2024 CVEs (page 158)
Page 158 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45964 | Medium | 4.8 | 2024-10-02 | Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field. |
CVE-2024-45962 | Medium | 4.7 | 2024-10-02 | October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed throu… |
CVE-2024-45960 | Medium | 4.8 | 2024-10-02 | Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through th… |
CVE-2024-43795 | Medium | 6.1 | 2024-10-02 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a refl… |
CVE-2024-9441 | Critical | 9.8 | 2024-10-02 | The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute a… |
CVE-2024-9440 | Medium | 5.4 | 2024-10-02 | Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the… |
CVE-2024-24116 | Critical | 9.8 | 2024-10-02 | An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm. |
CVE-2024-20513 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-20509 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-20502 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-20501 | High | 8.6 | 2024-10-02 | Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentica… |
CVE-2024-20500 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-20499 | High | 8.6 | 2024-10-02 | Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentica… |
CVE-2024-20498 | High | 8.6 | 2024-10-02 | Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthentica… |
CVE-2024-24122 | Low | 3.3 | 2024-10-02 | A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp.adpx file as a zip… |
CVE-2024-46626 | High | 8.8 | 2024-10-02 | OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload. |
CVE-2024-41290 | High | 8.1 | 2024-10-02 | FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component. |
CVE-2024-20524 | Medium | 6.8 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20523 | Medium | 6.8 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20522 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20521 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20520 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20519 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20518 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20517 | Medium | 6.8 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20516 | Medium | 6.8 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrat… |
CVE-2024-20515 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2024-20492 | Medium | 6.0 | 2024-10-02 | A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the und… |
CVE-2024-20491 | Medium | 6.3 | 2024-10-02 | A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive informatio… |
CVE-2024-20490 | Medium | 6.3 | 2024-10-02 | A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker wi… |
CVE-2024-20477 | Medium | 5.4 | 2024-10-02 | A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an aff… |
CVE-2024-20470 | High | 7.2 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an auth… |
CVE-2024-20449 | High | 8.8 | 2024-10-02 | A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code o… |
CVE-2024-20448 | Medium | 6.3 | 2024-10-02 | A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with… |
CVE-2024-20444 | Medium | 5.5 | 2024-10-02 | A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote atta… |
CVE-2024-20442 | Medium | 5.4 | 2024-10-02 | A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrat… |
CVE-2024-20441 | Medium | 5.7 | 2024-10-02 | A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on a… |
CVE-2024-20438 | Medium | 6.3 | 2024-10-02 | A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected dev… |
CVE-2024-20432 | Critical | 9.9 | 2024-10-02 | A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to p… |
CVE-2024-20393 | High | 8.8 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an auth… |
CVE-2024-20385 | Medium | 5.9 | 2024-10-02 | A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an unauthenticated, remote attacker to intercept sensitiv… |
CVE-2024-20365 | Medium | 6.5 | 2024-10-02 | A vulnerability in the Redfish API of Cisco UCS B-Series, Cisco UCS Managed C-Series, and Cisco UCS X-Series Servers could allow an authenticated, remote attac… |
CVE-2024-9423 | Medium | 5.3 | 2024-10-02 | Certain HP LaserJet printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer. The printer displays a “JPEG Unsu… |
CVE-2024-6360 | Critical | 9.8 | 2024-10-02 | Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privi… |
CVE-2024-47807 | High | 8.1 | 2024-10-02 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to sub… |
CVE-2024-47806 | High | 8.1 | 2024-10-02 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to s… |
CVE-2024-47805 | High | 7.5 | 2024-10-02 | Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `Secr… |
CVE-2024-47804 | Medium | 4.3 | 2024-10-02 | If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Je… |
CVE-2024-47803 | Medium | 4.3 | 2024-10-02 | Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `sec… |
CVE-2024-33210 | Medium | 5.4 | 2024-10-02 | A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3. This vulnerability allows an attacker to inject malicious scripts into web pag… |
CVE-2024-33209 | Medium | 5.4 | 2024-10-02 | FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into the "Add New Entry" section, which allows the… |
CVE-2024-47612 | Low | 3.5 | 2024-10-02 | DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (d… |
CVE-2024-47611 | | 2024-10-02 | XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the command line tools… | |
CVE-2024-44193 | High | 7.8 | 2024-10-02 | A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attacker may be able to elevate their privil… |
CVE-2024-44097 | Critical | 9.8 | 2024-10-02 | According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certi… |
CVE-2024-9429 | Medium | 6.3 | 2024-10-02 | A vulnerability has been found in code-projects Restaurant Reservation System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-8885 | High | 8.8 | 2024-10-02 | A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary file… |
CVE-2024-8038 | High | 7.9 | 2024-10-02 | Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication loc… |
CVE-2024-8037 | Medium | 6.5 | 2024-10-02 | Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default… |
CVE-2024-7558 | High | 8.7 | 2024-10-02 | JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the… |
CVE-2024-35294 | Medium | 6.5 | 2024-10-02 | An unauthenticated remote attacker may use the devices traffic capture without authentication to grab plaintext administrative credentials. |
CVE-2024-8505 | Medium | 6.4 | 2024-10-02 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ parameter in all versio… |
CVE-2024-8282 | Medium | 6.4 | 2024-10-02 | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:ive/ive-produ… |
CVE-2024-44030 | High | 7.2 | 2024-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Ab… |
CVE-2024-44017 | High | 7.5 | 2024-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MinHyeong Lim MH Board mh-board allows PHP Local File Inclusion… |
CVE-2024-35293 | Critical | 9.1 | 2024-10-02 | An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or erase the affected devices resulting in da… |
CVE-2024-9378 | Medium | 6.1 | 2024-10-02 | The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4… |
CVE-2024-9344 | Medium | 6.1 | 2024-10-02 | The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable… |
CVE-2024-9218 | Medium | 6.1 | 2024-10-02 | The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to Refl… |
CVE-2024-9225 | Medium | 6.1 | 2024-10-02 | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appr… |
CVE-2024-9222 | Medium | 6.1 | 2024-10-02 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Reflected Cross-Site… |
CVE-2024-9210 | Medium | 6.1 | 2024-10-02 | The MC4WP: Mailchimp Top Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping… |
CVE-2024-9172 | Medium | 6.4 | 2024-10-02 | The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due t… |
CVE-2024-8967 | Medium | 6.4 | 2024-10-02 | The PWA — easy way to Progressive Web App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc… |
CVE-2024-8800 | Medium | 6.1 | 2024-10-02 | The RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more plugin for WordPress is vulnerable… |
CVE-2024-8254 | Medium | 5.4 | 2024-10-02 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary… |
CVE-2024-9333 | | 2024-10-02 | Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access… | |
CVE-2024-9174 | Medium | 5.4 | 2024-10-02 | Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI |
CVE-2024-7315 | High | 7.5 | 2024-10-02 | The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, wh… |
CVE-2024-7855 | High | 8.8 | 2024-10-02 | The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all ve… |
CVE-2024-45186 | Critical | 9.8 | 2024-10-02 | FileSender before 2.49 allows server-side template injection (SSTI) for retrieving credentials. |
CVE-2024-33662 | High | 7.5 | 2024-10-02 | Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function. |
CVE-2024-21530 | Medium | 4.5 | 2024-10-02 | Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequential… |
CVE-2024-9407 | Medium | 4.7 | 2024-10-01 | A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this… |
CVE-2024-47609 | | 2024-10-01 | Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause… | |
CVE-2024-47528 | Medium | 4.8 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for… |
CVE-2024-47527 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Device Dependencies" feat… |
CVE-2024-47526 | Low | 3.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" featu… |
CVE-2024-47525 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allo… |
CVE-2024-47524 | High | 7.2 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can create a Device Groups, the application did not properly s… |
CVE-2024-47523 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Transports" feature… |
CVE-2024-46084 | High | 8.0 | 2024-10-01 | Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function. |
CVE-2024-46082 | Medium | 5.4 | 2024-10-01 | Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters. |
CVE-2024-46080 | High | 8.0 | 2024-10-01 | Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function. |
CVE-2024-9411 | Low | 3.5 | 2024-10-01 | A vulnerability classified as problematic has been found in OFCMS 1.1.2. This affects the function add of the file /admin/system/dict/add.json?sqlid=system.dic… |
CVE-2024-45999 | Critical | 9.8 | 2024-10-01 | A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function located in the file /application/models/Oqr… |
CVE-2024-9355 | Medium | 6.5 | 2024-10-01 | A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buf… |
CVE-2024-9341 | Medium | 5.4 | 2024-10-01 | A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the c… |
CVE-2024-46083 | Medium | 5.4 | 2024-10-01 | Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads using the messages feature, whi… |
CVE-2024-46081 | Medium | 5.4 | 2024-10-01 | Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads in the To-Do List. The assigned… |