 7.2 | 2024-10-22 | SQL Injection vulnerability in hospital management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code. |
CVE-2024-48656 | Medium | 4.8 | 2024-10-22 | Cross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code. |
CVE-2024-48652 | Medium | 4.8 | 2024-10-22 | Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field. |
CVE-2024-48644 | Medium | 5.3 | 2024-10-22 | Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote attackers to deter… |
CVE-2024-48415 | Medium | 5.0 | 2024-10-22 | itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middlename, address, con… |
CVE-2024-46483 | Critical | 9.8 | 2024-10-22 | Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap overflow with attacke… |
CVE-2024-46482 | High | 8.2 | 2024-10-22 | An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to execute arbitrary c… |
CVE-2024-44812 | Critical | 9.8 | 2024-10-22 | SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the username and password parameters in the /adm… |
CVE-2024-44331 | High | 7.5 | 2024-10-22 | Incorrect Access Control in GStreamer RTSP server 1.25.0 in gst-rtsp-server/rtsp-media.c allows remote attackers to cause a denial of service via a series of s… |
CVE-2024-43812 | High | 8.4 | 2024-10-22 | Kieback & Peter's DDC4000 series has an insufficiently protected credentials vulnerability, which may allow an unauthenticated attacker with access to /etc/pas… |
CVE-2024-43698 | Critical | 9.8 | 2024-10-22 | Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin rights on the system. |
CVE-2024-42643 | High | 7.5 | 2024-10-22 | Integer Overflow in fast_ping.c in SmartDNS Release46 allows remote attackers to cause a Denial of Service via misaligned memory access. |
CVE-2024-41717 | Critical | 9.8 | 2024-10-22 | Kieback & Peter's DDC4000 series is vulnerable to a path traversal vulnerability, which may allow an unauthenticated attacker to read files on the system. |
CVE-2024-40494 | Critical | 9.8 | 2024-10-22 | Buffer Overflow in coap_msg.c in FreeCoAP allows remote attackers to execute arbitrary code or cause a denial of service (stack buffer overflow) via a crafted… |
CVE-2024-40493 | Critical | 9.8 | 2024-10-22 | Null Pointer Dereference in `coap_client_exchange_blockwise2` function in Keith Cullen FreeCoAP 1.0 allows remote attackers to cause a denial of service and po… |
CVE-2024-31029 | High | 8.2 | 2024-10-22 | An issue in the server_handle_regular function of the test_coap_server.c file within the FreeCoAP project allows remote attackers to cause a Denial of Service… |
CVE-2024-26519 | Critical | 9.0 | 2024-10-22 | An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.c… |
CVE-2024-10231 | High | 8.8 | 2024-10-22 | Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-10230 | High | 8.8 | 2024-10-22 | Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-10229 | High | 8.1 | 2024-10-22 | Inappropriate implementation in Extensions in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to bypass site isolation via a crafted Chrome Exte… |
CVE-2024-48919 | | 2024-10-22 | Cursor is a code editor built for programming with AI. Prior to Sep 27, 2024, if a user generated a terminal command via Cursor's Terminal Cmd-K/Ctrl-K feature… | |
CVE-2024-45526 | Medium | 5.3 | 2024-10-22 | An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and ca… |
CVE-2024-48904 | Critical | 9.8 | 2024-10-22 | An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. Please note: au… |
CVE-2024-48903 | High | 7.8 | 2024-10-22 | An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affected installations. … |
CVE-2024-46903 | Medium | 6.5 | 2024-10-22 | A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive information affected install… |
CVE-2024-46902 | High | 8.4 | 2024-10-22 | A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive information affected install… |
CVE-2024-45335 | High | 8.4 | 2024-10-22 | Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted virus to allow itself t… |
CVE-2024-45334 | High | 7.8 | 2024-10-22 | Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthorized access to produ… |
CVE-2024-41183 | High | 7.8 | 2024-10-22 | Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevation of privileges. |
CVE-2024-39753 | High | 7.5 | 2024-10-22 | An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please not… |
CVE-2024-10183 | | 2024-10-22 | A vulnerability in Jamf Pro's Jamf Remote Assist tool allows a local, non-privileged user to escalate their privileges to root on MacOS systems. | |
CVE-2024-9287 | High | 7.8 | 2024-10-22 | A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, all… |
CVE-2024-9129 | | 2024-10-22 | In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan Marino | |
CVE-2024-49211 | Medium | 5.2 | 2024-10-22 | Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker co… |
CVE-2024-49210 | Medium | 5.2 | 2024-10-22 | Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could po… |
CVE-2024-49209 | Medium | 6.5 | 2024-10-22 | Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application files. A remote unpri… |
CVE-2024-49208 | Medium | 5.9 | 2024-10-22 | Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. A remote unprivile… |
CVE-2024-48708 | Medium | 5.4 | 2024-10-22 | Collabtive 3.1 is vulnerable to Cross-Site Scripting (XSS) via the name parameter in (a) file tasklist.php under action = add/edit and in (b) file admin.php un… |
CVE-2024-48707 | Medium | 5.4 | 2024-10-22 | Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under (a) action=add or action=edit within managemilestone.php file and (b) a… |
CVE-2024-48706 | Medium | 5.4 | 2024-10-22 | Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the title parameter with action=add or action=editform within the (a) managemessage.php file and… |
CVE-2024-48570 | High | 7.5 | 2024-10-22 | Client Management System 1.0 was discovered to contain a SQL injection vulnerability via the Between Dates Reports parameter at /admin/bwdates-reports-ds.php. |
CVE-2024-46538 | Medium | 4.8 | 2024-10-22 | A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-45518 | High | 8.8 | 2024-10-22 | An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows… |
CVE-2024-49373 | Medium | 4.1 | 2024-10-22 | No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user can view projects wit… |
CVE-2024-48929 | Medium | 4.2 | 2024-10-22 | Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8… |
CVE-2024-48927 | Medium | 4.6 | 2024-10-22 | Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to… |
CVE-2024-48926 | Medium | 4.2 | 2024-10-22 | Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10… |
CVE-2024-48925 | Unrated | | 2024-10-22 | Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. Th… |
CVE-2024-48605 | High | 7.8 | 2024-10-22 | An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper validation of the wow64log.dll file. |
CVE-2024-47819 | Medium | 4.2 | 2024-10-22 | Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3… |
CVE-2024-46240 | Medium | 4.8 | 2024-10-22 | Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under action=system and the company/contact parameters under action=addcust w… |
CVE-2024-8980 | Critical | 9.6 | 2024-10-22 | The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35… |
CVE-2024-43177 | Medium | 5.9 | 2024-10-22 | IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. |
CVE-2024-43173 | Low | 3.7 | 2024-10-22 | IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. |
CVE-2024-38002 | Critical | 9.0 | 2024-10-22 | The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through upda… |
CVE-2024-26273 | High | 8.8 | 2024-10-22 | Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4… |
CVE-2024-26272 | High | 8.8 | 2024-10-22 | Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4… |
CVE-2024-26271 | High | 8.8 | 2024-10-22 | Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q… |
CVE-2024-50312 | Medium | 5.3 | 2024-10-22 | A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comp… |
CVE-2024-50311 | Medium | 6.5 | 2024-10-22 | A denial of service (DoS) vulnerability was found in OpenShift. This flaw allows attackers to exploit the GraphQL batching functionality. The vulnerability ari… |
CVE-2024-10234 | Medium | 6.1 | 2024-10-22 | A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider t… |
CVE-2024-9050 | High | 7.8 | 2024-10-22 | A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from… |
CVE-2024-9231 | Medium | 6.1 | 2024-10-22 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escap… |
CVE-2024-10189 | Medium | 6.4 | 2024-10-22 | The Anchor Episodes Index (Spotify for Podcasters) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's anchor_episodes shortcode… |
CVE-2024-9987 | High | 8.8 | 2024-10-22 | A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora F… |
CVE-2024-35308 | High | 8.8 | 2024-10-22 | A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 t… |
CVE-2024-9591 | Medium | 5.5 | 2024-10-22 | The Category and Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_category_image' parameter in versions up to, and in… |
CVE-2024-9590 | Medium | 5.5 | 2024-10-22 | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image meta field value in the 'wpaft_add_meta_t… |
CVE-2024-9589 | Medium | 5.5 | 2024-10-22 | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_meta_name' parameter in the 'wpaft_option_… |
CVE-2024-9588 | Medium | 5.4 | 2024-10-22 | The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to… |
CVE-2024-9541 | Medium | 4.3 | 2024-10-22 | The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render f… |
CVE-2024-9627 | High | 8.6 | 2024-10-22 | The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'service_p… |
CVE-2024-8852 | Medium | 5.3 | 2024-10-22 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through… |
CVE-2024-10003 | Medium | 6.3 | 2024-10-22 | The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions… |
CVE-2024-10002 | High | 8.8 | 2024-10-22 | The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation… |
CVE-2024-9677 | Medium | 5.5 | 2024-10-22 | The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow… |
CVE-2024-8901 | High | 7.5 | 2024-10-22 | The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authenti… |
CVE-2024-10125 | High | 7.5 | 2024-10-22 | The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcore#validatetokensignature contains Middleware… |
CVE-2024-47224 | Medium | 6.5 | 2024-10-21 | A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attac… |
CVE-2024-41714 | High | 8.8 | 2024-10-21 | A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1… |
CVE-2024-41713 | Critical | 9.1 | 2024-10-21 | A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to c… |
CVE-2024-41712 | Medium | 6.6 | 2024-10-21 | A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack… |