2024 CVEs (page 158)
Page 158 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41163 | High | 7.5 | 2024-10-03 | A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a disclosure… |
CVE-2024-39755 | High | 7.8 | 2024-10-03 | A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. A specially crafted PKG file can lead to execute priv… |
CVE-2024-36474 | High | 8.4 | 2024-10-03 | An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1… |
CVE-2024-25590 | High | 7.5 | 2024-10-03 | An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and caching results for these sets can lead to a denial of s… |
CVE-2024-9460 | High | 7.3 | 2024-10-03 | A vulnerability was found in Codezips Online Shopping Portal 1.0. It has been classified as critical. Affected is an unknown function of the file index.php. Th… |
CVE-2024-9100 | Medium | 6.5 | 2024-10-03 | Zohocorp ManageEngine Analytics Plus versions before 5410 and Zoho Analytics On-Premise versions before 5410 are vulnerable to Path traversal. |
CVE-2024-5803 | High | 7.5 | 2024-10-03 | The AVGUI.exe of AVG/Avast Antivirus before versions before 24.1 can allow a local attacker to escalate privileges via an COM hijack in a time-of-check to time… |
CVE-2024-47618 | Medium | 5.4 | 2024-10-03 | Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file… |
CVE-2024-47617 | Medium | 6.1 | 2024-10-03 | Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu… |
CVE-2024-47614 | High | 7.5 | 2024-10-03 | async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead t… |
CVE-2024-47554 | Medium | 4.3 | 2024-10-03 | Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resour… |
CVE-2024-9313 | High | 8.8 | 2024-10-03 | Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation wit… |
CVE-2024-47561 | High | 7.3 | 2024-10-03 | Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to ver… |
CVE-2024-42504 | Medium | 4.3 | 2024-10-03 | A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery (CSRF) in the login flow. |
CVE-2024-8159 | Medium | 6.4 | 2024-10-03 | Deep Freeze 9.00.020.5760 is vulnerable to an out-of-bounds read vulnerability by triggering the 0x70014 IOCTL code of the FarDisk.sys driver. |
CVE-2024-8352 | High | 7.5 | 2024-10-03 | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and i… |
CVE-2024-47136 | High | 7.8 | 2024-10-03 | Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.14.0 and earlier. Having a… |
CVE-2024-47135 | High | 7.8 | 2024-10-03 | Stack-based buffer overflow vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.14.0 and earlier… |
CVE-2024-47134 | High | 7.8 | 2024-10-03 | Out-of-bounds write vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.14.0 and earlier. Having a… |
CVE-2024-47616 | Medium | 6.8 | 2024-10-02 | Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state… |
CVE-2024-45519 | Critical | 10.0 | 2024-10-02 | The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allow… |
CVE-2024-28888 | High | 8.8 | 2024-10-02 | A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. A specially crafted Javascript code inside a mal… |
CVE-2024-24117 | Critical | 9.8 | 2024-10-02 | Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via the login check stat… |
CVE-2024-8733 | High | 8.0 | 2024-10-02 | A potential security vulnerability has been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege. HP is rel… |
CVE-2024-47529 | Medium | 6.5 | 2024-10-02 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a… |
CVE-2024-46977 | Medium | 6.5 | 2024-10-02 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside o… |
CVE-2024-45965 | Medium | 6.4 | 2024-10-02 | Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and… |
CVE-2024-45964 | Medium | 4.8 | 2024-10-02 | Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field. |
CVE-2024-45962 | Medium | 4.7 | 2024-10-02 | October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed throu… |
CVE-2024-45960 | Medium | 4.8 | 2024-10-02 | Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through th… |
CVE-2024-43795 | Medium | 6.1 | 2024-10-02 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a refl… |
CVE-2024-9441 | Critical | 9.8 | 2024-10-02 | The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute a… |
CVE-2024-9440 | Medium | 5.4 | 2024-10-02 | Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the… |
CVE-2024-24116 | Critical | 9.8 | 2024-10-02 | An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm. |
CVE-2024-20513 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-20509 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-20502 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-20501 | High | 8.6 | 2024-10-02 | Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentica… |
CVE-2024-20500 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-20499 | High | 8.6 | 2024-10-02 | Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentica… |
CVE-2024-20498 | High | 8.6 | 2024-10-02 | Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentica… |
CVE-2024-24122 | Low | 3.3 | 2024-10-02 | A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp.adpx file as a zip… |
CVE-2024-46626 | High | 8.8 | 2024-10-02 | OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload. |
CVE-2024-41290 | High | 8.1 | 2024-10-02 | FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component. |
CVE-2024-20524 | Medium | 6.8 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20523 | Medium | 6.8 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20522 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20521 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20520 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20519 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20518 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20517 | Medium | 6.8 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20516 | Medium | 6.8 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20515 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2024-20492 | Medium | 6.0 | 2024-10-02 | A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the und… |
CVE-2024-20491 | Medium | 6.3 | 2024-10-02 | A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive informatio… |
CVE-2024-20490 | Medium | 6.3 | 2024-10-02 | A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker wi… |
CVE-2024-20477 | Medium | 5.4 | 2024-10-02 | A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an aff… |
CVE-2024-20470 | High | 7.2 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an auth… |
CVE-2024-20449 | High | 8.8 | 2024-10-02 | A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code o… |
CVE-2024-20448 | Medium | 6.3 | 2024-10-02 | A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with… |
CVE-2024-20444 | Medium | 5.5 | 2024-10-02 | A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote atta… |
CVE-2024-20442 | Medium | 5.4 | 2024-10-02 | A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrat… |
CVE-2024-20441 | Medium | 5.7 | 2024-10-02 | A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on a… |
CVE-2024-20438 | Medium | 6.3 | 2024-10-02 | A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected dev… |
CVE-2024-20432 | Critical | 9.9 | 2024-10-02 | A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to p… |
CVE-2024-20393 | High | 8.8 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an auth… |
CVE-2024-20385 | Medium | 5.9 | 2024-10-02 | A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an unauthenticated, remote attacker to intercept sensitiv… |
CVE-2024-20365 | Medium | 6.5 | 2024-10-02 | A vulnerability in the Redfish API of Cisco UCS B-Series, Cisco UCS Managed C-Series, and Cisco UCS X-Series Servers could allow an authenticated, remote attac… |
CVE-2024-9423 | Medium | 5.3 | 2024-10-02 | Certain HP LaserJet printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer. The printer displays a “JPEG Unsu… |
CVE-2024-6360 | Critical | 9.8 | 2024-10-02 | Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privi… |
CVE-2024-47807 | High | 8.1 | 2024-10-02 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to sub… |
CVE-2024-47806 | High | 8.1 | 2024-10-02 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to s… |
CVE-2024-47805 | High | 7.5 | 2024-10-02 | Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `Secr… |
CVE-2024-47804 | Medium | 4.3 | 2024-10-02 | If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Je… |
CVE-2024-47803 | Medium | 4.3 | 2024-10-02 | Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `sec… |
CVE-2024-33210 | Medium | 5.4 | 2024-10-02 | A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3. This vulnerability allows an attacker to inject malicious scripts into web pag… |
CVE-2024-33209 | Medium | 5.4 | 2024-10-02 | FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into the "Add New Entry" section, which allows the… |
CVE-2024-47612 | Low | 3.5 | 2024-10-02 | DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (d… |
CVE-2024-47611 | | 2024-10-02 | XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the command line tools… | |
CVE-2024-44193 | High | 7.8 | 2024-10-02 | A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attacker may be able to elevate their privil… |
CVE-2024-44097 | Critical | 9.8 | 2024-10-02 | According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certi… |
CVE-2024-9429 | Medium | 6.3 | 2024-10-02 | A vulnerability has been found in code-projects Restaurant Reservation System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-8885 | High | 8.8 | 2024-10-02 | A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary file… |
CVE-2024-8038 | High | 7.9 | 2024-10-02 | Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication loc… |
CVE-2024-8037 | Medium | 6.5 | 2024-10-02 | Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default… |
CVE-2024-7558 | High | 8.7 | 2024-10-02 | JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the… |
CVE-2024-35294 | Medium | 6.5 | 2024-10-02 | An unauthenticated remote attacker may use the devices traffic capture without authentication to grab plaintext administrative credentials. |
CVE-2024-8505 | Medium | 6.4 | 2024-10-02 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ parameter in all versio… |
CVE-2024-8282 | Medium | 6.4 | 2024-10-02 | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:ive/ive-produ… |
CVE-2024-44030 | High | 7.2 | 2024-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Ab… |
CVE-2024-44017 | High | 7.5 | 2024-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MinHyeong Lim MH Board mh-board allows PHP Local File Inclusion… |
CVE-2024-35293 | Critical | 9.1 | 2024-10-02 | An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or erase the affected devices resulting in da… |
CVE-2024-9378 | Medium | 6.1 | 2024-10-02 | The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4… |
CVE-2024-9344 | Medium | 6.1 | 2024-10-02 | The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable… |
CVE-2024-9218 | Medium | 6.1 | 2024-10-02 | The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to Refl… |
CVE-2024-9225 | Medium | 6.1 | 2024-10-02 | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appr… |
CVE-2024-9222 | Medium | 6.1 | 2024-10-02 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Reflected Cross-Site… |
CVE-2024-9210 | Medium | 6.1 | 2024-10-02 | The MC4WP: Mailchimp Top Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping… |
CVE-2024-9172 | Medium | 6.4 | 2024-10-02 | The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due t… |