2024 CVEs (page 146)
Page 146 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-9506 | Low | 3.7 | 2024-10-15 | Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability. |
CVE-2024-48914 | Critical | 9.1 | 2024-10-15 | Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to… |
CVE-2024-48913 | Medium | 5.9 | 2024-10-15 | Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header… |
CVE-2024-48624 | Medium | 5.3 | 2024-10-15 | In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS) vulner… |
CVE-2024-48623 | Medium | 5.3 | 2024-10-15 | In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in the GET request can be exploited to cause a reflected Cross Site Scripti… |
CVE-2024-48622 | Medium | 6.6 | 2024-10-15 | A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit.php and the cdfid… |
CVE-2024-47876 | High | 8.8 | 2024-10-15 | Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a… |
CVE-2024-47874 | | 2024-10-15 | Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a… | |
CVE-2024-47824 | | 2024-10-15 | matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 and before 3.102.0… | |
CVE-2024-47779 | | 2024-10-15 | Element is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which can, under speciall… | |
CVE-2024-47771 | | 2024-10-15 | Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially c… | |
CVE-2024-47080 | | 2024-10-15 | matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient… | |
CVE-2024-9979 | Medium | 5.3 | 2024-10-15 | A flaw was found in PyO3. This vulnerability causes a use-after-free issue, potentially leading to memory corruption or crashes via unsound borrowing from weak… |
CVE-2024-48948 | Medium | 4.8 | 2024-10-15 | The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading… |
CVE-2024-9986 | High | 7.3 | 2024-10-15 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2024-9977 | Medium | 4.7 | 2024-10-15 | A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26. Affected is an unknown function of the file /cgi… |
CVE-2024-48283 | Critical | 9.8 | 2024-10-15 | Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to SQL Injection in /admin//search-result.php via the searchkey parameter. |
CVE-2024-48282 | High | 7.6 | 2024-10-15 | A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote a… |
CVE-2024-48280 | High | 7.6 | 2024-10-15 | A SQL Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attac… |
CVE-2024-48279 | High | 7.6 | 2024-10-15 | A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allow… |
CVE-2024-48278 | Medium | 5.5 | 2024-10-15 | Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to Cross Site Request Forgery (CSRF) via /edit-profile.php. |
CVE-2024-9976 | Medium | 6.3 | 2024-10-15 | A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the file /php/manage_cus… |
CVE-2024-9975 | Medium | 6.3 | 2024-10-15 | A vulnerability was found in SourceCodester Drag and Drop Image Upload 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-49388 | Critical | 9.1 | 2024-10-15 | Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 3… |
CVE-2024-49387 | High | 7.5 | 2024-10-15 | Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befor… |
CVE-2024-49384 | Medium | 4.3 | 2024-10-15 | Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16… |
CVE-2024-49383 | Medium | 4.3 | 2024-10-15 | Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (… |
CVE-2024-49382 | Medium | 4.3 | 2024-10-15 | Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16… |
CVE-2024-47674 | High | 7.8 | 2024-10-15 | In the Linux kernel, the following vulnerability has been resolved: mm: avoid leaving partial pfn mappings around in error case As Jann points out, PFN mappi… |
CVE-2024-45276 | High | 7.5 | 2024-10-15 | An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication. |
CVE-2024-45275 | Critical | 9.8 | 2024-10-15 | The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected device… |
CVE-2024-45274 | Critical | 9.8 | 2024-10-15 | An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication. |
CVE-2024-45273 | High | 8.4 | 2024-10-15 | An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. |
CVE-2024-45272 | High | 7.5 | 2024-10-15 | An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in… |
CVE-2024-45271 | High | 8.4 | 2024-10-15 | An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation. |
CVE-2024-9974 | Medium | 6.3 | 2024-10-15 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-9973 | Medium | 6.3 | 2024-10-15 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?pa… |
CVE-2024-47945 | Critical | 9.8 | 2024-10-15 | The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with onl… |
CVE-2024-9985 | Critical | 10.0 | 2024-10-15 | Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it t… |
CVE-2024-9984 | Critical | 9.8 | 2024-10-15 | Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionalit… |
CVE-2024-9983 | High | 7.5 | 2024-10-15 | Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerabil… |
CVE-2024-9925 | Critical | 9.8 | 2024-10-15 | SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all data… |
CVE-2024-9895 | Medium | 6.4 | 2024-10-15 | The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's moo_receipt_link shortcode in all versions… |
CVE-2024-47944 | Medium | 6.8 | 2024-10-15 | The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthentic… |
CVE-2024-47943 | Critical | 9.8 | 2024-10-15 | The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed be… |
CVE-2024-9982 | Critical | 9.8 | 2024-10-15 | AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticate… |
CVE-2024-9981 | High | 8.8 | 2024-10-15 | The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upload a malicious PHP… |
CVE-2024-9980 | High | 8.8 | 2024-10-15 | The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to inject arbitrary SQL c… |
CVE-2024-9837 | High | 7.3 | 2024-10-15 | The The AADMY – Add Auto Date Month Year Into Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2… |
CVE-2024-9972 | Critical | 9.8 | 2024-10-15 | Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read… |
CVE-2024-46898 | High | 7.5 | 2024-10-15 | SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitra… |
CVE-2024-9944 | Medium | 5.3 | 2024-10-15 | The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutra… |
CVE-2024-0129 | Medium | 6.3 | 2024-10-15 | NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exp… |
CVE-2024-21535 | Medium | 6.1 | 2024-10-15 | Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An a… |
CVE-2024-9971 | High | 8.8 | 2024-10-15 | The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileg… |
CVE-2024-9970 | High | 8.8 | 2024-10-15 | The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to… |
CVE-2024-9969 | Medium | 5.4 | 2024-10-15 | NewType WebEIP v3.0 does not properly validate user input, allowing a remote attacker with regular privileges to insert JavaScript into specific parameters, re… |
CVE-2024-9968 | High | 8.8 | 2024-10-15 | WebEIP v3.0 from NewType does not properly validate user input, allowing remote attackers with regular privilege to inject SQL commands to read, modify, and… |
CVE-2024-9952 | Low | 2.4 | 2024-10-15 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. This issue affects some unknown processing of the file /admi… |
CVE-2024-9820 | Medium | 6.5 | 2024-10-15 | The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-f… |
CVE-2024-9687 | High | 8.8 | 2024-10-15 | The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validat… |
CVE-2024-6757 | Medium | 4.3 | 2024-10-15 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and inclu… |
CVE-2024-9548 | High | 7.2 | 2024-10-15 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6… |
CVE-2024-9546 | Medium | 5.3 | 2024-10-15 | The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to t… |
CVE-2024-30117 | Low | 2.5 | 2024-10-14 | A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances. |
CVE-2024-9953 | Medium | 4.9 | 2024-10-14 | A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arb… |
CVE-2024-35520 | High | 8.4 | 2024-10-14 | Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter. |
CVE-2024-35519 | High | 8.4 | 2024-10-14 | Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi via the ap_mode para… |
CVE-2024-35518 | High | 8.4 | 2024-10-14 | Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie_fix2.cgi via the wan_dns1_pri parameter. |
CVE-2024-6207 | High | 7.5 | 2024-10-14 | CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send a specially crafted CIP message to the… |
CVE-2024-48911 | High | 7.8 | 2024-10-14 | OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored i… |
CVE-2024-48909 | Low | 2.0 | 2024-10-14 | SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, c… |
CVE-2024-48824 | High | 7.5 | 2024-10-14 | An issue in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to obtain sensitive information via… |
CVE-2024-48823 | Critical | 9.8 | 2024-10-14 | Local file inclusion in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges v… |
CVE-2024-48822 | High | 8.8 | 2024-10-14 | Privilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges v… |
CVE-2024-48821 | Medium | 6.1 | 2024-10-14 | Cross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalat… |
CVE-2024-47885 | Medium | 5.9 | 2024-10-14 | The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site… |
CVE-2024-48795 | Medium | 5.3 | 2024-10-14 | An issue in Creative Labs Pte Ltd com.creative.apps.xficonnect 2.00.02 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48793 | Medium | 5.9 | 2024-10-14 | An issue in INATRONIC com.inatronic.bmw 2.7.1 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48792 | High | 7.5 | 2024-10-14 | An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48791 | High | 7.5 | 2024-10-14 | An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-48790 | Medium | 5.3 | 2024-10-14 | An issue in ILIFE com.ilife.home.global 1.8.7 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48789 | High | 7.5 | 2024-10-14 | An issue in INATRONIC com.inatronic.drivedeck.home 2.6.23 allows a remote attacker to obtain sensitve information via the firmware update process. |
CVE-2024-47831 | Medium | 5.9 | 2024-10-14 | Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image… |
CVE-2024-47826 | Low | 3.5 | 2024-10-14 | eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tag… |
CVE-2024-47767 | Medium | 4.3 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.113, Tuleap Enterprise Edition… |
CVE-2024-47766 | Medium | 4.9 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition… |
CVE-2024-46988 | Medium | 4.8 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 1… |
CVE-2024-46980 | Medium | 4.8 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 1… |
CVE-2024-46528 | Medium | 4.3 | 2024-10-14 | An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3… |
CVE-2024-48799 | High | 7.5 | 2024-10-14 | An issue in LOREX TECHNOLOGY INC com.lorexcorp.lorexping 1.4.22 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48798 | High | 7.5 | 2024-10-14 | An issue in Hubble Connected (com.hubbleconnected.vervelife) 2.00.81 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48797 | High | 7.5 | 2024-10-14 | An issue in PCS Engineering Preston Cinema (com.prestoncinema.app) 0.2.0 allows a remote attacker to obtain sensitive information via the firmware update proce… |
CVE-2024-48796 | High | 7.5 | 2024-10-14 | An issue in EQUES com.eques.plug 1.0.1 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48168 | Critical | 9.8 | 2024-10-14 | A stack overflow vulnerability exists in the sub_402280 function of the HNAP service of D-Link DCS-960L 1.09, allowing an attacker to execute arbitrary code. |
CVE-2024-46535 | Critical | 9.8 | 2024-10-14 | Jepaas v7.2.8 was discovered to contain a SQL injection vulnerability via the orderSQL parameter at /homePortal/loadUserMsg. |
CVE-2024-45741 | Medium | 5.4 | 2024-10-14 | In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not… |
CVE-2024-45740 | Medium | 5.4 | 2024-10-14 | In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the "admin" or… |
CVE-2024-45739 | Medium | 4.9 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users… |
CVE-2024-45738 | Medium | 4.9 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure… |