2024 CVEs (page 160)
Page 160 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-28813 | High | 8.4 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management application allow an attacker to activate remote… |
CVE-2024-28812 | High | 8.8 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service (on the local management network interface) with hardcoded credentials allows attack… |
CVE-2024-28811 | Low | 3.3 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. A web application allows a remote privileged attacker to execute applications contained in a specific OS… |
CVE-2024-28810 | Medium | 6.6 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Sensitive information inside diagnostic files (exported by the @CT application) allows an attacker to ach… |
CVE-2024-46635 | Medium | 5.9 | 2024-09-30 | An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information via a crafted paylo… |
CVE-2024-46511 | High | 7.5 | 2024-09-30 | LoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitrary code via the Lo… |
CVE-2024-42017 | Critical | 10.0 | 2024-09-30 | An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenario, if the applicat… |
CVE-2024-35495 | Medium | 4.3 | 2024-09-30 | An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 Build 220930 Rel.143947 allows attackers… |
CVE-2024-28809 | High | 8.8 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers to access various ap… |
CVE-2024-9158 | High | 8.4 | 2024-09-30 | A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into… |
CVE-2024-47536 | Medium | 5.4 | 2024-09-30 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their na… |
CVE-2024-46549 | High | 7.6 | 2024-09-30 | An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating devices owned by o… |
CVE-2024-46548 | Medium | 6.3 | 2024-09-30 | TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eavesdrop on communications and access sens… |
CVE-2024-46540 | Medium | 6.3 | 2024-09-30 | A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and sel… |
CVE-2024-45993 | Medium | 6.5 | 2024-09-30 | Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb. |
CVE-2024-47532 | Medium | 6.5 | 2024-09-30 | RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) informa… |
CVE-2024-47531 | Medium | 4.6 | 2024-09-30 | Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extension and make users do… |
CVE-2024-47530 | Medium | 5.4 | 2024-09-30 | Scout is a web-based visualizer for VCF-files. Open redirect vulnerability allows performing phishing attacks on users by redirecting them to malicious page. /… |
CVE-2024-47178 | Medium | 5.3 | 2024-09-30 | basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timi… |
CVE-2024-47067 | Medium | 6.1 | 2024-09-30 | AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link… |
CVE-2024-46869 | High | 7.8 | 2024-09-30 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: Allocate memory for driver private data Fix driver not allocatin… |
CVE-2024-46510 | High | 7.6 | 2024-09-30 | ESAFENET CDG v5 was discovered to contain a SQL injection vulnerability via the id parameter in the NavigationAjax interface |
CVE-2024-46475 | Medium | 4.8 | 2024-09-30 | A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows attackers to execute arbitrary code in th… |
CVE-2024-47172 | Medium | 5.4 | 2024-09-30 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve cert… |
CVE-2024-47064 | Medium | 6.1 | 2024-09-30 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a logged-in CVAT user in… |
CVE-2024-47063 | Medium | 6.1 | 2024-09-30 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If a malicious CVAT user with permissions to eith… |
CVE-2024-46313 | High | 8.0 | 2024-09-30 | TP-Link WR941ND V6 has a stack overflow vulnerability in the ssid parameter in /userRpm/popupSiteSurveyRpm.htm. |
CVE-2024-46293 | Critical | 9.8 | 2024-09-30 | Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control. There is a lack of authorization checks for admin operations. Spe… |
CVE-2024-46280 | High | 8.8 | 2024-09-30 | PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improper Access Control. The TELNET service is enabled with weak credentials for a root-level account, wi… |
CVE-2024-45792 | Medium | 6.5 | 2024-09-30 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information a… |
CVE-2024-6051 | | 2024-09-30 | Cross Application Scripting vulnerability in Vercom S.A. Redlink SDK in specific situations allows local code injection and to manipulate the view of a vulnera… | |
CVE-2024-47641 | Medium | 6.5 | 2024-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muhammad Shakeel Confetti Fall Animation confetti-fall-an… |
CVE-2024-45920 | Medium | 5.4 | 2024-09-30 | A Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts into the application. This issue arises… |
CVE-2024-45772 | Medium | 5.1 | 2024-09-30 | Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. T… |
CVE-2024-9329 | Medium | 6.1 | 2024-09-30 | In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpo… |
CVE-2024-8459 | High | 7.2 | 2024-09-30 | Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configuration files, allowing remote attackers with administ… |
CVE-2024-8458 | High | 8.8 | 2024-09-30 | Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker… |
CVE-2024-8457 | Medium | 4.8 | 2024-09-30 | Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users wi… |
CVE-2024-8456 | Critical | 9.8 | 2024-09-30 | Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attacker… |
CVE-2024-8455 | High | 8.1 | 2024-09-30 | The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communicat… |
CVE-2024-8454 | Medium | 5.3 | 2024-09-30 | The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl… |
CVE-2024-8453 | Medium | 4.9 | 2024-09-30 | Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted. Remote attackers with administrator… |
CVE-2024-6394 | High | 7.5 | 2024-09-30 | A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the `ser… |
CVE-2024-45200 | Medium | 6.3 | 2024-09-30 | In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-based buffer overflow up… |
CVE-2024-42496 | Low | 2.4 | 2024-09-30 | Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. If this vulnerability is exploited, an attacker w… |
CVE-2024-41999 | Medium | 6.8 | 2024-09-30 | Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability. If this vulnerability is exploited, an attacker with physica… |
CVE-2024-8452 | High | 7.5 | 2024-09-30 | Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowi… |
CVE-2024-8451 | High | 7.5 | 2024-09-30 | Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorize… |
CVE-2024-8450 | High | 8.6 | 2024-09-30 | Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowing unauthorized remote attackers to use this commu… |
CVE-2024-8449 | Medium | 6.8 | 2024-09-30 | Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to con… |
CVE-2024-8448 | High | 8.8 | 2024-09-30 | Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers with regular privil… |
CVE-2024-8536 | Medium | 5.4 | 2024-09-30 | The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where t… |
CVE-2024-8379 | High | 7.2 | 2024-09-30 | The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a S… |
CVE-2024-8283 | Medium | 4.8 | 2024-09-30 | The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-8239 | Medium | 5.4 | 2024-09-30 | The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages… |
CVE-2024-3635 | Medium | 4.8 | 2024-09-30 | The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and… |
CVE-2024-9328 | Medium | 6.3 | 2024-09-29 | A vulnerability was found in SourceCodester Advocate Office Management System 1.0. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2024-9327 | Medium | 6.3 | 2024-09-29 | A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot… |
CVE-2024-9326 | High | 7.3 | 2024-09-29 | A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /shopping/admin/… |
CVE-2024-9325 | High | 7.8 | 2024-09-29 | A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\Program Files (x86)\Int… |
CVE-2024-9324 | Medium | 6.3 | 2024-09-29 | A vulnerability was found in Intelbras InControl up to 2.21.57. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-9323 | Low | 3.5 | 2024-09-29 | A vulnerability was found in SourceCodester Inventory Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown… |
CVE-2024-9322 | Medium | 6.3 | 2024-09-29 | A vulnerability was found in code-projects Supply Chain Management 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/… |
CVE-2024-9321 | Medium | 5.3 | 2024-09-29 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2024-9320 | Low | 3.5 | 2024-09-29 | A vulnerability has been found in SourceCodester Online Timesheet App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /e… |
CVE-2024-9319 | Medium | 6.3 | 2024-09-29 | A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the file /endpoint/del… |
CVE-2024-9318 | Medium | 6.3 | 2024-09-28 | A vulnerability, which was classified as critical, has been found in SourceCodester Advocate Office Management System 1.0. Affected by this issue is some unkno… |
CVE-2024-9317 | Medium | 6.3 | 2024-09-28 | A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_category of t… |
CVE-2024-9316 | Medium | 6.3 | 2024-09-28 | A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of the file /admin/blo… |
CVE-2024-9315 | Medium | 6.3 | 2024-09-28 | A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown p… |
CVE-2024-9300 | Medium | 4.3 | 2024-09-28 | A vulnerability classified as problematic was found in SourceCodester Online Railway Reservation System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2024-9299 | Low | 3.5 | 2024-09-28 | A vulnerability classified as problematic has been found in SourceCodester Online Railway Reservation System 1.0. This affects an unknown part of the file /?pa… |
CVE-2024-9298 | Medium | 4.3 | 2024-09-28 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown fun… |
CVE-2024-8189 | Medium | 4.4 | 2024-09-28 | The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmt_menu_name’ parameter in all versions up to… |
CVE-2024-9297 | Medium | 6.3 | 2024-09-28 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2024-9296 | High | 7.3 | 2024-09-28 | A vulnerability was found in SourceCodester Advocate Office Management System 1.0. It has been classified as critical. Affected is an unknown function of the f… |
CVE-2024-8712 | Medium | 6.1 | 2024-09-28 | The GTM Server Side plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the UR… |
CVE-2024-9295 | High | 7.3 | 2024-09-28 | A vulnerability was found in SourceCodester Advocate Office Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2024-23967 | High | 8.0 | 2024-09-28 | Autel MaxiCharger AC Elite Business C50 WebSocket Base64 Decoding Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows ne… |
CVE-2024-23961 | Medium | 6.8 | 2024-09-28 | Alpine Halo9 UPDM_wemCmdUpdFSpeDecomp Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute… |
CVE-2024-23960 | Medium | 4.6 | 2024-09-28 | Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability. This vulnerability allows physically present attackers to bypass signature validat… |
CVE-2024-23959 | High | 8.0 | 2024-09-28 | Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows netwo… |
CVE-2024-23958 | Medium | 6.5 | 2024-09-28 | Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2024-23935 | High | 8.0 | 2024-09-28 | Alpine Halo9 DecodeUTF7 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitr… |
CVE-2024-23924 | Medium | 6.8 | 2024-09-28 | Alpine Halo9 UPDM_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execut… |
CVE-2024-23923 | High | 8.8 | 2024-09-28 | Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary… |
CVE-2024-23957 | High | 8.8 | 2024-09-28 | Autel MaxiCharger AC Elite Business C50 DLB_HostHeartBeat Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-ad… |
CVE-2024-23938 | High | 8.8 | 2024-09-28 | Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2024-8715 | Medium | 6.1 | 2024-09-28 | The Simple LDAP Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the… |
CVE-2024-9189 | Medium | 5.3 | 2024-09-28 | The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_e… |
CVE-2024-9023 | Medium | 6.4 | 2024-09-28 | The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwa_login_form shortcode in all versions up to, and includin… |
CVE-2024-8788 | Medium | 6.1 | 2024-09-28 | The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate… |
CVE-2024-8547 | Medium | 6.4 | 2024-09-28 | The Simple Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [popup] shortcode in all versions up to, and includi… |
CVE-2024-8353 | Critical | 9.8 | 2024-09-28 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 v… |
CVE-2024-9294 | Medium | 6.3 | 2024-09-27 | A vulnerability, which was classified as critical, has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected by this issue is so… |
CVE-2024-38796 | Medium | 5.9 | 2024-09-27 | EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A success… |
CVE-2024-23586 | Medium | 5.3 | 2024-09-27 | HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker could obtain old sessi… |
CVE-2024-9293 | Medium | 6.3 | 2024-09-27 | A vulnerability classified as critical was found in skyselang yylAdmin up to 3.0. Affected by this vulnerability is the function list of the file /app/admin/co… |
CVE-2024-9291 | Low | 3.5 | 2024-09-27 | A vulnerability classified as problematic has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff. Affected is an unknown function… |
CVE-2024-47186 | Medium | 6.1 | 2024-09-27 | Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scrip… |