2024 CVEs (page 166)
Page 166 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-9094 | Medium | 6.3 | 2024-09-23 | A vulnerability classified as critical was found in code-projects Blood Bank System 1.0. This vulnerability affects unknown code of the file /admin/blood/updat… |
CVE-2024-9093 | Medium | 6.3 | 2024-09-23 | A vulnerability classified as critical has been found in SourceCodester Profile Registration without Reload Refresh 1.0. This affects an unknown part of the fi… |
CVE-2024-9092 | Low | 3.5 | 2024-09-23 | A vulnerability was found in SourceCodester Profile Registration without Reload Refresh 1.0. It has been rated as problematic. Affected by this issue is some u… |
CVE-2024-45453 | Low | 3.7 | 2024-09-23 | Authentication Bypass by Spoofing vulnerability in Peter Hardy-vanDoorn Maintenance Redirect jf3-maintenance-mode.This issue affects Maintenance Redirect: from… |
CVE-2024-44048 | Medium | 6.5 | 2024-09-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Product Carousel Slider & Grid U… |
CVE-2024-43996 | Medium | 6.5 | 2024-09-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ElementsKit ElementsKit Pro allows PHP Local File Inclusion.Thi… |
CVE-2024-9091 | High | 7.3 | 2024-09-23 | A vulnerability was found in code-projects Student Record System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2024-9090 | Medium | 6.3 | 2024-09-23 | A vulnerability was found in SourceCodester Modern Loan Management System 1.0. It has been classified as critical. Affected is an unknown function of the file… |
CVE-2024-9089 | Low | 3.5 | 2024-09-23 | A vulnerability was found in SourceCodester Modern Loan Management System 1.0 and classified as problematic. This issue affects some unknown processing of the… |
CVE-2024-43989 | High | 7.5 | 2024-09-23 | Server-Side Request Forgery (SSRF) vulnerability in Firsh Justified Image Grid justified-image-grid.This issue affects Justified Image Grid: from n/a through <… |
CVE-2024-9088 | Medium | 6.3 | 2024-09-22 | A vulnerability has been found in SourceCodester Telecom Billing Management System 1.0 and classified as critical. This vulnerability affects the function logi… |
CVE-2024-9087 | High | 7.3 | 2024-09-22 | A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. This affects an unknown part of the file /edit1.php. The… |
CVE-2024-9086 | Medium | 6.3 | 2024-09-22 | A vulnerability classified as critical has been found in code-projects Restaurant Reservation System 1.0. Affected is an unknown function of the file /filter.p… |
CVE-2024-40703 | Medium | 5.5 | 2024-09-22 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a lo… |
CVE-2024-9084 | Low | 3.5 | 2024-09-22 | A vulnerability classified as problematic was found in code-projects Blood Bank System 1.0. This vulnerability affects unknown code of the file bbms.php. The m… |
CVE-2024-9083 | Low | 2.4 | 2024-09-22 | A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file /Admin/add-… |
CVE-2024-9085 | High | 7.3 | 2024-09-22 | A vulnerability was found in code-projects Restaurant Reservation System 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2024-9082 | Medium | 6.3 | 2024-09-22 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-9081 | Medium | 6.3 | 2024-09-22 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-9080 | High | 7.3 | 2024-09-22 | A vulnerability was found in code-projects Student Record System 1.0. It has been classified as critical. Affected is an unknown function of the file /pincode-… |
CVE-2024-9079 | High | 7.3 | 2024-09-22 | A vulnerability was found in code-projects Student Record System 1.0 and classified as critical. This issue affects some unknown processing of the file /marks… |
CVE-2024-9078 | High | 7.3 | 2024-09-22 | A vulnerability has been found in code-projects Student Record System 1.0 and classified as critical. This vulnerability affects unknown code of the file /cour… |
CVE-2024-9077 | Low | 3.5 | 2024-09-22 | A vulnerability classified as problematic has been found in dingfangzu up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected is an unknown function of the f… |
CVE-2024-47226 | Medium | 5.4 | 2024-09-22 | A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-rev… |
CVE-2024-9076 | Medium | 4.7 | 2024-09-22 | A vulnerability was found in DedeCMS up to 5.7.115. It has been rated as critical. This issue affects some unknown processing of the file /dede/article_string_… |
CVE-2024-47221 | High | 7.5 | 2024-09-22 | CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password. |
CVE-2024-47219 | Critical | 9.8 | 2024-09-22 | An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows shell command injection. |
CVE-2024-47218 | Critical | 9.8 | 2024-09-22 | An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows bypassing authentication. |
CVE-2024-9075 | Low | 2.6 | 2024-09-21 | A vulnerability was found in Stirling-Tools Stirling-PDF up to 0.28.3. It has been declared as problematic. This vulnerability affects unknown code of the comp… |
CVE-2024-47210 | High | 8.8 | 2024-09-21 | Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelf in server/api/con… |
CVE-2024-42323 | High | 8.8 | 2024-09-21 | SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This… |
CVE-2024-9048 | Low | 3.1 | 2024-09-21 | A vulnerability was found in y_project RuoYi up to 4.7.9. It has been declared as problematic. Affected by this vulnerability is the function SysUserServiceImp… |
CVE-2024-8680 | Medium | 4.4 | 2024-09-21 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4… |
CVE-2024-6787 | Medium | 5.3 | 2024-09-21 | This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By exploiting this ra… |
CVE-2024-6786 | Medium | 6.5 | 2024-09-21 | The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system… |
CVE-2024-6785 | Medium | 5.5 | 2024-09-21 | The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting i… |
CVE-2024-46649 | High | 7.5 | 2024-09-20 | eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder. |
CVE-2024-46648 | High | 7.5 | 2024-09-20 | eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scan_folder. |
CVE-2024-46647 | Medium | 6.5 | 2024-09-20 | eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via upload_files. |
CVE-2024-46646 | Medium | 6.5 | 2024-09-20 | eNMS up to 4.7.1 is vulnerable to Directory Traversal via /download/file. |
CVE-2024-46645 | High | 7.5 | 2024-09-20 | eNMS 4.0.0 is vulnerable to Directory Traversal via get_tree_files. |
CVE-2024-46644 | Medium | 6.5 | 2024-09-20 | eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via edit_file. |
CVE-2024-46640 | Critical | 9.8 | 2024-09-20 | SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check function is not ex… |
CVE-2024-46103 | Critical | 9.8 | 2024-09-20 | SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php. |
CVE-2024-46101 | Critical | 9.8 | 2024-09-20 | GDidees CMS <= v3.9.1 has a file upload vulnerability. |
CVE-2024-45793 | Medium | 4.8 | 2024-09-20 | Confidant is a open source secret management service that provides user-friendly storage and access to secrets. The following endpoints are subject to a cross… |
CVE-2024-47062 | High | 8.8 | 2024-09-20 | Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be expl… |
CVE-2024-47061 | High | 8.3 | 2024-09-20 | Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Pl… |
CVE-2024-46654 | Medium | 4.8 | 2024-09-20 | A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web script… |
CVE-2024-45229 | Medium | 6.6 | 2024-09-20 | The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registratio… |
CVE-2024-42351 | Medium | 6.5 | 2024-09-20 | Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. An a… |
CVE-2024-42346 | High | 7.6 | 2024-09-20 | Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The… |
CVE-2024-8612 | Low | 3.8 | 2024-09-20 | A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_bl… |
CVE-2024-42697 | Medium | 6.1 | 2024-09-20 | Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q param… |
CVE-2024-9041 | Medium | 6.3 | 2024-09-20 | A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This vulnerability affects unknown code of… |
CVE-2024-9040 | Low | 2.3 | 2024-09-20 | A vulnerability, which was classified as problematic, was found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the componen… |
CVE-2024-45489 | Critical | 9.8 | 2024-09-20 | Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however (because of misconfigu… |
CVE-2024-37879 | Medium | 4.8 | 2024-09-20 | Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitrary code via the fi… |
CVE-2024-9039 | High | 7.3 | 2024-09-20 | A vulnerability, which was classified as critical, has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is some unk… |
CVE-2024-9038 | Medium | 4.3 | 2024-09-20 | A vulnerability classified as problematic was found in Codezips Online Shopping Portal 1.0. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2024-9037 | High | 7.3 | 2024-09-20 | A vulnerability classified as critical has been found in Codezips Internal Marks Calculation 1.0. Affected is an unknown function of the file index.php. The ma… |
CVE-2024-9036 | Medium | 6.3 | 2024-09-20 | A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin_add… |
CVE-2024-46652 | Critical | 9.8 | 2024-09-20 | Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability in the fromAdvSetMacMtuWan function. |
CVE-2024-9035 | High | 7.3 | 2024-09-20 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admi… |
CVE-2024-9034 | High | 7.3 | 2024-09-20 | A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2024-9033 | Low | 3.5 | 2024-09-20 | A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an un… |
CVE-2024-9032 | Medium | 6.3 | 2024-09-20 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Forum-Discussion System 1.0. Affected is an unknown function of the file… |
CVE-2024-9031 | Low | 3.5 | 2024-09-20 | A vulnerability, which was classified as problematic, has been found in CodeCanyon CRMGo SaaS up to 7.2. This issue affects some unknown processing of the file… |
CVE-2024-9030 | Low | 3.5 | 2024-09-20 | A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2. This vulnerability affects unknown code of the file /deal/{note_id}/note. The… |
CVE-2024-9043 | Critical | 9.8 | 2024-09-20 | Secure Email Gateway from Cellopoint has Buffer Overflow Vulnerability in authentication process. Remote unauthenticated attackers can send crafted packets to… |
CVE-2024-8853 | Critical | 9.8 | 2024-09-20 | The Webo-facto plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.40 due to insufficient restriction on the 'doSsoA… |
CVE-2024-41721 | High | 8.1 | 2024-09-20 | An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and rem… |
CVE-2024-9011 | Medium | 6.3 | 2024-09-20 | A vulnerability, which was classified as critical, was found in code-projects Crud Operation System 1.0. Affected is an unknown function of the file updata.php… |
CVE-2024-9009 | Medium | 6.3 | 2024-09-20 | A vulnerability, which was classified as critical, has been found in code-projects Online Quiz Site 1.0. This issue affects some unknown processing of the file… |
CVE-2024-47060 | Medium | 4.3 | 2024-09-20 | Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applicat… |
CVE-2024-47000 | High | 8.1 | 2024-09-20 | Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated… |
CVE-2024-46999 | High | 7.3 | 2024-09-20 | Zitadel is an open source identity management platform. ZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still… |
CVE-2024-45810 | Medium | 6.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling `sendLocalReply` under some circums… |
CVE-2024-45809 | Medium | 5.3 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the foll… |
CVE-2024-45808 | Medium | 6.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unex… |
CVE-2024-45807 | High | 7.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are potential bugs ar… |
CVE-2024-45806 | Medium | 6.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, pote… |
CVE-2024-9008 | Medium | 6.3 | 2024-09-19 | A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. This vulnerability affects unknown code of the file /news-detai… |
CVE-2024-9007 | Low | 3.5 | 2024-09-19 | A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulati… |
CVE-2024-9006 | Medium | 6.3 | 2024-09-19 | A vulnerability was found in jeanmarc77 123solar 1.8.4.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file confi… |
CVE-2024-46984 | High | 8.6 | 2024-09-19 | The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location rou… |
CVE-2024-46983 | Critical | 9.8 | 2024-09-19 | sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict dese… |
CVE-2024-45614 | Medium | 5.4 | 2024-09-19 | Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) b… |
CVE-2024-45410 | Critical | 9.8 | 2024-09-19 | Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-… |
CVE-2024-9004 | Medium | 6.3 | 2024-09-19 | A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/DBManage/Backup_Serv… |
CVE-2024-9003 | Medium | 4.3 | 2024-09-19 | A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController o… |
CVE-2024-43496 | Medium | 6.5 | 2024-09-19 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43489 | Medium | 6.5 | 2024-09-19 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-38221 | Medium | 4.3 | 2024-09-19 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-9001 | Medium | 6.3 | 2024-09-19 | A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file… |
CVE-2024-40125 | Critical | 9.8 | 2024-09-19 | An arbitrary file upload vulnerability in the Media Manager function of Closed-Loop Technology CLESS Server v4.5.2 allows attackers to execute arbitrary code v… |
CVE-2024-33109 | Critical | 9.9 | 2024-09-19 | Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via t… |
CVE-2024-25673 | Medium | 6.1 | 2024-09-19 | Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection. |
CVE-2024-8963 | Critical | 9.4 | 2024-09-19 | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. |
CVE-2024-47162 | Medium | 4.1 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page |