2024 CVEs (page 174)
Page 174 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8533 | High | 8.8 | 2024-09-12 | A privilege escalation vulnerability exists in the Rockwell Automation affected products. The vulnerability occurs due to improper default file permissions all… |
CVE-2024-6077 | High | 7.5 | 2024-09-12 | A denial-of-service vulnerability exists in the Rockwell Automation affected products when specially crafted packets are sent to the CIP Security Object. If ex… |
CVE-2024-45607 | Medium | 5.8 | 2024-09-12 | whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRe… |
CVE-2024-44460 | High | 7.5 | 2024-09-12 | An invalid read size in Nanomq v0.21.9 allows attackers to cause a Denial of Service (DoS). |
CVE-2024-44459 | High | 7.5 | 2024-09-12 | A memory allocation issue in vernemq v2.0.1 allows attackers to cause a Denial of Service (DoS) via excessive memory consumption. |
CVE-2024-20430 | High | 7.3 | 2024-09-12 | A vulnerability in Cisco Meraki Systems Manager (SM) Agent for Windows could allow an authenticated, local attacker to execute arbitrary code with elevated pri… |
CVE-2024-8641 | Medium | 6.7 | 2024-09-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3… |
CVE-2024-8311 | Medium | 6.5 | 2024-09-12 | An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authe… |
CVE-2024-6678 | Critical | 9.9 | 2024-09-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 p… |
CVE-2024-4472 | Medium | 4.0 | 2024-09-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 p… |
CVE-2024-45383 | Medium | 5.0 | 2024-09-12 | A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 (WinBuild.160101… |
CVE-2024-45303 | Medium | 6.1 | 2024-09-12 | Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to… |
CVE-2024-45182 | Medium | 5.5 | 2024-09-12 | An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70 An improper bounds check allows specially crafted packets to… |
CVE-2024-45181 | High | 7.8 | 2024-09-12 | An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70. An improper bounds check allows crafted packets to cause an… |
CVE-2024-36066 | Low | 3.1 | 2024-09-12 | The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might m… |
CVE-2024-34336 | Medium | 5.3 | 2024-09-12 | User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the serv… |
CVE-2024-34335 | Medium | 6.1 | 2024-09-12 | ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login page. |
CVE-2024-34334 | High | 7.5 | 2024-09-12 | ORDAT FOSS-Online before v2.24.01 was discovered to contain a SQL injection vulnerability via the forgot password function. |
CVE-2024-25270 | Medium | 4.3 | 2024-09-12 | An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulnerability by manipulating the ID paramete… |
CVE-2024-8696 | Critical | 9.8 | 2024-09-12 | A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop befo… |
CVE-2024-8695 | Critical | 9.8 | 2024-09-12 | A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34… |
CVE-2024-41629 | Medium | 5.5 | 2024-09-12 | An issue in Texas Instruments Fusion Digital Power Designer v.7.10.1 allows a local attacker to obtain sensitive information via the plaintext storage of crede… |
CVE-2024-8754 | Medium | 6.4 | 2024-09-12 | An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper in… |
CVE-2024-8640 | High | 8.5 | 2024-09-12 | An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2… |
CVE-2024-8635 | High | 7.7 | 2024-09-12 | A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and… |
CVE-2024-8631 | Medium | 5.5 | 2024-09-12 | A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17… |
CVE-2024-8124 | High | 7.5 | 2024-09-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior… |
CVE-2024-6840 | Medium | 6.6 | 2024-09-12 | An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with… |
CVE-2024-6446 | Low | 3.5 | 2024-09-12 | An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could… |
CVE-2024-6389 | Medium | 4.3 | 2024-09-12 | An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a g… |
CVE-2024-5435 | Medium | 4.5 | 2024-09-12 | An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5… |
CVE-2024-4660 | Medium | 6.5 | 2024-09-12 | An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions… |
CVE-2024-4612 | Medium | 6.4 | 2024-09-12 | An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain co… |
CVE-2024-2743 | Medium | 5.3 | 2024-09-12 | An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modif… |
CVE-2024-6702 | Medium | 5.2 | 2024-09-12 | Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage. |
CVE-2024-6701 | Medium | 5.5 | 2024-09-12 | Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type. |
CVE-2024-6700 | Medium | 5.5 | 2024-09-12 | Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name. |
CVE-2024-6658 | High | 8.4 | 2024-09-12 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects: Product Affected… |
CVE-2024-6510 | High | 7.8 | 2024-09-12 | Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking. |
CVE-2024-45826 | Medium | 6.8 | 2024-09-12 | CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a craft… |
CVE-2024-45825 | High | 7.5 | 2024-09-12 | CVE-2024-45825 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the… |
CVE-2024-45823 | High | 8.1 | 2024-09-12 | CVE-2024-45823 IMPACT An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts… |
CVE-2024-42484 | Medium | 6.5 | 2024-09-12 | ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An Out-of-Bound (OOB) vulnerability was discovered in the implementation of the ESP-N… |
CVE-2024-42483 | Medium | 6.5 | 2024-09-12 | ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW b… |
CVE-2024-45824 | Critical | 9.8 | 2024-09-12 | CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products. The vulnerability occurs when chained with Path Traversal, Command Inject… |
CVE-2024-40457 | Critical | 9.1 | 2024-09-12 | No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext… |
CVE-2024-28991 | Critical | 9.0 | 2024-09-12 | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an au… |
CVE-2024-28990 | Medium | 6.3 | 2024-09-12 | SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would… |
CVE-2024-45857 | High | 7.8 | 2024-09-12 | Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrar… |
CVE-2024-45856 | Critical | 9.0 | 2024-09-12 | A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enume… |
CVE-2024-45855 | High | 7.1 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arb… |
CVE-2024-45854 | High | 7.1 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arb… |
CVE-2024-45853 | High | 7.1 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arb… |
CVE-2024-45852 | High | 8.8 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code… |
CVE-2024-45851 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45850 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45849 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45848 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on th… |
CVE-2024-45847 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on… |
CVE-2024-45846 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on th… |
CVE-2024-3306 | High | 7.5 | 2024-09-12 | Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-3305 | High | 7.5 | 2024-09-12 | Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data. … |
CVE-2024-27321 | High | 7.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification t… |
CVE-2024-27320 | High | 7.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle… |
CVE-2024-8750 | Medium | 5.4 | 2024-09-12 | Cross-site Scripting (XSS) vulnerability in idoit pro version 28. This vulnerability allows an attacker to retrieve session details of an authenticated user du… |
CVE-2024-8749 | High | 8.8 | 2024-09-12 | SQL injection vulnerability in idoit pro version 28. This vulnerability could allow an attacker to send a specially crafted query to the ID parameter in /var/w… |
CVE-2024-8622 | Medium | 6.1 | 2024-09-12 | The amCharts: Charts and Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'amcharts_javascript' parameter in all versions up t… |
CVE-2024-8529 | Critical | 10.0 | 2024-09-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-co… |
CVE-2024-8522 | Critical | 10.0 | 2024-09-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/cours… |
CVE-2024-2010 | Medium | 6.1 | 2024-09-12 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in TE Informatics V5 allows Reflected XSS. This issue affects V5… |
CVE-2024-8056 | Medium | 6.1 | 2024-09-12 | The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which coul… |
CVE-2024-8054 | Medium | 6.1 | 2024-09-12 | The MM-Breaking News WordPress plugin through 0.7.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2024-7862 | Medium | 6.5 | 2024-09-12 | The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers… |
CVE-2024-7861 | Medium | 6.1 | 2024-09-12 | The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-7860 | Medium | 6.1 | 2024-09-12 | The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could… |
CVE-2024-7859 | Medium | 6.5 | 2024-09-12 | The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-7822 | Medium | 6.1 | 2024-09-12 | The Quick Code WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2024-7820 | Medium | 6.5 | 2024-09-12 | The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2024-7818 | Medium | 6.1 | 2024-09-12 | The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could all… |
CVE-2024-7817 | Medium | 6.5 | 2024-09-12 | The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbi… |
CVE-2024-7816 | Medium | 6.1 | 2024-09-12 | The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2024-7766 | High | 7.2 | 2024-09-12 | The Adicon Server WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL inje… |
CVE-2024-6887 | Medium | 4.8 | 2024-09-12 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high… |
CVE-2024-6019 | Medium | 6.1 | 2024-09-12 | The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform… |
CVE-2024-6018 | Medium | 6.1 | 2024-09-12 | The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which c… |
CVE-2024-6017 | Medium | 6.1 | 2024-09-12 | The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could al… |
CVE-2024-5799 | Medium | 4.8 | 2024-09-12 | The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privilege users such as C… |
CVE-2024-3163 | Medium | 4.3 | 2024-09-12 | The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged… |
CVE-2024-45624 | High | 7.5 | 2024-09-12 | Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized fo… |
CVE-2024-8711 | Medium | 5.3 | 2024-09-12 | A vulnerability, which was classified as problematic, has been found in SourceCodester Food Ordering Management System 1.0. Affected by this issue is some unkn… |
CVE-2024-8710 | Medium | 6.3 | 2024-09-12 | A vulnerability classified as critical was found in code-projects Inventory Management 1.0. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2024-8709 | Medium | 6.3 | 2024-09-12 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. Affected is the function delete_user/save_user… |
CVE-2024-38222 | Medium | 6.5 | 2024-09-12 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-8708 | Low | 3.5 | 2024-09-12 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0. It has been rated as problematic. This issue affects some unknown processi… |
CVE-2024-37397 | High | 8.2 | 2024-09-12 | An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthen… |
CVE-2024-34785 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-34783 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-34779 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32848 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32846 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |