2024 CVEs (page 166)
Page 166 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47218 | Critical | 9.8 | 2024-09-22 | An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows bypassing authentication. |
CVE-2024-9075 | Low | 2.6 | 2024-09-21 | A vulnerability was found in Stirling-Tools Stirling-PDF up to 0.28.3. It has been declared as problematic. This vulnerability affects unknown code of the comp… |
CVE-2024-47210 | High | 8.8 | 2024-09-21 | Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelf in server/api/con… |
CVE-2024-42323 | High | 8.8 | 2024-09-21 | SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This… |
CVE-2024-9048 | Low | 3.1 | 2024-09-21 | A vulnerability was found in y_project RuoYi up to 4.7.9. It has been declared as problematic. Affected by this vulnerability is the function SysUserServiceImp… |
CVE-2024-8680 | Medium | 4.4 | 2024-09-21 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4… |
CVE-2024-6787 | Medium | 5.3 | 2024-09-21 | This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By exploiting this ra… |
CVE-2024-6786 | Medium | 6.5 | 2024-09-21 | The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system… |
CVE-2024-6785 | Medium | 5.5 | 2024-09-21 | The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting i… |
CVE-2024-46649 | High | 7.5 | 2024-09-20 | eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder. |
CVE-2024-46648 | High | 7.5 | 2024-09-20 | eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scan_folder. |
CVE-2024-46647 | Medium | 6.5 | 2024-09-20 | eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via upload_files. |
CVE-2024-46646 | Medium | 6.5 | 2024-09-20 | eNMS up to 4.7.1 is vulnerable to Directory Traversal via /download/file. |
CVE-2024-46645 | High | 7.5 | 2024-09-20 | eNMS 4.0.0 is vulnerable to Directory Traversal via get_tree_files. |
CVE-2024-46644 | Medium | 6.5 | 2024-09-20 | eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via edit_file. |
CVE-2024-46640 | Critical | 9.8 | 2024-09-20 | SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check function is not ex… |
CVE-2024-46103 | Critical | 9.8 | 2024-09-20 | SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php. |
CVE-2024-46101 | Critical | 9.8 | 2024-09-20 | GDidees CMS <= v3.9.1 has a file upload vulnerability. |
CVE-2024-45793 | Medium | 4.8 | 2024-09-20 | Confidant is a open source secret management service that provides user-friendly storage and access to secrets. The following endpoints are subject to a cross… |
CVE-2024-47062 | High | 8.8 | 2024-09-20 | Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be expl… |
CVE-2024-47061 | High | 8.3 | 2024-09-20 | Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Pl… |
CVE-2024-46654 | Medium | 4.8 | 2024-09-20 | A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web script… |
CVE-2024-45229 | Medium | 6.6 | 2024-09-20 | The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registratio… |
CVE-2024-42351 | Medium | 6.5 | 2024-09-20 | Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. An a… |
CVE-2024-42346 | High | 7.6 | 2024-09-20 | Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The… |
CVE-2024-8612 | Low | 3.8 | 2024-09-20 | A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_bl… |
CVE-2024-42697 | Medium | 6.1 | 2024-09-20 | Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q param… |
CVE-2024-9041 | Medium | 6.3 | 2024-09-20 | A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This vulnerability affects unknown code of… |
CVE-2024-9040 | Low | 2.3 | 2024-09-20 | A vulnerability, which was classified as problematic, was found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the componen… |
CVE-2024-45489 | Critical | 9.8 | 2024-09-20 | Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however (because of misconfigu… |
CVE-2024-37879 | Medium | 4.8 | 2024-09-20 | Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitrary code via the fi… |
CVE-2024-9039 | High | 7.3 | 2024-09-20 | A vulnerability, which was classified as critical, has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is some unk… |
CVE-2024-9038 | Medium | 4.3 | 2024-09-20 | A vulnerability classified as problematic was found in Codezips Online Shopping Portal 1.0. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2024-9037 | High | 7.3 | 2024-09-20 | A vulnerability classified as critical has been found in Codezips Internal Marks Calculation 1.0. Affected is an unknown function of the file index.php. The ma… |
CVE-2024-9036 | Medium | 6.3 | 2024-09-20 | A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin_add… |
CVE-2024-46652 | Critical | 9.8 | 2024-09-20 | Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability in the fromAdvSetMacMtuWan function. |
CVE-2024-9035 | High | 7.3 | 2024-09-20 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admi… |
CVE-2024-9034 | High | 7.3 | 2024-09-20 | A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2024-9033 | Low | 3.5 | 2024-09-20 | A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an un… |
CVE-2024-9032 | Medium | 6.3 | 2024-09-20 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Forum-Discussion System 1.0. Affected is an unknown function of the file… |
CVE-2024-9031 | Low | 3.5 | 2024-09-20 | A vulnerability, which was classified as problematic, has been found in CodeCanyon CRMGo SaaS up to 7.2. This issue affects some unknown processing of the file… |
CVE-2024-9030 | Low | 3.5 | 2024-09-20 | A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2. This vulnerability affects unknown code of the file /deal/{note_id}/note. The… |
CVE-2024-9043 | Critical | 9.8 | 2024-09-20 | Secure Email Gateway from Cellopoint has Buffer Overflow Vulnerability in authentication process. Remote unauthenticated attackers can send crafted packets to… |
CVE-2024-8853 | Critical | 9.8 | 2024-09-20 | The Webo-facto plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.40 due to insufficient restriction on the 'doSsoA… |
CVE-2024-41721 | High | 8.1 | 2024-09-20 | An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and rem… |
CVE-2024-9011 | Medium | 6.3 | 2024-09-20 | A vulnerability, which was classified as critical, was found in code-projects Crud Operation System 1.0. Affected is an unknown function of the file updata.php… |
CVE-2024-9009 | Medium | 6.3 | 2024-09-20 | A vulnerability, which was classified as critical, has been found in code-projects Online Quiz Site 1.0. This issue affects some unknown processing of the file… |
CVE-2024-47060 | Medium | 4.3 | 2024-09-20 | Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applicat… |
CVE-2024-47000 | High | 8.1 | 2024-09-20 | Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated… |
CVE-2024-46999 | High | 7.3 | 2024-09-20 | Zitadel is an open source identity management platform. ZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still… |
CVE-2024-45810 | Medium | 6.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling `sendLocalReply` under some circums… |
CVE-2024-45809 | Medium | 5.3 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the foll… |
CVE-2024-45808 | Medium | 6.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unex… |
CVE-2024-45807 | High | 7.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are potential bugs ar… |
CVE-2024-45806 | Medium | 6.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, pote… |
CVE-2024-9008 | Medium | 6.3 | 2024-09-19 | A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. This vulnerability affects unknown code of the file /news-detai… |
CVE-2024-9007 | Low | 3.5 | 2024-09-19 | A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulati… |
CVE-2024-9006 | Medium | 6.3 | 2024-09-19 | A vulnerability was found in jeanmarc77 123solar 1.8.4.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file confi… |
CVE-2024-46984 | High | 8.6 | 2024-09-19 | The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location rou… |
CVE-2024-46983 | Critical | 9.8 | 2024-09-19 | sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict dese… |
CVE-2024-45614 | Medium | 5.4 | 2024-09-19 | Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) b… |
CVE-2024-45410 | Critical | 9.8 | 2024-09-19 | Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-… |
CVE-2024-9004 | Medium | 6.3 | 2024-09-19 | A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/DBManage/Backup_Serv… |
CVE-2024-9003 | Medium | 4.3 | 2024-09-19 | A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController o… |
CVE-2024-43496 | Medium | 6.5 | 2024-09-19 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43489 | Medium | 6.5 | 2024-09-19 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-38221 | Medium | 4.3 | 2024-09-19 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-9001 | Medium | 6.3 | 2024-09-19 | A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file… |
CVE-2024-40125 | Critical | 9.8 | 2024-09-19 | An arbitrary file upload vulnerability in the Media Manager function of Closed-Loop Technology CLESS Server v4.5.2 allows attackers to execute arbitrary code v… |
CVE-2024-33109 | Critical | 9.9 | 2024-09-19 | Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via t… |
CVE-2024-25673 | Medium | 6.1 | 2024-09-19 | Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection. |
CVE-2024-8963 | Critical | 9.4 | 2024-09-19 | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. |
CVE-2024-47162 | Medium | 4.1 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page |
CVE-2024-47160 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible |
CVE-2024-47159 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project |
CVE-2024-8653 | Medium | 6.1 | 2024-09-19 | A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific paths on the site. This issue affects… |
CVE-2024-8652 | Medium | 6.1 | 2024-09-19 | A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific path on the site. This issue affects N… |
CVE-2024-8651 | Medium | 5.3 | 2024-09-19 | A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which… |
CVE-2024-38016 | High | 7.8 | 2024-09-19 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2024-31570 | Critical | 9.8 | 2024-09-19 | libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file. |
CVE-2024-8883 | Medium | 6.1 | 2024-09-19 | A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http… |
CVE-2024-8698 | High | 7.7 | 2024-09-19 | A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is… |
CVE-2024-8375 | High | 7.8 | 2024-09-19 | There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a… |
CVE-2024-7737 | High | 8.7 | 2024-09-19 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an a… |
CVE-2024-7736 | High | 8.7 | 2024-09-19 | A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPER… |
CVE-2024-45862 | High | 7.5 | 2024-09-19 | Kastle Systems firmware prior to May 1, 2024, stored machine credentials in cleartext, which may allow an attacker to access sensitive information. |
CVE-2024-45861 | High | 7.5 | 2024-09-19 | Kastle Systems firmware prior to May 1, 2024, contained a hard-coded credential, which if accessed may allow an attacker to access sensitive information. |
CVE-2024-45752 | High | 8.5 | 2024-09-19 | logiops through 0.3.4, in its default configuration, allows any unprivileged user to configure its logid daemon via an unrestricted D-Bus service, including se… |
CVE-2024-7785 | | 2024-09-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ece Software Electronic Ticket System allows Refle… | |
CVE-2024-46394 | High | 8.8 | 2024-09-19 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/?/user/add |
CVE-2024-46382 | High | 7.5 | 2024-09-19 | A SQL injection vulnerability in linlinjava litemall 1.8.0 allows a remote attacker to obtain sensitive information via the goodsId, goodsSn, and name paramete… |
CVE-2024-8986 | | 2024-09-19 | The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved… | |
CVE-2024-8354 | Medium | 5.5 | 2024-09-19 | A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device… |
CVE-2024-45770 | Medium | 4.4 | 2024-09-19 | A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The iss… |
CVE-2024-45769 | Medium | 5.5 | 2024-09-19 | A vulnerability was found in Performance Co-Pilot (PCP). This flaw allows an attacker to send specially crafted data to the system, which could cause the prog… |
CVE-2024-47089 | Medium | 6.5 | 2024-09-19 | This vulnerability exists in the Apex Softcell LD Geo due to improper validation of the transaction token ID in the API endpoint. An authenticated remote attac… |
CVE-2024-47088 | Critical | 9.8 | 2024-09-19 | This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote att… |
CVE-2024-47087 | Medium | 6.5 | 2024-09-19 | This vulnerability exists in Apex Softcell LD Geo due to improper validation of the certain parameters (Client ID, DPID or BOID) in the API endpoint. An authen… |
CVE-2024-47086 | Medium | 6.5 | 2024-09-19 | This vulnerability exists in Apex Softcell LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpoints. An authentica… |
CVE-2024-47085 | Medium | 6.5 | 2024-09-19 | This vulnerability exists in Apex Softcell LD DP Back Office due to improper validation of certain parameters (cCdslClicentcode and cLdClientCode) in the API e… |