2024 CVEs (page 161)
Page 161 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8189 | Medium | 4.4 | 2024-09-28 | The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmt_menu_name’ parameter in all versions up to… |
CVE-2024-9297 | Medium | 6.3 | 2024-09-28 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2024-9296 | High | 7.3 | 2024-09-28 | A vulnerability was found in SourceCodester Advocate Office Management System 1.0. It has been classified as critical. Affected is an unknown function of the f… |
CVE-2024-8712 | Medium | 6.1 | 2024-09-28 | The GTM Server Side plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the UR… |
CVE-2024-9295 | High | 7.3 | 2024-09-28 | A vulnerability was found in SourceCodester Advocate Office Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2024-23967 | High | 8.0 | 2024-09-28 | Autel MaxiCharger AC Elite Business C50 WebSocket Base64 Decoding Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows ne… |
CVE-2024-23961 | Medium | 6.8 | 2024-09-28 | Alpine Halo9 UPDM_wemCmdUpdFSpeDecomp Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute… |
CVE-2024-23960 | Medium | 4.6 | 2024-09-28 | Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability. This vulnerability allows physically present attackers to bypass signature validat… |
CVE-2024-23959 | High | 8.0 | 2024-09-28 | Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows netwo… |
CVE-2024-23958 | Medium | 6.5 | 2024-09-28 | Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2024-23935 | High | 8.0 | 2024-09-28 | Alpine Halo9 DecodeUTF7 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitr… |
CVE-2024-23924 | Medium | 6.8 | 2024-09-28 | Alpine Halo9 UPDM_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execut… |
CVE-2024-23923 | High | 8.8 | 2024-09-28 | Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary… |
CVE-2024-23957 | High | 8.8 | 2024-09-28 | Autel MaxiCharger AC Elite Business C50 DLB_HostHeartBeat Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-ad… |
CVE-2024-23938 | High | 8.8 | 2024-09-28 | Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2024-8715 | Medium | 6.1 | 2024-09-28 | The Simple LDAP Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the… |
CVE-2024-9189 | Medium | 5.3 | 2024-09-28 | The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_e… |
CVE-2024-9023 | Medium | 6.4 | 2024-09-28 | The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwa_login_form shortcode in all versions up to, and includin… |
CVE-2024-8788 | Medium | 6.1 | 2024-09-28 | The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate… |
CVE-2024-8547 | Medium | 6.4 | 2024-09-28 | The Simple Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [popup] shortcode in all versions up to, and includi… |
CVE-2024-8353 | Critical | 9.8 | 2024-09-28 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 v… |
CVE-2024-9294 | Medium | 6.3 | 2024-09-27 | A vulnerability, which was classified as critical, has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected by this issue is so… |
CVE-2024-38796 | Medium | 5.9 | 2024-09-27 | EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A success… |
CVE-2024-23586 | Medium | 5.3 | 2024-09-27 | HCL Nomad is susceptible to an insufficient session expiration vulnerability. Under certain circumstances, an unauthenticated attacker could obtain old sessi… |
CVE-2024-9293 | Medium | 6.3 | 2024-09-27 | A vulnerability classified as critical was found in skyselang yylAdmin up to 3.0. Affected by this vulnerability is the function list of the file /app/admin/co… |
CVE-2024-9291 | Low | 3.5 | 2024-09-27 | A vulnerability classified as problematic has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff. Affected is an unknown function… |
CVE-2024-47186 | Medium | 6.1 | 2024-09-27 | Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scrip… |
CVE-2024-46453 | Medium | 6.1 | 2024-09-27 | A cross-site scripting (XSS) vulnerability in the component /test/ of iq3xcite v2.31 to v3.05 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2024-6436 | Medium | 6.5 | 2024-09-27 | An input validation vulnerability exists in the Rockwell Automation Sequence Manager™ which could allow a malicious user to send malformed packets to the serve… |
CVE-2024-9160 | | 2024-09-27 | In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered. | |
CVE-2024-33369 | High | 8.8 | 2024-09-27 | Directory Traversal vulnerability in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the getFileNameFromConnection… |
CVE-2024-33368 | High | 8.8 | 2024-09-27 | An issue in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the build method in DonwloadPromptScreen |
CVE-2024-9301 | High | 7.5 | 2024-09-27 | A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a |
CVE-2024-46257 | Medium | 6.3 | 2024-09-27 | A Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2.11.3 allows an attacker to achieve remote code execution via… |
CVE-2024-46256 | Critical | 9.8 | 2024-09-27 | A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate. |
CVE-2024-46097 | High | 8.1 | 2024-09-27 | TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is a… |
CVE-2024-39364 | Medium | 6.3 | 2024-09-27 | Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, re… |
CVE-2024-39275 | High | 8.0 | 2024-09-27 | Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a session is closed. Forging requests with a legitimate cookie, even if… |
CVE-2024-38308 | High | 8.8 | 2024-09-27 | Advantech ADAM 5550's web application includes a "logs" page where all the HTTP requests received are displayed to the user. The device doesn't correctly neu… |
CVE-2024-37187 | Medium | 5.7 | 2024-09-27 | Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding. |
CVE-2024-34542 | Medium | 5.7 | 2024-09-27 | Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process. |
CVE-2024-28948 | High | 8.0 | 2024-09-27 | Advantech ADAM-5630 contains a cross-site request forgery (CSRF) vulnerability. It allows an attacker to partly circumvent the same origin policy, which is de… |
CVE-2024-25412 | Medium | 6.1 | 2024-09-27 | A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-25411 | Medium | 6.1 | 2024-09-27 | A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-9284 | Medium | 6.5 | 2024-09-27 | A vulnerability was found in TP-LINK TL-WR841ND up to 20240920. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-8630 | Critical | 9.4 | 2024-09-27 | Alisonic Sibylla devices are vulnerable to SQL injection attacks, which could allow complete access to the database. |
CVE-2024-8310 | Critical | 9.8 | 2024-09-27 | OPW Fuel Management Systems SiteSentinel could allow an attacker to bypass authentication to the server and obtain full admin privileges. |
CVE-2024-6981 | Critical | 9.8 | 2024-09-27 | OMNTEC Proteus Tank Monitoring OEL8000III Series could allow an attacker to perform administrative actions without proper authentication. |
CVE-2024-46367 | Critical | 9.6 | 2024-09-27 | A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malici… |
CVE-2024-46366 | High | 8.8 | 2024-09-27 | A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by inje… |
CVE-2024-38809 | Medium | 5.3 | 2024-09-27 | Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to th… |
CVE-2024-22170 | | 2024-09-27 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.T… | |
CVE-2024-6983 | High | 8.8 | 2024-09-27 | mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the co… |
CVE-2024-47077 | Medium | 6.5 | 2024-09-27 | authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that applicati… |
CVE-2024-47070 | Critical | 9.0 | 2024-09-27 | authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding… |
CVE-2024-45745 | Medium | 5.0 | 2024-09-27 | TopQuadrant TopBraid EDG before version 8.0.1 allows an authenticated attacker to upload an XML DTD file and execute JavaScript to read local files or access U… |
CVE-2024-45744 | Low | 3.0 | 2024-09-27 | TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the… |
CVE-2024-46472 | High | 8.6 | 2024-09-27 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page. |
CVE-2024-46471 | High | 7.5 | 2024-09-27 | The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealin… |
CVE-2024-46470 | Medium | 6.1 | 2024-09-27 | Cross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers to run malicious JavaScript via the membership_type field in… |
CVE-2024-46333 | Medium | 4.8 | 2024-09-27 | An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj… |
CVE-2024-46331 | High | 7.2 | 2024-09-27 | ModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. This vulnerability allows attackers to r… |
CVE-2024-44912 | High | 7.5 | 2024-09-27 | NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TM subsystem (crypto_tm.c). |
CVE-2024-44911 | High | 7.5 | 2024-09-27 | NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TC subsystem (crypto_tc.c). |
CVE-2024-44910 | High | 7.5 | 2024-09-27 | NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the AOS subsystem (crypto_aos.c). |
CVE-2024-40510 | High | 8.2 | 2024-09-27 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMCommon.asmx function. |
CVE-2024-40509 | High | 7.3 | 2024-09-27 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMFinDev.asmx function. |
CVE-2024-3373 | | 2024-09-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RSM Design Website Template allows SQL Injection. This i… | |
CVE-2024-9283 | Low | 3.3 | 2024-09-27 | A vulnerability classified as problematic has been found in RelaxedJS ReLaXed up to 0.2.2. Affected is an unknown function of the component Pug to PDF Converte… |
CVE-2024-7149 | High | 8.8 | 2024-09-27 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl… |
CVE-2024-47184 | Medium | 6.1 | 2024-09-27 | Ampache is a web based audio/video streaming application and file manager. Prior to version 6.6.0, the Democratic Playlist Name is vulnerable to a stored cross… |
CVE-2024-47182 | Medium | 4.8 | 2024-09-27 | Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to… |
CVE-2024-45863 | Medium | 5.3 | 2024-09-27 | A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other unde… |
CVE-2024-45773 | High | 7.5 | 2024-09-27 | A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirab… |
CVE-2024-40512 | High | 7.3 | 2024-09-27 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMReporting.asmx function. |
CVE-2024-40511 | High | 7.3 | 2024-09-27 | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMServerAdmin.asmx function. |
CVE-2024-9282 | Medium | 4.3 | 2024-09-27 | A vulnerability was found in bg5sbk MiniCMS 1.11. It has been classified as problematic. Affected is an unknown function of the file page-edit.php. The manipul… |
CVE-2024-9281 | Medium | 4.3 | 2024-09-27 | A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic. This issue affects some unknown processing of the file post-edit.php. The… |
CVE-2024-46868 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire() If the __qcuefi pointer is n… |
CVE-2024-46867 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: fix deadlock in show_meminfo() There is a real deadlock as well as sleepin… |
CVE-2024-46866 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: add missing bo locking in show_meminfo() bo_meminfo() wants to inspect bo… |
CVE-2024-46865 | Critical | 9.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be initialize first. There can be a condition… |
CVE-2024-46864 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: fix kexec crash due to VP assist page corruption commit 9636be85cc5b ("x86/hy… |
CVE-2024-46863 | High | 7.3 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item There is no links_num in st… |
CVE-2024-46862 | High | 8.0 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item There is no links_num in st… |
CVE-2024-46861 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: do not stop RX on failing RX callback RX callbacks can fail for multiple… |
CVE-2024-46860 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change When disabling wif… |
CVE-2024-46859 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses The panasonic lapto… |
CVE-2024-46858 | High | 8.1 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_… |
CVE-2024-46857 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix bridge mode operations when there are no VFs Currently, trying to set the b… |
CVE-2024-46856 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices The probe() function i… |
CVE-2024-46855 | High | 7.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: fix sk refcount leaks We must put 'sk' reference before returning. |
CVE-2024-46854 | High | 7.1 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: net: dpaa: Pad packets to ETH_ZLEN When sending packets under 60 bytes, up to three bytes… |
CVE-2024-46853 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the… |
CVE-2024-46852 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONTEXPAND was added in… |
CVE-2024-46851 | Medium | 4.7 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid race between dcn10_set_drr() and dc_state_destruct() dc_state_dest… |
CVE-2024-46850 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid race between dcn35_set_drr() and dc_state_destruct() dc_state_dest… |
CVE-2024-46849 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: axg-card: fix 'use-after-free' Buffer 'card->dai_link' is reallocated in 'me… |
CVE-2024-46848 | Medium | 5.5 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Limit the period on Haswell Running the ltp test cve-2015-3290 concurrent… |
CVE-2024-46847 | High | 7.8 | 2024-09-27 | In the Linux kernel, the following vulnerability has been resolved: mm: vmalloc: ensure vmap_block is initialised before adding to queue Commit 8c61291fd850… |