2024 CVEs (page 163)
Page 163 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47170 | Medium | 4.3 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to re… |
CVE-2024-47169 | High | 8.8 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to up… |
CVE-2024-47130 | High | 8.8 | 2024-09-26 | The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages. It is advised to update your a… |
CVE-2024-47129 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length o… |
CVE-2024-47128 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the enc… |
CVE-2024-47127 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio… |
CVE-2024-47126 | Medium | 6.5 | 2024-09-26 | The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attack… |
CVE-2024-47125 | High | 8.1 | 2024-09-26 | The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to update your app to th… |
CVE-2024-47124 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using this and previous vers… |
CVE-2024-47123 | Medium | 5.3 | 2024-09-26 | The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages mal… |
CVE-2024-47122 | Medium | 4.3 | 2024-09-26 | In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD). This allows for complete decryption of keys store… |
CVE-2024-47121 | Medium | 5.3 | 2024-09-26 | The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and… |
CVE-2024-47075 | Medium | 6.4 | 2024-09-26 | LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripti… |
CVE-2024-45989 | Medium | 4.0 | 2024-09-26 | Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attack… |
CVE-2024-45987 | Medium | 6.5 | 2024-09-26 | Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. This vulnerability allows an attacker to craft… |
CVE-2024-45985 | Medium | 4.7 | 2024-09-26 | A Cross Site Scripting (XSS) vulnerability in update_contact.php of Blood Bank and Donation Management System v1.0 allows an attacker to inject malicious scrip… |
CVE-2024-45984 | Medium | 4.7 | 2024-09-26 | A Cross Site Scripting (XSS) vulnerability in add_donor.php of Blood Bank And Donation Management System 1.0 allows an attacker to inject malicious scripts tha… |
CVE-2024-45838 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. It is advised to not use sensitive information in callsigns when using this and previous… |
CVE-2024-45723 | Medium | 6.5 | 2024-09-26 | The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier fo… |
CVE-2024-45374 | Medium | 5.3 | 2024-09-26 | The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over… |
CVE-2024-45042 | Medium | 4.4 | 2024-09-26 | Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the `highest_… |
CVE-2024-43814 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is a… |
CVE-2024-43694 | Medium | 4.3 | 2024-09-26 | In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys… |
CVE-2024-43108 | Medium | 5.3 | 2024-09-26 | The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves mess… |
CVE-2024-41931 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. It is advised to share t… |
CVE-2024-41722 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software define… |
CVE-2024-41715 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the… |
CVE-2024-39577 | High | 7.1 | 2024-09-26 | Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contains an Improper Neutralization of Special Elements used in a Command ('Co… |
CVE-2024-9203 | Low | 2.5 | 2024-09-26 | A vulnerability, which was classified as problematic, has been found in Enpass Password Manager up to 6.9.5 on Windows. This issue affects some unknown process… |
CVE-2024-9166 | | 2024-09-26 | The device enables an unauthorized attacker to execute system commands with elevated privileges. This exploit is facilitated through the use of the 'getcommand… | |
CVE-2024-46627 | Critical | 9.1 | 2024-09-26 | Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests. |
CVE-2024-45982 | High | 8.8 | 2024-09-26 | A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password res… |
CVE-2024-45981 | High | 8.8 | 2024-09-26 | A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password… |
CVE-2024-45980 | High | 8.8 | 2024-09-26 | A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset l… |
CVE-2024-45979 | High | 8.8 | 2024-09-26 | A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password… |
CVE-2024-44860 | High | 7.5 | 2024-09-26 | An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access sensitive data via a crafted request. |
CVE-2024-37125 | High | 7.5 | 2024-09-26 | Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x,10.5.3.x, contains an Uncontrolled Resource Consumption vulnerability. A remote unauthent… |
CVE-2024-8771 | Medium | 4.3 | 2024-09-26 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthori… |
CVE-2024-7259 | Medium | 4.9 | 2024-09-26 | A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools… |
CVE-2024-46632 | Medium | 4.3 | 2024-09-26 | Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function. |
CVE-2024-45983 | Medium | 6.3 | 2024-09-26 | A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows an attacker to craf… |
CVE-2024-43191 | High | 7.2 | 2024-09-26 | IBM ManageIQ could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted yaml file request. |
CVE-2024-41605 | High | 8.4 | 2024-09-26 | In Foxit PDF Reader before 2024.3, and PDF Editor before 2024.3 and 13.x before 13.1.4, an attacker can replace an update file with a Trojan horse via side loa… |
CVE-2024-39319 | Medium | 5.3 | 2024-09-26 | aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, a… |
CVE-2024-9155 | Medium | 4.3 | 2024-09-26 | Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an… |
CVE-2024-30134 | Medium | 6.7 | 2024-09-26 | The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application. |
CVE-2024-9177 | Medium | 6.4 | 2024-09-26 | The Themedy Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themedy_col, themedy_social_link, themedy_alertbox, and… |
CVE-2024-46330 | High | 7.4 | 2024-09-26 | VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the iptablesWebsFilterRun object. |
CVE-2024-46329 | High | 8.0 | 2024-09-26 | VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the SystemCommand object. |
CVE-2024-46328 | High | 8.0 | 2024-09-26 | VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain hardcoded credentials for several different privileged accounts, including root. |
CVE-2024-46327 | Medium | 5.7 | 2024-09-26 | An issue in the Http_handle object of VONETS VAP11G-300 v3.3.23.6.9 allows attackers to access sensitive files via a directory traversal. |
CVE-2024-31899 | Medium | 4.3 | 2024-09-26 | IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device. |
CVE-2024-8633 | Medium | 5.5 | 2024-09-26 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up… |
CVE-2024-7108 | Critical | 9.8 | 2024-09-26 | Incorrect Authorization vulnerability in National Keep Cyber Security Services CyberMath allows Accessing Functionality Not Properly Constrained by ACLs. This… |
CVE-2024-7107 | High | 7.5 | 2024-09-26 | Files or Directories Accessible to External Parties vulnerability in National Keep Cyber Security Services CyberMath allows Collect Data from Common Resource L… |
CVE-2024-8725 | Medium | 6.8 | 2024-09-26 | Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-… |
CVE-2024-8704 | High | 7.2 | 2024-09-26 | The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 5.2.8 via the 'fma_locale… |
CVE-2024-8126 | High | 7.5 | 2024-09-26 | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php' file in all versions up to, and includ… |
CVE-2024-9199 | Medium | 5.8 | 2024-09-26 | Rate limit vulnerability in Clibo Manager v1.1.9.2 that could allow an attacker to send a large number of emails to the victim in a short time, affecting avail… |
CVE-2024-9198 | High | 7.6 | 2024-09-26 | Vulnerability in Clibo Manager v1.1.9.1 that could allow an attacker to execute an stored Cross-Site Scripting (stored XSS ) by uploading a malicious .svg imag… |
CVE-2024-9173 | Medium | 6.4 | 2024-09-26 | The GF Custom Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0 due to ins… |
CVE-2024-9127 | Medium | 6.4 | 2024-09-26 | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alignment’ parameter in all versions up to, and including, 3… |
CVE-2024-9125 | Medium | 6.4 | 2024-09-26 | The king_IE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficien… |
CVE-2024-9117 | Medium | 6.4 | 2024-09-26 | The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insuff… |
CVE-2024-9115 | Medium | 6.4 | 2024-09-26 | The Common Tools for Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 du… |
CVE-2024-9025 | Medium | 5.3 | 2024-09-26 | The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the… |
CVE-2024-8872 | Medium | 6.1 | 2024-09-26 | The Store Hours for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapi… |
CVE-2024-47337 | Medium | 4.3 | 2024-09-26 | Missing Authorization vulnerability in Phillip Dane Joy Of Text Lite joy-of-text.This issue affects Joy Of Text Lite: from n/a through <= 2.3.1. |
CVE-2024-47044 | Medium | 5.3 | 2024-09-26 | Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for D… |
CVE-2024-8861 | Medium | 6.4 | 2024-09-26 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including… |
CVE-2024-47197 | High | 7.5 | 2024-09-26 | Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affe… |
CVE-2024-47145 | Low | 3.1 | 2024-09-26 | Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker… |
CVE-2024-47003 | Low | 3.1 | 2024-09-26 | Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a… |
CVE-2024-45843 | Low | 3.1 | 2024-09-26 | Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibl… |
CVE-2024-42406 | Medium | 5.4 | 2024-09-26 | Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is… |
CVE-2024-4278 | Medium | 5.5 | 2024-09-26 | An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from… |
CVE-2024-6517 | Medium | 6.1 | 2024-09-26 | The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-0133 | Medium | 4.1 | 2024-09-26 | NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create emp… |
CVE-2024-0132 | Critical | 9.0 | 2024-09-26 | NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specificall… |
CVE-2024-7781 | High | 8.1 | 2024-09-26 | The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to improper authenticat… |
CVE-2024-7772 | Critical | 9.8 | 2024-09-26 | The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all vers… |
CVE-2024-45836 | Medium | 6.1 | 2024-09-26 | Cross-site scripting vulnerability exists in the web management page of PLANEX COMMUNICATIONS network cameras. If a logged-in user accesses a specific file, an… |
CVE-2024-45372 | Medium | 6.5 | 2024-09-26 | MZK-DP300N firmware versions 1.04 and earlier contains a cross-site request forger vulnerability. Viewing a malicious page while logging in to the web manageme… |
CVE-2024-47045 | High | 7.8 | 2024-09-26 | Privilege chaining issue exists in the installer of e-Tax software(common program). If this vulnerability is exploited, a malicious DLL prepared by an attacker… |
CVE-2024-8803 | Medium | 6.1 | 2024-09-26 | The Bulk NoIndex & NoFollow Toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate… |
CVE-2024-8723 | Medium | 6.4 | 2024-09-26 | The 012 Ps Multi Languages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via translated titles in all versions up to, and including, 1.6 du… |
CVE-2024-8552 | Medium | 4.3 | 2024-09-26 | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in… |
CVE-2024-47330 | Medium | 4.3 | 2024-09-26 | Missing Authorization vulnerability in Supsystic Slider by Supsystic, Supsystic Social Share Buttons by Supsystic.This issue affects Slider by Supsystic: from… |
CVE-2024-8405 | Medium | 6.1 | 2024-09-26 | An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within th… |
CVE-2024-8404 | High | 7.8 | 2024-09-26 | An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability… |
CVE-2024-47083 | High | 7.5 | 2024-09-25 | Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Pl… |
CVE-2024-47315 | Medium | 5.4 | 2024-09-25 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.15.1. |
CVE-2024-47305 | Medium | 4.3 | 2024-09-25 | Cross-Site Request Forgery (CSRF) vulnerability in Dnesscarkey Use Any Font use-any-font allows Cross Site Request Forgery.This issue affects Use Any Font: fro… |
CVE-2024-47082 | Medium | 4.6 | 2024-09-25 | Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request… |
CVE-2024-46655 | Medium | 6.1 | 2024-09-25 | A reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a user's browser via a… |
CVE-2024-46489 | High | 8.8 | 2024-09-25 | A remote command execution (RCE) vulnerability in promptr v6.0.7 allows attackers to execute arbitrary commands via a crafted URL. |
CVE-2024-46488 | Medium | 5.5 | 2024-09-25 | sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to cause a Denial of Se… |
CVE-2024-45750 | High | 7.3 | 2024-09-25 | An issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN Client 6.87.109 (and older), Windows Enterprise VPN Client 7.5… |
CVE-2024-8996 | High | 7.3 | 2024-09-25 | Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects… |
CVE-2024-8975 | High | 7.3 | 2024-09-25 | Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: befor… |