2024 CVEs (page 165)
Page 165 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43423 | Critical | 9.8 | 2024-09-25 | The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed. |
CVE-2024-42797 | Critical | 9.8 | 2024-09-25 | An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_playlist in Kashipara Music Management System v1.0. This vulnerability all… |
CVE-2024-42507 | Critical | 9.8 | 2024-09-25 | Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destin… |
CVE-2024-42506 | Critical | 9.8 | 2024-09-25 | Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destin… |
CVE-2024-42505 | Critical | 9.8 | 2024-09-25 | Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destin… |
CVE-2024-41725 | High | 8.8 | 2024-09-25 | ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input fields that are used to render pages which may allow cross site scripting. |
CVE-2024-39928 | High | 7.5 | 2024-09-25 | In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons… |
CVE-2024-38324 | Medium | 5.9 | 2024-09-25 | IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which… |
CVE-2024-21545 | High | 8.2 | 2024-09-25 | Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response… |
CVE-2024-8794 | Medium | 5.3 | 2024-09-24 | The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_us… |
CVE-2024-8791 | Critical | 9.8 | 2024-09-24 | The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all vers… |
CVE-2024-8671 | Critical | 9.1 | 2024-09-24 | The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/b… |
CVE-2024-8628 | Medium | 5.4 | 2024-09-24 | The Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… |
CVE-2024-8624 | Critical | 9.9 | 2024-09-24 | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' attribute of the 'mdf_select_title' shortcode… |
CVE-2024-8623 | High | 7.3 | 2024-09-24 | The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3… |
CVE-2024-8795 | High | 8.8 | 2024-09-24 | The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or… |
CVE-2024-8738 | Medium | 6.1 | 2024-09-24 | The Seriously Simple Stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on… |
CVE-2024-8716 | Medium | 6.1 | 2024-09-24 | The XT Ajax Add To Cart for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriat… |
CVE-2024-8662 | Medium | 6.1 | 2024-09-24 | The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL… |
CVE-2024-8657 | Medium | 6.4 | 2024-09-24 | The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ggpkg shortcode in all versions up to, and includin… |
CVE-2024-8544 | Medium | 6.1 | 2024-09-24 | The Pixel Cat – Conversion Pixel Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria… |
CVE-2024-8432 | Medium | 4.3 | 2024-09-24 | The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2024-38269 | Medium | 4.9 | 2024-09-24 | An improper restriction of operations within the bounds of a memory buffer in the USB file-sharing handler of the Zyxel VMG8825-T50K firmware versions through… |
CVE-2024-38268 | Medium | 4.9 | 2024-09-24 | An improper restriction of operations within the bounds of a memory buffer in the MAC address parser of the Zyxel VMG8825-T50K firmware versions through 5.50(A… |
CVE-2024-38267 | Medium | 4.9 | 2024-09-24 | An improper restriction of operations within the bounds of a memory buffer in the IPv6 address parser of the Zyxel VMG8825-T50K firmware versions through 5.50(… |
CVE-2024-38266 | Medium | 4.9 | 2024-09-24 | An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG8825-T50K firmware versions through 5.5… |
CVE-2024-7024 | Critical | 9.6 | 2024-09-23 | Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2024-7023 | High | 8.8 | 2024-09-23 | Insufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 allowed a remote attacker to perform privilege escalation via a malicious file… |
CVE-2024-7022 | Medium | 4.3 | 2024-09-23 | Uninitialized Use in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chro… |
CVE-2024-7020 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2024-7019 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2024-7018 | High | 7.8 | 2024-09-23 | Heap buffer overflow in PDF in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (C… |
CVE-2024-8770 | Medium | 6.1 | 2024-09-23 | A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensi… |
CVE-2024-8263 | Low | 2.7 | 2024-09-23 | An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This… |
CVE-2024-42861 | High | 7.5 | 2024-09-23 | An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay_Req message to the time synchro… |
CVE-2024-47222 | Critical | 9.8 | 2024-09-23 | New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from external document storage via the MS-WOPI p… |
CVE-2024-46639 | High | 7.6 | 2024-09-23 | A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into th… |
CVE-2024-44540 | Medium | 6.6 | 2024-09-23 | Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART Debugging Port. |
CVE-2024-43201 | High | 8.8 | 2024-09-23 | The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obt… |
CVE-2024-37779 | High | 8.8 | 2024-09-23 | WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality. |
CVE-2024-39843 | Medium | 6.7 | 2024-09-23 | A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via create user form inputs. |
CVE-2024-39842 | High | 7.2 | 2024-09-23 | A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massive changes inputs. |
CVE-2024-39342 | Medium | 6.6 | 2024-09-23 | Entrust Instant Financial Issuance (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library (i.e. DCG.Security.dll)… |
CVE-2024-39341 | Medium | 5.9 | 2024-09-23 | Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a conf… |
CVE-2024-0005 | Critical | 9.1 | 2024-09-23 | A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP c… |
CVE-2024-0004 | Critical | 9.1 | 2024-09-23 | A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array. |
CVE-2024-0003 | Critical | 9.1 | 2024-09-23 | A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privilege… |
CVE-2024-0002 | Critical | 10.0 | 2024-09-23 | A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array. |
CVE-2024-0001 | Critical | 10.0 | 2024-09-23 | A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor… |
CVE-2024-9014 | Critical | 9.9 | 2024-09-23 | pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the c… |
CVE-2024-40442 | High | 7.2 | 2024-09-23 | An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document au… |
CVE-2024-40441 | Medium | 6.6 | 2024-09-23 | An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document au… |
CVE-2024-47069 | Medium | 6.1 | 2024-09-23 | Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to version… |
CVE-2024-47068 | Medium | 6.1 | 2024-09-23 | Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts… |
CVE-2024-47066 | Critical | 9.0 | 2024-09-23 | Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/ap… |
CVE-2024-46997 | Critical | 9.8 | 2024-09-23 | DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully co… |
CVE-2024-46985 | High | 7.5 | 2024-09-23 | DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static res… |
CVE-2024-41228 | High | 7.6 | 2024-09-23 | A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges and write arbitrary f… |
CVE-2024-34331 | Critical | 9.8 | 2024-09-23 | A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted macOS installer, bec… |
CVE-2024-23972 | Medium | 6.8 | 2024-09-23 | Sony XAV-AX5500 USB Configuration Descriptor Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to exe… |
CVE-2024-23934 | High | 8.8 | 2024-09-23 | Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2024-23933 | Medium | 6.8 | 2024-09-23 | Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute… |
CVE-2024-23922 | Medium | 6.8 | 2024-09-23 | Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute… |
CVE-2024-46241 | Medium | 5.9 | 2024-09-23 | PHPGurukul Dairy Farm Shop Management System v1.1 is vulnerable to Cross-Site Scripting (XSS) via the pname parameter in add_product.php and edit_product.php. |
CVE-2024-7835 | | 2024-09-23 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Exnet Informatics Software Ferry Reservation Syste… | |
CVE-2024-7735 | | 2024-09-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Exnet Informatics Software Ferry Reservation System allow… | |
CVE-2024-46544 | Medium | 5.9 | 2024-09-23 | Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration whi… |
CVE-2024-8903 | Medium | 4.7 | 2024-09-23 | Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Cyber Protect Clou… |
CVE-2024-45348 | Medium | 6.4 | 2024-09-23 | Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an att… |
CVE-2024-8606 | High | 8.8 | 2024-09-23 | Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass two factor authentication |
CVE-2024-8758 | Medium | 4.8 | 2024-09-23 | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2024-7846 | Medium | 5.4 | 2024-09-23 | YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible fo… |
CVE-2024-47227 | Medium | 6.1 | 2024-09-23 | iRedAdmin before 2.6 allows XSS, e.g., via order_name. |
CVE-2024-9094 | Medium | 6.3 | 2024-09-23 | A vulnerability classified as critical was found in code-projects Blood Bank System 1.0. This vulnerability affects unknown code of the file /admin/blood/updat… |
CVE-2024-9093 | Medium | 6.3 | 2024-09-23 | A vulnerability classified as critical has been found in SourceCodester Profile Registration without Reload Refresh 1.0. This affects an unknown part of the fi… |
CVE-2024-9092 | Low | 3.5 | 2024-09-23 | A vulnerability was found in SourceCodester Profile Registration without Reload Refresh 1.0. It has been rated as problematic. Affected by this issue is some u… |
CVE-2024-45453 | Low | 3.7 | 2024-09-23 | Authentication Bypass by Spoofing vulnerability in Peter Hardy-vanDoorn Maintenance Redirect jf3-maintenance-mode.This issue affects Maintenance Redirect: from… |
CVE-2024-44048 | Medium | 6.5 | 2024-09-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Product Carousel Slider & Grid U… |
CVE-2024-43996 | Medium | 6.5 | 2024-09-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ElementsKit ElementsKit Pro allows PHP Local File Inclusion.Thi… |
CVE-2024-9091 | High | 7.3 | 2024-09-23 | A vulnerability was found in code-projects Student Record System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2024-9090 | Medium | 6.3 | 2024-09-23 | A vulnerability was found in SourceCodester Modern Loan Management System 1.0. It has been classified as critical. Affected is an unknown function of the file… |
CVE-2024-9089 | Low | 3.5 | 2024-09-23 | A vulnerability was found in SourceCodester Modern Loan Management System 1.0 and classified as problematic. This issue affects some unknown processing of the… |
CVE-2024-43989 | High | 7.5 | 2024-09-23 | Server-Side Request Forgery (SSRF) vulnerability in Firsh Justified Image Grid justified-image-grid.This issue affects Justified Image Grid: from n/a through <… |
CVE-2024-9088 | Medium | 6.3 | 2024-09-22 | A vulnerability has been found in SourceCodester Telecom Billing Management System 1.0 and classified as critical. This vulnerability affects the function logi… |
CVE-2024-9087 | High | 7.3 | 2024-09-22 | A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. This affects an unknown part of the file /edit1.php. The… |
CVE-2024-9086 | Medium | 6.3 | 2024-09-22 | A vulnerability classified as critical has been found in code-projects Restaurant Reservation System 1.0. Affected is an unknown function of the file /filter.p… |
CVE-2024-40703 | Medium | 5.5 | 2024-09-22 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a lo… |
CVE-2024-9084 | Low | 3.5 | 2024-09-22 | A vulnerability classified as problematic was found in code-projects Blood Bank System 1.0. This vulnerability affects unknown code of the file bbms.php. The m… |
CVE-2024-9083 | Low | 2.4 | 2024-09-22 | A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file /Admin/add-… |
CVE-2024-9085 | High | 7.3 | 2024-09-22 | A vulnerability was found in code-projects Restaurant Reservation System 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2024-9082 | Medium | 6.3 | 2024-09-22 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-9081 | Medium | 6.3 | 2024-09-22 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-9080 | High | 7.3 | 2024-09-22 | A vulnerability was found in code-projects Student Record System 1.0. It has been classified as critical. Affected is an unknown function of the file /pincode-… |
CVE-2024-9079 | High | 7.3 | 2024-09-22 | A vulnerability was found in code-projects Student Record System 1.0 and classified as critical. This issue affects some unknown processing of the file /marks… |
CVE-2024-9078 | High | 7.3 | 2024-09-22 | A vulnerability has been found in code-projects Student Record System 1.0 and classified as critical. This vulnerability affects unknown code of the file /cour… |
CVE-2024-9077 | Low | 3.5 | 2024-09-22 | A vulnerability classified as problematic has been found in dingfangzu up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected is an unknown function of the f… |
CVE-2024-47226 | Medium | 5.4 | 2024-09-22 | A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-rev… |
CVE-2024-9076 | Medium | 4.7 | 2024-09-22 | A vulnerability was found in DedeCMS up to 5.7.115. It has been rated as critical. This issue affects some unknown processing of the file /dede/article_string_… |
CVE-2024-47221 | High | 7.5 | 2024-09-22 | CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password. |
CVE-2024-47219 | Critical | 9.8 | 2024-09-22 | An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows shell command injection. |