2024 CVEs (page 148)
Page 148 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8912 | High | 7.5 | 2024-10-11 | An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Look… |
CVE-2024-48041 | Medium | 6.5 | 2024-10-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary enhanced-toolt… |
CVE-2024-48040 | High | 8.5 | 2024-10-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows SQL Injection.This issu… |
CVE-2024-48033 | Critical | 9.8 | 2024-10-11 | Deserialization of Untrusted Data vulnerability in baptiste.gourdin Talkback talkback-secure-linkback-protocol allows Object Injection.This issue affects Talkb… |
CVE-2024-48020 | High | 8.5 | 2024-10-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-cap… |
CVE-2024-47353 | Medium | 4.7 | 2024-10-11 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite.This issue affects Eleme… |
CVE-2024-47331 | Critical | 9.3 | 2024-10-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step all… |
CVE-2024-9539 | Medium | 4.3 | 2024-10-11 | An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata i… |
CVE-2024-46532 | Critical | 9.8 | 2024-10-11 | SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class.php component. |
CVE-2024-44807 | Medium | 5.3 | 2024-10-11 | A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. BurgerEditor and BurgerEditor Limited Edition before 2.25.1 allows remote attackers to obt… |
CVE-2024-44157 | Medium | 5.5 | 2024-10-11 | A stack buffer overflow was addressed through improved input validation. This issue is fixed in Apple TV 1.5.0.152 for Windows, iTunes 12.13.3 for Windows. Par… |
CVE-2024-9859 | High | 8.8 | 2024-10-11 | Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium s… |
CVE-2024-47877 | High | 7.5 | 2024-10-11 | Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside… |
CVE-2024-46215 | Medium | 6.5 | 2024-10-11 | A vulnerability was discovered in KM08-708H-v1.1, There is a buffer overflow in the sub_445BDC() function within the /usr/sbin/goahead program; The strcpy func… |
CVE-2024-44734 | High | 7.5 | 2024-10-11 | Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction request to the serv… |
CVE-2024-44731 | Medium | 4.7 | 2024-10-11 | Mirotalk before commit 9de226 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary code v… |
CVE-2024-44415 | Medium | 6.5 | 2024-10-11 | A vulnerability was discovered in DI_8200-16.07.26A1, There is a buffer overflow in the dbsrv_asp function; The strcpy function is executed without checking th… |
CVE-2024-44414 | High | 8.8 | 2024-10-11 | A vulnerability was discovered in FBM_292W-21.03.10V, which has been classified as critical. This issue affects the sub_4901E0 function in the msp_info.htm fil… |
CVE-2024-44413 | High | 8.8 | 2024-10-11 | A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_… |
CVE-2024-42018 | High | 7.7 | 2024-10-11 | An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved from management nod… |
CVE-2024-9046 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-8376 | High | 7.5 | 2024-10-11 | In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of… |
CVE-2024-6985 | Medium | 4.4 | 2024-10-11 | A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any f… |
CVE-2024-5474 | Medium | 5.5 | 2024-10-11 | A potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2.0.0.2 that could a… |
CVE-2024-4132 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-4131 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-4130 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-4089 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-48827 | High | 8.8 | 2024-10-11 | An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password function. |
CVE-2024-48813 | High | 8.8 | 2024-10-11 | SQL injection vulnerability in employee-management-system-php-and-mysql-free-download.html taskmatic 1.0 allows a remote attacker to execute arbitrary code via… |
CVE-2024-47509 | Medium | 6.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an… |
CVE-2024-47508 | Medium | 6.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an… |
CVE-2024-47507 | Medium | 5.8 | 2024-10-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2024-47506 | Medium | 5.9 | 2024-10-11 | A Deadlock vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to… |
CVE-2024-47505 | Medium | 6.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an… |
CVE-2024-47504 | High | 7.5 | 2024-10-11 | An Improper Validation of Specified Type of Input vulnerability in the packet forwarding engine (pfe) Juniper Networks Junos OS on SRX5000 Series allows an una… |
CVE-2024-47503 | Medium | 6.5 | 2024-10-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX4600 and SRX5000… |
CVE-2024-47502 | High | 7.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network bas… |
CVE-2024-47501 | Medium | 5.5 | 2024-10-11 | A NULL Pointer Dereference vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX304, MX with MPC10/11/LC9600, and EX9200 wit… |
CVE-2024-47499 | High | 7.5 | 2024-10-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2024-47498 | Medium | 6.5 | 2024-10-11 | An Unimplemented or Unsupported Feature in UI vulnerability in the CLI of Juniper Networks Junos OS Evolved on QFX5000 Series allows an unauthenticated, adjace… |
CVE-2024-47497 | High | 7.5 | 2024-10-11 | An Uncontrolled Resource Consumption vulnerability in the http daemon (httpd) of Juniper Networks Junos OS on SRX Series, QFX Series, MX Series and EX Series a… |
CVE-2024-47496 | Medium | 5.5 | 2024-10-11 | A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS allows a local, low-privileged attacker to cause a… |
CVE-2024-47495 | Medium | 6.7 | 2024-10-11 | An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device… |
CVE-2024-47494 | Medium | 5.9 | 2024-10-11 | A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the AgentD process of Juniper Networks Junos OS allows an attacker who is already causing… |
CVE-2024-47493 | Medium | 6.5 | 2024-10-11 | A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of the Juniper Networks Junos OS on the MX Series plat… |
CVE-2024-47491 | Medium | 5.9 | 2024-10-11 | An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a ne… |
CVE-2024-47490 | High | 8.2 | 2024-10-11 | An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved… |
CVE-2024-47489 | Medium | 5.8 | 2024-10-11 | An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of the Juniper Networks Junos OS Evolved on ACX Series devic… |
CVE-2024-46088 | Critical | 9.8 | 2024-10-11 | An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer Resource Management System v2002 to v2… |
CVE-2024-44730 | Critical | 9.1 | 2024-10-11 | Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an a… |
CVE-2024-44729 | High | 7.5 | 2024-10-11 | Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presenter privileges to a… |
CVE-2024-42640 | Critical | 9.8 | 2024-10-11 | angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an atta… |
CVE-2024-39563 | High | 7.3 | 2024-10-11 | A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to exec… |
CVE-2024-39547 | High | 7.5 | 2024-10-11 | An Improper Handling of Exceptional Conditions vulnerability in the rpd-server of Juniper Networks Junos OS and Junos OS Evolved within cRPD allows an unauthen… |
CVE-2024-39544 | Medium | 5.0 | 2024-10-11 | An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks Junos OS Evolved allows a low privileged local attacker… |
CVE-2024-39534 | Medium | 5.4 | 2024-10-11 | An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent att… |
CVE-2024-39527 | Medium | 5.5 | 2024-10-11 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devi… |
CVE-2024-39526 | Medium | 6.5 | 2024-10-11 | An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Series with MPC10/MPC11/LC9600 line cards… |
CVE-2024-33582 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33581 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33580 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33579 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33578 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-8755 | High | 8.4 | 2024-10-11 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects: Product Affe… |
CVE-2024-47875 | Critical | 10.0 | 2024-10-11 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability i… |
CVE-2024-47830 | Critical | 9.3 | 2024-10-11 | Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may… |
CVE-2024-47074 | Critical | 9.8 | 2024-10-11 | DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customize the JDBC connect… |
CVE-2024-45403 | Low | 3.7 | 2024-10-11 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client… |
CVE-2024-45402 | High | 8.6 | 2024-10-11 | Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, pic… |
CVE-2024-45397 | Medium | 5.9 | 2024-10-11 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets… |
CVE-2024-45396 | High | 7.5 | 2024-10-11 | Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker can exploit these… |
CVE-2024-25622 | Low | 3.1 | 2024-10-11 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the res… |
CVE-2024-9002 | High | 7.8 | 2024-10-11 | CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and availability of the w… |
CVE-2024-8531 | High | 7.2 | 2024-10-11 | CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when an upgrade bundle is… |
CVE-2024-8530 | Medium | 5.9 | 2024-10-11 | CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” ar… |
CVE-2024-6657 | Medium | 6.5 | 2024-10-11 | A denial of service may be caused to a single peripheral device in a BLE network when multiple central devices continuously connect and disconnect to the peri… |
CVE-2024-9856 | Low | 2.4 | 2024-10-11 | A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2024-9855 | Medium | 4.7 | 2024-10-11 | A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been declared as critical. Affected by this vulnerability is the function uploadFil… |
CVE-2024-9707 | Critical | 9.8 | 2024-10-11 | The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/th… |
CVE-2024-9616 | Medium | 6.1 | 2024-10-11 | The BlockMeister – Block Pattern Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria… |
CVE-2024-9611 | Medium | 6.1 | 2024-10-11 | The Increase upload file size & Maximum Execution Time limit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_a… |
CVE-2024-9610 | Medium | 6.1 | 2024-10-11 | The Language Switcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the… |
CVE-2024-9587 | Medium | 5.4 | 2024-10-11 | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_linkz' function in versions… |
CVE-2024-9586 | Medium | 6.5 | 2024-10-11 | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_auth' and 'check_logout' f… |
CVE-2024-9543 | Medium | 6.4 | 2024-10-11 | The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skipto' shortcode in all versio… |
CVE-2024-9538 | Medium | 4.3 | 2024-10-11 | The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'render' function in in… |
CVE-2024-9507 | Medium | 4.9 | 2024-10-11 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-9436 | Medium | 6.1 | 2024-10-11 | The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting… |
CVE-2024-9346 | Medium | 6.1 | 2024-10-11 | The Embed videos and respect privacy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'v' parameter in all versions up to, and incl… |
CVE-2024-9234 | Critical | 9.8 | 2024-10-11 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a mi… |
CVE-2024-9232 | Medium | 6.1 | 2024-10-11 | The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with… |
CVE-2024-9221 | Medium | 6.1 | 2024-10-11 | The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in al… |
CVE-2024-9211 | Medium | 6.1 | 2024-10-11 | The FULL – Cliente plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate… |
CVE-2024-9164 | Critical | 9.6 | 2024-10-11 | An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 pri… |
CVE-2024-9051 | Medium | 6.4 | 2024-10-11 | The WP Ultimate Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpupg-grid-with-filters shortcode in all versions… |
CVE-2024-8970 | High | 8.2 | 2024-10-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 p… |
CVE-2024-8913 | Medium | 4.3 | 2024-10-11 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Informati… |
CVE-2024-7514 | Medium | 6.5 | 2024-10-11 | The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comment… |
CVE-2024-6971 | Medium | 4.4 | 2024-10-11 | A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_databas… |