2024 CVEs (page 146)
Page 146 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21211 | Low | 3.7 | 2024-10-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported vers… |
CVE-2024-21210 | Low | 3.7 | 2024-10-15 | Vulnerability in Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4 and… |
CVE-2024-21209 | Low | 2.0 | 2024-10-15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.4.2 and prior and 9.0.1… |
CVE-2024-21208 | Low | 3.7 | 2024-10-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported ve… |
CVE-2024-21207 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38 and prior, 8.4.1 and prior and… |
CVE-2024-21206 | Medium | 4.3 | 2024-10-15 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affec… |
CVE-2024-21205 | Medium | 6.5 | 2024-10-15 | Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). The supported version that is affected is 12… |
CVE-2024-21204 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.4.0 and 9.0.1 and prior. Easily… |
CVE-2024-21203 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior… |
CVE-2024-21202 | Medium | 6.1 | 2024-10-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2024-21201 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and… |
CVE-2024-21200 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior. Easily ex… |
CVE-2024-21199 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and… |
CVE-2024-21198 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior… |
CVE-2024-21197 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.39 and prior… |
CVE-2024-21196 | Medium | 6.5 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and… |
CVE-2024-21195 | High | 7.6 | 2024-10-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Layout Templates). Supported versions that are affected are 7.0.0.0.0, 7.6.0… |
CVE-2024-21194 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and… |
CVE-2024-21193 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior… |
CVE-2024-21192 | Medium | 4.4 | 2024-10-15 | Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Fusion Middleware (component: WebLogic Mgmt). The supported version th… |
CVE-2024-21191 | High | 7.6 | 2024-10-15 | Vulnerability in the Oracle Enterprise Manager Fusion Middleware Control product of Oracle Fusion Middleware (component: FMW Control Plugin). The supported v… |
CVE-2024-21190 | High | 7.5 | 2024-10-15 | Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). The supported version that is… |
CVE-2024-21172 | Critical | 9.0 | 2024-10-15 | Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected ar… |
CVE-2024-41344 | High | 7.5 | 2024-10-15 | A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges. |
CVE-2024-35584 | High | 8.8 | 2024-10-15 | SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition… |
CVE-2024-5749 | High | 7.5 | 2024-10-15 | Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials. |
CVE-2024-48915 | | 2024-10-15 | Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/cer… | |
CVE-2024-9676 | Medium | 6.5 | 2024-10-15 | A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI… |
CVE-2024-9506 | Low | 3.7 | 2024-10-15 | Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability. |
CVE-2024-48914 | Critical | 9.1 | 2024-10-15 | Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to… |
CVE-2024-48913 | Medium | 5.9 | 2024-10-15 | Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header… |
CVE-2024-48624 | Medium | 5.3 | 2024-10-15 | In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS) vulner… |
CVE-2024-48623 | Medium | 5.3 | 2024-10-15 | In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in the GET request can be exploited to cause a reflected Cross Site Scripti… |
CVE-2024-48622 | Medium | 6.6 | 2024-10-15 | A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit.php and the cdfid… |
CVE-2024-47876 | High | 8.8 | 2024-10-15 | Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a… |
CVE-2024-47874 | | 2024-10-15 | Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a… | |
CVE-2024-47824 | | 2024-10-15 | matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 and before 3.102.0… | |
CVE-2024-47779 | | 2024-10-15 | Element is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which can, under speciall… | |
CVE-2024-47771 | | 2024-10-15 | Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially c… | |
CVE-2024-47080 | | 2024-10-15 | matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient… | |
CVE-2024-9979 | Medium | 5.3 | 2024-10-15 | A flaw was found in PyO3. This vulnerability causes a use-after-free issue, potentially leading to memory corruption or crashes via unsound borrowing from weak… |
CVE-2024-48948 | Medium | 4.8 | 2024-10-15 | The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading… |
CVE-2024-9986 | High | 7.3 | 2024-10-15 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2024-9977 | Medium | 4.7 | 2024-10-15 | A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26. Affected is an unknown function of the file /cgi… |
CVE-2024-48283 | Critical | 9.8 | 2024-10-15 | Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to SQL Injection in /admin//search-result.php via the searchkey parameter. |
CVE-2024-48282 | High | 7.6 | 2024-10-15 | A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote a… |
CVE-2024-48280 | High | 7.6 | 2024-10-15 | A SQL Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attac… |
CVE-2024-48279 | High | 7.6 | 2024-10-15 | A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allow… |
CVE-2024-48278 | Medium | 5.5 | 2024-10-15 | Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to Cross Site Request Forgery (CSRF) via /edit-profile.php. |
CVE-2024-9976 | Medium | 6.3 | 2024-10-15 | A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the file /php/manage_cus… |
CVE-2024-9975 | Medium | 6.3 | 2024-10-15 | A vulnerability was found in SourceCodester Drag and Drop Image Upload 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-49388 | Critical | 9.1 | 2024-10-15 | Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 3… |
CVE-2024-49387 | High | 7.5 | 2024-10-15 | Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) befor… |
CVE-2024-49384 | Medium | 4.3 | 2024-10-15 | Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16… |
CVE-2024-49383 | Medium | 4.3 | 2024-10-15 | Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (… |
CVE-2024-49382 | Medium | 4.3 | 2024-10-15 | Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16… |
CVE-2024-47674 | High | 7.8 | 2024-10-15 | In the Linux kernel, the following vulnerability has been resolved: mm: avoid leaving partial pfn mappings around in error case As Jann points out, PFN mappi… |
CVE-2024-45276 | High | 7.5 | 2024-10-15 | An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication. |
CVE-2024-45275 | Critical | 9.8 | 2024-10-15 | The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected device… |
CVE-2024-45274 | Critical | 9.8 | 2024-10-15 | An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication. |
CVE-2024-45273 | High | 8.4 | 2024-10-15 | An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. |
CVE-2024-45272 | High | 7.5 | 2024-10-15 | An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in… |
CVE-2024-45271 | High | 8.4 | 2024-10-15 | An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation. |
CVE-2024-9974 | Medium | 6.3 | 2024-10-15 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-9973 | Medium | 6.3 | 2024-10-15 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?pa… |
CVE-2024-47945 | Critical | 9.8 | 2024-10-15 | The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with onl… |
CVE-2024-9985 | Critical | 10.0 | 2024-10-15 | Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it t… |
CVE-2024-9984 | Critical | 9.8 | 2024-10-15 | Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionalit… |
CVE-2024-9983 | High | 7.5 | 2024-10-15 | Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerabil… |
CVE-2024-9925 | Critical | 9.8 | 2024-10-15 | SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all data… |
CVE-2024-9895 | Medium | 6.4 | 2024-10-15 | The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's moo_receipt_link shortcode in all versions… |
CVE-2024-47944 | Medium | 6.8 | 2024-10-15 | The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthentic… |
CVE-2024-47943 | Critical | 9.8 | 2024-10-15 | The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed be… |
CVE-2024-9982 | Critical | 9.8 | 2024-10-15 | AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticate… |
CVE-2024-9981 | High | 8.8 | 2024-10-15 | The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upload a malicious PHP… |
CVE-2024-9980 | High | 8.8 | 2024-10-15 | The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to inject arbitrary SQL c… |
CVE-2024-9837 | High | 7.3 | 2024-10-15 | The The AADMY – Add Auto Date Month Year Into Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2… |
CVE-2024-9972 | Critical | 9.8 | 2024-10-15 | Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read… |
CVE-2024-46898 | High | 7.5 | 2024-10-15 | SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitra… |
CVE-2024-9944 | Medium | 5.3 | 2024-10-15 | The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutra… |
CVE-2024-0129 | Medium | 6.3 | 2024-10-15 | NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exp… |
CVE-2024-21535 | Medium | 6.1 | 2024-10-15 | Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An a… |
CVE-2024-9971 | High | 8.8 | 2024-10-15 | The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileg… |
CVE-2024-9970 | High | 8.8 | 2024-10-15 | The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to… |
CVE-2024-9969 | Medium | 5.4 | 2024-10-15 | NewType WebEIP v3.0 does not properly validate user input, allowing a remote attacker with regular privileges to insert JavaScript into specific parameters, re… |
CVE-2024-9968 | High | 8.8 | 2024-10-15 | WebEIP v3.0 from NewType does not properly validate user input, allowing remote attackers with regular privilege to inject SQL commands to read, modify, and… |
CVE-2024-9952 | Low | 2.4 | 2024-10-15 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. This issue affects some unknown processing of the file /admi… |
CVE-2024-9820 | Medium | 6.5 | 2024-10-15 | The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-f… |
CVE-2024-9687 | High | 8.8 | 2024-10-15 | The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validat… |
CVE-2024-6757 | Medium | 4.3 | 2024-10-15 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and inclu… |
CVE-2024-9548 | High | 7.2 | 2024-10-15 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6… |
CVE-2024-9546 | Medium | 5.3 | 2024-10-15 | The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to t… |
CVE-2024-30117 | Low | 2.5 | 2024-10-14 | A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file under some circumstances. |
CVE-2024-9953 | Medium | 4.9 | 2024-10-14 | A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arb… |
CVE-2024-35520 | High | 8.4 | 2024-10-14 | Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter. |
CVE-2024-35519 | High | 8.4 | 2024-10-14 | Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi via the ap_mode para… |
CVE-2024-35518 | High | 8.4 | 2024-10-14 | Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie_fix2.cgi via the wan_dns1_pri parameter. |
CVE-2024-6207 | High | 7.5 | 2024-10-14 | CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send a specially crafted CIP message to the… |
CVE-2024-48911 | High | 7.8 | 2024-10-14 | OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored i… |
CVE-2024-48909 | Low | 2.0 | 2024-10-14 | SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, c… |