2024 CVEs (page 157)
Page 157 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41511 | Low | 3.9 | 2024-10-04 | A Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers to retrieve arbitra… |
CVE-2024-38040 | High | 7.5 | 2024-10-04 | There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that co… |
CVE-2024-38039 | Medium | 5.4 | 2024-10-04 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted… |
CVE-2024-38038 | Medium | 6.1 | 2024-10-04 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 which may allow a remote, unauthenticated attacker to create a crafted link whic… |
CVE-2024-38037 | Medium | 6.1 | 2024-10-04 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2024-38036 | Medium | 5.4 | 2024-10-04 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a craft… |
CVE-2024-25707 | Medium | 4.8 | 2024-10-04 | There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with adminis… |
CVE-2024-25702 | Medium | 4.8 | 2024-10-04 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated… |
CVE-2024-25701 | Medium | 4.8 | 2024-10-04 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Experience Builder versions 11.1 and below that may allow a remote, a… |
CVE-2024-25694 | Medium | 4.8 | 2024-10-04 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise versions 11.1 and below that may allow a remote, authenticated attack… |
CVE-2024-25691 | Medium | 6.1 | 2024-10-04 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 and below which may allow a remote, unauthenticated attacker to create a crafted… |
CVE-2024-46486 | High | 8.0 | 2024-10-04 | TP-LINK TL-WDR5620 v2.3 was discovered to contain a remote code execution (RCE) vulnerability via the httpProcDataSrv function. |
CVE-2024-46409 | Medium | 5.4 | 2024-10-04 | A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload… |
CVE-2024-47769 | High | 7.5 | 2024-10-04 | IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is id… |
CVE-2024-47768 | High | 8.1 | 2024-10-04 | Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account recovery system whe… |
CVE-2024-47765 | Medium | 6.1 | 2024-10-04 | Minecraft MOTD Parser is a PHP library to parse minecraft server motd. The HtmlGenerator class is subject to potential cross-site scripting (XSS) attack throug… |
CVE-2024-47183 | High | 8.1 | 2024-10-04 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is… |
CVE-2024-9515 | High | 8.8 | 2024-10-04 | A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. This affects the function formSetQoS of the file /goform/formSet… |
CVE-2024-9514 | High | 8.8 | 2024-10-04 | A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been declared as critical. This vulnerability affects the function formSetDomainFilter of the… |
CVE-2024-9410 | Medium | 5.3 | 2024-10-04 | Ada.cx's Sentry configuration allowed for blind server-side request forgeries (SSRF) through the use of a data scraping endpoint. |
CVE-2024-9513 | Low | 3.7 | 2024-10-04 | A vulnerability was found in Netadmin Software NetAdmin IAM up to 3.5 and classified as problematic. Affected by this issue is some unknown functionality of th… |
CVE-2024-9484 | Medium | 5.1 | 2024-10-04 | An null-pointer-derefrence in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed xar file to cras… |
CVE-2024-9483 | Medium | 5.1 | 2024-10-04 | A null-pointer-dereference in the signature verification module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS may allow a malform… |
CVE-2024-9482 | Medium | 5.1 | 2024-10-04 | An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed Mach-O file to crash… |
CVE-2024-9481 | Medium | 5.1 | 2024-10-04 | An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed eml file to crash th… |
CVE-2024-8499 | Medium | 4.7 | 2024-10-04 | The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_reques… |
CVE-2024-47790 | | 2024-10-04 | ** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in D3D Security IP Camera D8801 due to usage of insecure Real-Time Streaming Protocol (RTSP) version… | |
CVE-2024-47789 | | 2024-10-04 | ** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in D3D Security IP Camera D8801 due to usage of weak authentication scheme of the HTTP header protoco… | |
CVE-2024-47657 | Medium | 6.5 | 2024-10-04 | This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoints. An authenticated remote attacker could exploi… |
CVE-2024-47656 | Critical | 9.8 | 2024-10-04 | This vulnerability exists in Shilpi Client Dashboard due to missing restrictions for incorrect login attempts on its API based login. A remote attacker could e… |
CVE-2024-47655 | High | 8.8 | 2024-10-04 | This vulnerability exists in the Shilpi Client Dashboard due to improper validation of files being uploaded other than the specified extension. An authenticate… |
CVE-2024-47654 | High | 7.5 | 2024-10-04 | This vulnerability exists in Shilpi Client Dashboard due to lack of rate limiting and Captcha protection for OTP requests in certain API endpoint. An unauthent… |
CVE-2024-47653 | Medium | 6.5 | 2024-10-04 | This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancellation requests through certain API endpoints. An… |
CVE-2024-47652 | High | 8.1 | 2024-10-04 | This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module wherein access to any use… |
CVE-2024-6400 | High | 7.5 | 2024-10-04 | Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded… |
CVE-2024-47651 | Medium | 6.5 | 2024-10-04 | This vulnerability exists in Shilpi Client Dashboard due to improper handling of multiple parameters in the API endpoint. An authenticated remote attacker coul… |
CVE-2024-9271 | Medium | 6.4 | 2024-10-04 | The Re:WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficien… |
CVE-2024-9071 | Medium | 6.4 | 2024-10-04 | The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all… |
CVE-2024-9435 | Medium | 6.1 | 2024-10-04 | The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL keys in all versions up to, and incl… |
CVE-2024-9306 | Medium | 4.4 | 2024-10-04 | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.6 due to… |
CVE-2024-6444 | Medium | 6.3 | 2024-10-04 | No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. |
CVE-2024-9242 | Medium | 6.4 | 2024-10-04 | The Memberful – Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'memberful_buy_subscription_link' and 'mem… |
CVE-2024-8804 | Medium | 6.4 | 2024-10-04 | The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functionality in all versions up to, and includi… |
CVE-2024-6443 | Medium | 6.3 | 2024-10-04 | In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty. |
CVE-2024-6442 | Medium | 6.3 | 2024-10-04 | In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow. |
CVE-2024-47855 | Medium | 5.3 | 2024-10-04 | util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string. |
CVE-2024-47854 | Medium | 6.1 | 2024-10-04 | An XSS vulnerability was discovered in Veritas Data Insight before 7.1. It allows a remote attacker to inject an arbitrary web script into an HTTP request that… |
CVE-2024-9445 | Medium | 6.4 | 2024-10-04 | The Display Medium Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_medium_posts shortcode in all versions up t… |
CVE-2024-9421 | Medium | 6.4 | 2024-10-04 | The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to, and including, 1… |
CVE-2024-9384 | Medium | 6.1 | 2024-10-04 | The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_… |
CVE-2024-9375 | Medium | 6.1 | 2024-10-04 | The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appro… |
CVE-2024-9372 | Medium | 6.4 | 2024-10-04 | The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to ins… |
CVE-2024-9368 | Medium | 6.4 | 2024-10-04 | The Aggregator Advanced Settings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1… |
CVE-2024-9353 | Medium | 6.1 | 2024-10-04 | The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate… |
CVE-2024-9349 | Medium | 6.1 | 2024-10-04 | The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg… |
CVE-2024-9345 | Medium | 6.1 | 2024-10-04 | The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without a… |
CVE-2024-9237 | Medium | 6.1 | 2024-10-04 | The Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to… |
CVE-2024-9204 | Medium | 6.1 | 2024-10-04 | The Smart Custom 404 Error Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] in all versions up to, and inc… |
CVE-2024-8802 | Medium | 6.1 | 2024-10-04 | The Clio Grow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in a… |
CVE-2024-8520 | Medium | 5.3 | 2024-10-04 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-… |
CVE-2024-8519 | Medium | 6.4 | 2024-10-04 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2024-47850 | High | 7.5 | 2024-10-04 | CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer… |
CVE-2024-44207 | Medium | 4.3 | 2024-10-04 | This issue was addressed with improved checks. This issue is fixed in iOS 18.0.1 and iPadOS 18.0.1. Audio messages in Messages may be able to capture a few sec… |
CVE-2024-44204 | Medium | 5.5 | 2024-10-04 | A logic issue was addressed with improved validation. This issue is fixed in iOS 18.0.1 and iPadOS 18.0.1. A user's saved passwords may be read aloud by VoiceO… |
CVE-2024-45367 | Critical | 9.1 | 2024-10-03 | The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a pa… |
CVE-2024-43699 | Critical | 9.8 | 2024-10-03 | Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue t… |
CVE-2024-42417 | High | 8.8 | 2024-10-03 | Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to c… |
CVE-2024-41925 | Critical | 9.8 | 2024-10-03 | The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse director… |
CVE-2024-46658 | High | 8.0 | 2024-10-03 | Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability. |
CVE-2024-9266 | Medium | 4.7 | 2024-10-03 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue imp… |
CVE-2024-41596 | High | 8.0 | 2024-10-03 | Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval and handling of th… |
CVE-2024-41595 | High | 8.0 | 2024-10-03 | DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .cgi pages because of missing bounds check… |
CVE-2024-41594 | High | 7.5 | 2024-10-03 | An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI use… |
CVE-2024-41593 | Critical | 9.8 | 2024-10-03 | DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension ope… |
CVE-2024-41592 | High | 8.0 | 2024-10-03 | DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand ch… |
CVE-2024-41591 | Medium | 6.1 | 2024-10-03 | DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS. |
CVE-2024-41590 | High | 8.0 | 2024-10-03 | Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed through POST requests… |
CVE-2024-41589 | High | 8.8 | 2024-10-03 | DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests. |
CVE-2024-41588 | High | 8.0 | 2024-10-03 | The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated users, because of… |
CVE-2024-41587 | Medium | 5.4 | 2024-10-03 | Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6. |
CVE-2024-41586 | High | 8.0 | 2024-10-03 | A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code via a long query str… |
CVE-2024-41585 | Medium | 6.8 | 2024-10-03 | DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker to leverage the recvCmd binary to escap… |
CVE-2024-41584 | Medium | 4.7 | 2024-10-03 | DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormAuthStr parameter. |
CVE-2024-41583 | Medium | 4.7 | 2024-10-03 | DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated users due to poor sanitization of the router nam… |
CVE-2024-47762 | Medium | 5.8 | 2024-10-03 | Backstage is an open framework for building developer portals. Configuration supplied through APP_CONFIG_* environment variables, for example APP_CONFIG_backen… |
CVE-2024-41988 | | 2024-10-03 | TEM Opera Plus FM Family Transmitter allows access to an unprotected endpoint that allows MPFS File System binary image upload without authentication. This fil… | |
CVE-2024-41987 | | 2024-10-03 | The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks… | |
CVE-2024-34535 | Medium | 5.9 | 2024-10-03 | In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header. |
CVE-2024-8508 | Medium | 5.3 | 2024-10-03 | NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compr… |
CVE-2024-7826 | Critical | 9.8 | 2024-10-03 | Improper Check for Unusual or Exceptional Conditions vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit (wrURL.Dll modules) a… |
CVE-2024-7825 | Critical | 9.8 | 2024-10-03 | Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit (wrUrl.Dll m… |
CVE-2024-7824 | Critical | 9.8 | 2024-10-03 | Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit (wrUrl.Dll m… |
CVE-2024-45872 | Medium | 6.3 | 2024-10-03 | Bandisoft BandiView 7.05 is vulnerable to Buffer Overflow via sub_0x410d1d. The vulnerability occurs due to insufficient validation of PSD files. |
CVE-2024-45871 | Medium | 6.3 | 2024-10-03 | Bandisoft BandiView 7.05 is Incorrect Access Control via sub_0x232bd8 resulting in denial of service (DOS). |
CVE-2024-0125 | Low | 3.3 | 2024-10-03 | NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can cause a NULL pointer dereference by runni… |
CVE-2024-0124 | Low | 3.3 | 2024-10-03 | NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can cause nvdisasm to read freed memory by ru… |
CVE-2024-0123 | Low | 3.3 | 2024-10-03 | NVIDIA CUDA toolkit for Windows and Linux contains a vulnerability in the nvdisasm command line tool where an attacker may cause an improper validation in inpu… |
CVE-2024-45870 | Medium | 6.5 | 2024-10-03 | Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file. |
CVE-2024-42415 | High | 8.4 | 2024-10-03 | An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf)… |
CVE-2024-41922 | High | 7.5 | 2024-10-03 | A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a… |