2024 CVEs (page 167)
Page 167 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47160 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible |
CVE-2024-47159 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project |
CVE-2024-8653 | Medium | 6.1 | 2024-09-19 | A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific paths on the site. This issue affects… |
CVE-2024-8652 | Medium | 6.1 | 2024-09-19 | A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific path on the site. This issue affects N… |
CVE-2024-8651 | Medium | 5.3 | 2024-09-19 | A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which… |
CVE-2024-38016 | High | 7.8 | 2024-09-19 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2024-31570 | Critical | 9.8 | 2024-09-19 | libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file. |
CVE-2024-8883 | Medium | 6.1 | 2024-09-19 | A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http… |
CVE-2024-8698 | High | 7.7 | 2024-09-19 | A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is… |
CVE-2024-8375 | High | 7.8 | 2024-09-19 | There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a… |
CVE-2024-7737 | High | 8.7 | 2024-09-19 | A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an a… |
CVE-2024-7736 | High | 8.7 | 2024-09-19 | A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPER… |
CVE-2024-45862 | High | 7.5 | 2024-09-19 | Kastle Systems firmware prior to May 1, 2024, stored machine credentials in cleartext, which may allow an attacker to access sensitive information. |
CVE-2024-45861 | High | 7.5 | 2024-09-19 | Kastle Systems firmware prior to May 1, 2024, contained a hard-coded credential, which if accessed may allow an attacker to access sensitive information. |
CVE-2024-45752 | High | 8.5 | 2024-09-19 | logiops through 0.3.4, in its default configuration, allows any unprivileged user to configure its logid daemon via an unrestricted D-Bus service, including se… |
CVE-2024-7785 | | 2024-09-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ece Software Electronic Ticket System allows Refle… | |
CVE-2024-46394 | High | 8.8 | 2024-09-19 | FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/?/user/add |
CVE-2024-46382 | High | 7.5 | 2024-09-19 | A SQL injection vulnerability in linlinjava litemall 1.8.0 allows a remote attacker to obtain sensitive information via the goodsId, goodsSn, and name paramete… |
CVE-2024-8986 | | 2024-09-19 | The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved… | |
CVE-2024-8354 | Medium | 5.5 | 2024-09-19 | A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device… |
CVE-2024-45770 | Medium | 4.4 | 2024-09-19 | A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The iss… |
CVE-2024-45769 | Medium | 5.5 | 2024-09-19 | A vulnerability was found in Performance Co-Pilot (PCP). This flaw allows an attacker to send specially crafted data to the system, which could cause the prog… |
CVE-2024-47089 | Medium | 6.5 | 2024-09-19 | This vulnerability exists in the Apex Softcell LD Geo due to improper validation of the transaction token ID in the API endpoint. An authenticated remote attac… |
CVE-2024-47088 | Critical | 9.8 | 2024-09-19 | This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote att… |
CVE-2024-47087 | Medium | 6.5 | 2024-09-19 | This vulnerability exists in Apex Softcell LD Geo due to improper validation of the certain parameters (Client ID, DPID or BOID) in the API endpoint. An authen… |
CVE-2024-47086 | Medium | 6.5 | 2024-09-19 | This vulnerability exists in Apex Softcell LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpoints. An authentica… |
CVE-2024-47085 | Medium | 6.5 | 2024-09-19 | This vulnerability exists in Apex Softcell LD DP Back Office due to improper validation of certain parameters (cCdslClicentcode and cLdClientCode) in the API e… |
CVE-2024-46946 | Critical | 9.8 | 2024-09-19 | langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which… |
CVE-2024-8850 | Medium | 6.1 | 2024-09-19 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a placeholder such as {e… |
CVE-2024-8364 | Medium | 6.4 | 2024-09-19 | The WP Custom Fields Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfs-preset shortcode in all versions up to, an… |
CVE-2024-7254 | High | 7.5 | 2024-09-19 | Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the… |
CVE-2024-47059 | Medium | 4.3 | 2024-09-18 | When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an in… |
CVE-2024-37406 | High | 7.5 | 2024-09-18 | In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, which may lead to domain confusion. |
CVE-2024-47058 | Low | 2.9 | 2024-09-18 | With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from t… |
CVE-2024-47050 | Medium | 5.4 | 2024-09-18 | Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable. |
CVE-2024-46377 | Critical | 9.8 | 2024-09-18 | Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/admin_class.php. |
CVE-2024-46376 | Critical | 9.8 | 2024-09-18 | Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the update_account() function of the file rental/admin_class.php. |
CVE-2024-46375 | Critical | 9.8 | 2024-09-18 | Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup() function of the file rental/admin_class.php. |
CVE-2024-46374 | Critical | 9.8 | 2024-09-18 | Best House Rental Management System 1.0 contains a SQL injection vulnerability in the delete_category() function of the file rental/admin_class.php. |
CVE-2024-46373 | High | 8.8 | 2024-09-18 | Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend. |
CVE-2024-46372 | Medium | 6.1 | 2024-09-18 | DedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement management module. |
CVE-2024-40568 | Critical | 9.8 | 2024-09-18 | Buffer Overflow vulnerability in btstack mesh commit before v.864e2f2b6b7878c8fab3cf5ee84ae566e3380c58 allows a remote attacker to execute arbitrary code via t… |
CVE-2024-44589 | High | 8.8 | 2024-09-18 | Stack overflow vulnerability in the Login function in the HNAP service in D-Link DCS-960L with firmware 1.09 allows attackers to execute of arbitrary code. |
CVE-2024-43025 | Medium | 6.1 | 2024-09-18 | An HTML injection vulnerability in RWS MultiTrans v7.0.23324.2 and earlier allows attackers to alter the HTML-layout and possibly execute a phishing attack via… |
CVE-2024-43024 | Medium | 6.1 | 2024-09-18 | Multiple stored cross-site scripting (XSS) vulnerabilities in RWS MultiTrans v7.0.23324.2 and earlier allow attackers to execute arbitrary web scripts or HTML… |
CVE-2024-39339 | High | 7.5 | 2024-09-18 | A vulnerability has been discovered in all versions of Smartplay headunits, which are widely used in Suzuki and Toyota cars. This misconfiguration can lead to… |
CVE-2024-8287 | High | 7.5 | 2024-09-18 | Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must b… |
CVE-2024-34057 | High | 7.5 | 2024-09-18 | Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing received messages. The resulting buffer o… |
CVE-2024-46989 | Low | 3.7 | 2024-09-18 | spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over… |
CVE-2024-46987 | High | 7.7 | 2024-09-18 | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's downlo… |
CVE-2024-46986 | Critical | 9.9 | 2024-09-18 | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method… |
CVE-2024-46979 | Medium | 5.3 | 2024-09-18 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of… |
CVE-2024-46978 | Medium | 6.5 | 2024-09-18 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notific… |
CVE-2024-46959 | Medium | 6.5 | 2024-09-18 | runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1 URI via the rtsp:/… |
CVE-2024-45601 | High | 7.5 | 2024-09-18 | Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially all… |
CVE-2024-45523 | Critical | 9.1 | 2024-09-18 | An issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.5.x before 12.5.2.35950, 12.6.x before 1… |
CVE-2024-34399 | Critical | 9.8 | 2024-09-18 | **UNSUPPORTED WHEN ASSIGNED** An issue was discovered in BMC Remedy Mid Tier 7.6.04. An unauthenticated remote attacker is able to access any user account with… |
CVE-2024-46990 | Medium | 5.0 | 2024-09-18 | Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filte… |
CVE-2024-45813 | Medium | 5.3 | 2024-09-18 | find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework i… |
CVE-2024-45298 | Medium | 4.3 | 2024-09-18 | Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function. While setting up S… |
CVE-2024-46086 | High | 8.8 | 2024-09-18 | FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/delete/123 |
CVE-2024-6878 | | 2024-09-18 | Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common Resource Locations. This issue affect… | |
CVE-2024-6877 | Medium | 6.1 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Reflected XSS. This is… |
CVE-2024-5960 | Critical | 9.8 | 2024-09-18 | Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials. This issue affects Panel: before v2.3.24. |
CVE-2024-5959 | Medium | 5.4 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Stored XSS. This issue… |
CVE-2024-5958 | High | 8.8 | 2024-09-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through… |
CVE-2024-46598 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This vulnerability allows attackers to caus… |
CVE-2024-46597 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46596 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi. This vulnerability allows attackers to cause a Deni… |
CVE-2024-46595 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46594 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x00.cgi. This vulnerability allows attackers to ca… |
CVE-2024-46593 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46592 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt_5g%d parameter at v2x00.cgi. This vulnerability allows attackers to… |
CVE-2024-46591 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sDnsPro parameter at v2x00.cgi. This vulnerability allows attackers to cause a D… |
CVE-2024-46590 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt%d parameter at v2x00.cgi. This vulnerability allows attackers to cau… |
CVE-2024-46589 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sIpv6AiccuUser parameter at inetipv6.cgi. This vulnerability allows attackers to… |
CVE-2024-46588 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw.cgi. This vulnerability allows attackers to caus… |
CVE-2024-46586 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46585 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at usergrp.cgi. This vulnerability allows attackers to ca… |
CVE-2024-46584 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontrol.cgi. This vulnerability allows attackers to ca… |
CVE-2024-46583 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46582 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvAddr parameter at v2x00.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46581 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfName parameter at v2x00.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46580 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denia… |
CVE-2024-46571 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46568 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi. This vulnerability allows attackers to cause a Den… |
CVE-2024-46567 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iProfileIdx parameter at v2x00.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46566 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46565 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvName parameter at service.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46564 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to ca… |
CVE-2024-46561 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46560 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi. This vulnerability allows attackers to cause a D… |
CVE-2024-46559 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to caus… |
CVE-2024-46558 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46557 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to caus… |
CVE-2024-46556 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00.cgi. This vulnerability allows attackers to caus… |
CVE-2024-46555 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial… |
CVE-2024-46554 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46553 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46552 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability allows attackers to cau… |