2024 CVEs (page 167)
Page 167 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46946 | Critical | 9.8 | 2024-09-19 | langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which… |
CVE-2024-8850 | Medium | 6.1 | 2024-09-19 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a placeholder such as {e… |
CVE-2024-8364 | Medium | 6.4 | 2024-09-19 | The WP Custom Fields Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfs-preset shortcode in all versions up to, an… |
CVE-2024-7254 | High | 7.5 | 2024-09-19 | Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the… |
CVE-2024-47059 | Medium | 4.3 | 2024-09-18 | When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an in… |
CVE-2024-37406 | High | 7.5 | 2024-09-18 | In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, which may lead to domain confusion. |
CVE-2024-47058 | Low | 2.9 | 2024-09-18 | With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from t… |
CVE-2024-47050 | Medium | 5.4 | 2024-09-18 | Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable. |
CVE-2024-46377 | Critical | 9.8 | 2024-09-18 | Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/admin_class.php. |
CVE-2024-46376 | Critical | 9.8 | 2024-09-18 | Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the update_account() function of the file rental/admin_class.php. |
CVE-2024-46375 | Critical | 9.8 | 2024-09-18 | Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup() function of the file rental/admin_class.php. |
CVE-2024-46374 | Critical | 9.8 | 2024-09-18 | Best House Rental Management System 1.0 contains a SQL injection vulnerability in the delete_category() function of the file rental/admin_class.php. |
CVE-2024-46373 | High | 8.8 | 2024-09-18 | Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend. |
CVE-2024-46372 | Medium | 6.1 | 2024-09-18 | DedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement management module. |
CVE-2024-40568 | Critical | 9.8 | 2024-09-18 | Buffer Overflow vulnerability in btstack mesh commit before v.864e2f2b6b7878c8fab3cf5ee84ae566e3380c58 allows a remote attacker to execute arbitrary code via t… |
CVE-2024-44589 | High | 8.8 | 2024-09-18 | Stack overflow vulnerability in the Login function in the HNAP service in D-Link DCS-960L with firmware 1.09 allows attackers to execute of arbitrary code. |
CVE-2024-43025 | Medium | 6.1 | 2024-09-18 | An HTML injection vulnerability in RWS MultiTrans v7.0.23324.2 and earlier allows attackers to alter the HTML-layout and possibly execute a phishing attack via… |
CVE-2024-43024 | Medium | 6.1 | 2024-09-18 | Multiple stored cross-site scripting (XSS) vulnerabilities in RWS MultiTrans v7.0.23324.2 and earlier allow attackers to execute arbitrary web scripts or HTML… |
CVE-2024-39339 | High | 7.5 | 2024-09-18 | A vulnerability has been discovered in all versions of Smartplay headunits, which are widely used in Suzuki and Toyota cars. This misconfiguration can lead to… |
CVE-2024-8287 | High | 7.5 | 2024-09-18 | Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must b… |
CVE-2024-34057 | High | 7.5 | 2024-09-18 | Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing received messages. The resulting buffer o… |
CVE-2024-46989 | Low | 3.7 | 2024-09-18 | spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over… |
CVE-2024-46987 | High | 7.7 | 2024-09-18 | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's downlo… |
CVE-2024-46986 | Critical | 9.9 | 2024-09-18 | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method… |
CVE-2024-46979 | Medium | 5.3 | 2024-09-18 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of… |
CVE-2024-46978 | Medium | 6.5 | 2024-09-18 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notific… |
CVE-2024-46959 | Medium | 6.5 | 2024-09-18 | runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1 URI via the rtsp:/… |
CVE-2024-45601 | High | 7.5 | 2024-09-18 | Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially all… |
CVE-2024-45523 | Critical | 9.1 | 2024-09-18 | An issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.5.x before 12.5.2.35950, 12.6.x before 1… |
CVE-2024-34399 | Critical | 9.8 | 2024-09-18 | **UNSUPPORTED WHEN ASSIGNED** An issue was discovered in BMC Remedy Mid Tier 7.6.04. An unauthenticated remote attacker is able to access any user account with… |
CVE-2024-46990 | Medium | 5.0 | 2024-09-18 | Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filte… |
CVE-2024-45813 | Medium | 5.3 | 2024-09-18 | find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework i… |
CVE-2024-45298 | Medium | 4.3 | 2024-09-18 | Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function. While setting up S… |
CVE-2024-46086 | High | 8.8 | 2024-09-18 | FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/delete/123 |
CVE-2024-6878 | | 2024-09-18 | Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common Resource Locations. This issue affect… | |
CVE-2024-6877 | Medium | 6.1 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Reflected XSS. This is… |
CVE-2024-5960 | Critical | 9.8 | 2024-09-18 | Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials. This issue affects Panel: before v2.3.24. |
CVE-2024-5959 | Medium | 5.4 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Stored XSS. This issue… |
CVE-2024-5958 | High | 8.8 | 2024-09-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through… |
CVE-2024-46598 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This vulnerability allows attackers to caus… |
CVE-2024-46597 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46596 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi. This vulnerability allows attackers to cause a Deni… |
CVE-2024-46595 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46594 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x00.cgi. This vulnerability allows attackers to ca… |
CVE-2024-46593 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46592 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt_5g%d parameter at v2x00.cgi. This vulnerability allows attackers to… |
CVE-2024-46591 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sDnsPro parameter at v2x00.cgi. This vulnerability allows attackers to cause a D… |
CVE-2024-46590 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt%d parameter at v2x00.cgi. This vulnerability allows attackers to cau… |
CVE-2024-46589 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sIpv6AiccuUser parameter at inetipv6.cgi. This vulnerability allows attackers to… |
CVE-2024-46588 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw.cgi. This vulnerability allows attackers to caus… |
CVE-2024-46586 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46585 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at usergrp.cgi. This vulnerability allows attackers to ca… |
CVE-2024-46584 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontrol.cgi. This vulnerability allows attackers to ca… |
CVE-2024-46583 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46582 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvAddr parameter at v2x00.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46581 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfName parameter at v2x00.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46580 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denia… |
CVE-2024-46571 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46568 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi. This vulnerability allows attackers to cause a Den… |
CVE-2024-46567 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iProfileIdx parameter at v2x00.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46566 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46565 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvName parameter at service.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46564 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to ca… |
CVE-2024-46561 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46560 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi. This vulnerability allows attackers to cause a D… |
CVE-2024-46559 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to caus… |
CVE-2024-46558 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46557 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to caus… |
CVE-2024-46556 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00.cgi. This vulnerability allows attackers to caus… |
CVE-2024-46555 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial… |
CVE-2024-46554 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46553 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability allows attackers to cause… |
CVE-2024-46552 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability allows attackers to cau… |
CVE-2024-46551 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a… |
CVE-2024-46550 | High | 7.5 | 2024-09-18 | Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to c… |
CVE-2024-45858 | High | 7.8 | 2024-09-18 | An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML f… |
CVE-2024-44542 | Critical | 9.8 | 2024-09-18 | SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.html parameter. |
CVE-2024-39590 | High | 7.5 | 2024-09-18 | Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a36d95b73e7b8722d0edb… |
CVE-2024-39589 | High | 7.5 | 2024-09-18 | Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a36d95b73e7b8722d0edb… |
CVE-2024-36981 | High | 7.5 | 2024-09-18 | An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3 b4702061dc14d1024856f71b4543298d77007b88… |
CVE-2024-36980 | High | 7.5 | 2024-09-18 | An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3 b4702061dc14d1024856f71b4543298d77007b88… |
CVE-2024-35515 | Critical | 9.8 | 2024-09-18 | Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code. |
CVE-2024-34026 | Critical | 9.0 | 2024-09-18 | A stack-based buffer overflow vulnerability exists in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC _v3 b4702061dc14d1024856f71b4543298d77007… |
CVE-2024-8891 | Medium | 5.3 | 2024-09-18 | An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it ind… |
CVE-2024-39081 | Medium | 4.2 | 2024-09-18 | An issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communications. |
CVE-2024-31198 | Medium | 5.3 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |
CVE-2024-31197 | Medium | 5.3 | 2024-09-18 | Improper Null Termination vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routi… |
CVE-2024-31196 | Medium | 5.3 | 2024-09-18 | Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is asso… |
CVE-2024-31195 | Medium | 6.5 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |
CVE-2024-31194 | Medium | 6.5 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |
CVE-2024-31193 | Medium | 6.5 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |
CVE-2024-31192 | Medium | 6.5 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |
CVE-2024-31191 | Medium | 6.5 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |
CVE-2024-31190 | Medium | 6.5 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |
CVE-2024-31189 | Medium | 6.5 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |
CVE-2024-31188 | Medium | 6.5 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |
CVE-2024-31187 | Medium | 6.5 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |
CVE-2024-31186 | Medium | 6.5 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |
CVE-2024-31185 | Medium | 5.3 | 2024-09-18 | Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is asso… |
CVE-2024-31184 | Medium | 6.5 | 2024-09-18 | Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine flui… |