2024 CVEs (page 174)
Page 174 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6840 | Medium | 6.6 | 2024-09-12 | An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with… |
CVE-2024-6446 | Low | 3.5 | 2024-09-12 | An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could… |
CVE-2024-6389 | Medium | 4.3 | 2024-09-12 | An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a g… |
CVE-2024-5435 | Medium | 4.5 | 2024-09-12 | An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5… |
CVE-2024-4660 | Medium | 6.5 | 2024-09-12 | An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions… |
CVE-2024-4612 | Medium | 6.4 | 2024-09-12 | An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain co… |
CVE-2024-2743 | Medium | 5.3 | 2024-09-12 | An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modif… |
CVE-2024-6702 | Medium | 5.2 | 2024-09-12 | Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage. |
CVE-2024-6701 | Medium | 5.5 | 2024-09-12 | Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type. |
CVE-2024-6700 | Medium | 5.5 | 2024-09-12 | Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name. |
CVE-2024-6658 | High | 8.4 | 2024-09-12 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects: Product Affected… |
CVE-2024-6510 | High | 7.8 | 2024-09-12 | Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking. |
CVE-2024-45826 | Medium | 6.8 | 2024-09-12 | CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a craft… |
CVE-2024-45825 | High | 7.5 | 2024-09-12 | CVE-2024-45825 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the… |
CVE-2024-45823 | High | 8.1 | 2024-09-12 | CVE-2024-45823 IMPACT An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts… |
CVE-2024-42484 | Medium | 6.5 | 2024-09-12 | ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An Out-of-Bound (OOB) vulnerability was discovered in the implementation of the ESP-N… |
CVE-2024-42483 | Medium | 6.5 | 2024-09-12 | ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW b… |
CVE-2024-45824 | Critical | 9.8 | 2024-09-12 | CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products. The vulnerability occurs when chained with Path Traversal, Command Inject… |
CVE-2024-40457 | Critical | 9.1 | 2024-09-12 | No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext… |
CVE-2024-28991 | Critical | 9.0 | 2024-09-12 | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an au… |
CVE-2024-28990 | Medium | 6.3 | 2024-09-12 | SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would… |
CVE-2024-45857 | High | 7.8 | 2024-09-12 | Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrar… |
CVE-2024-45856 | Critical | 9.0 | 2024-09-12 | A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enume… |
CVE-2024-45855 | High | 7.1 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arb… |
CVE-2024-45854 | High | 7.1 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arb… |
CVE-2024-45853 | High | 7.1 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arb… |
CVE-2024-45852 | High | 8.8 | 2024-09-12 | Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code… |
CVE-2024-45851 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45850 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45849 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45848 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on th… |
CVE-2024-45847 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on… |
CVE-2024-45846 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on th… |
CVE-2024-3306 | High | 7.5 | 2024-09-12 | Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-3305 | High | 7.5 | 2024-09-12 | Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data. … |
CVE-2024-27321 | High | 7.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification t… |
CVE-2024-27320 | High | 7.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle… |
CVE-2024-8750 | Medium | 5.4 | 2024-09-12 | Cross-site Scripting (XSS) vulnerability in idoit pro version 28. This vulnerability allows an attacker to retrieve session details of an authenticated user du… |
CVE-2024-8749 | High | 8.8 | 2024-09-12 | SQL injection vulnerability in idoit pro version 28. This vulnerability could allow an attacker to send a specially crafted query to the ID parameter in /var/w… |
CVE-2024-8622 | Medium | 6.1 | 2024-09-12 | The amCharts: Charts and Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'amcharts_javascript' parameter in all versions up t… |
CVE-2024-8529 | Critical | 10.0 | 2024-09-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-co… |
CVE-2024-8522 | Critical | 10.0 | 2024-09-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/cours… |
CVE-2024-2010 | Medium | 6.1 | 2024-09-12 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in TE Informatics V5 allows Reflected XSS. This issue affects V5… |
CVE-2024-8056 | Medium | 6.1 | 2024-09-12 | The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which coul… |
CVE-2024-8054 | Medium | 6.1 | 2024-09-12 | The MM-Breaking News WordPress plugin through 0.7.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2024-7862 | Medium | 6.5 | 2024-09-12 | The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers… |
CVE-2024-7861 | Medium | 6.1 | 2024-09-12 | The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-7860 | Medium | 6.1 | 2024-09-12 | The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could… |
CVE-2024-7859 | Medium | 6.5 | 2024-09-12 | The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-7822 | Medium | 6.1 | 2024-09-12 | The Quick Code WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2024-7820 | Medium | 6.5 | 2024-09-12 | The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2024-7818 | Medium | 6.1 | 2024-09-12 | The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could all… |
CVE-2024-7817 | Medium | 6.5 | 2024-09-12 | The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbi… |
CVE-2024-7816 | Medium | 6.1 | 2024-09-12 | The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2024-7766 | High | 7.2 | 2024-09-12 | The Adicon Server WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL inje… |
CVE-2024-6887 | Medium | 4.8 | 2024-09-12 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high… |
CVE-2024-6019 | Medium | 6.1 | 2024-09-12 | The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform… |
CVE-2024-6018 | Medium | 6.1 | 2024-09-12 | The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which c… |
CVE-2024-6017 | Medium | 6.1 | 2024-09-12 | The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could al… |
CVE-2024-5799 | Medium | 4.8 | 2024-09-12 | The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privilege users such as C… |
CVE-2024-3163 | Medium | 4.3 | 2024-09-12 | The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged… |
CVE-2024-45624 | High | 7.5 | 2024-09-12 | Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized fo… |
CVE-2024-8711 | Medium | 5.3 | 2024-09-12 | A vulnerability, which was classified as problematic, has been found in SourceCodester Food Ordering Management System 1.0. Affected by this issue is some unkn… |
CVE-2024-8710 | Medium | 6.3 | 2024-09-12 | A vulnerability classified as critical was found in code-projects Inventory Management 1.0. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2024-8709 | Medium | 6.3 | 2024-09-12 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. Affected is the function delete_user/save_user… |
CVE-2024-38222 | Medium | 6.5 | 2024-09-12 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-8708 | Low | 3.5 | 2024-09-12 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0. It has been rated as problematic. This issue affects some unknown processi… |
CVE-2024-37397 | High | 8.2 | 2024-09-12 | An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthen… |
CVE-2024-34785 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-34783 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-34779 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32848 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32846 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32845 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32843 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32842 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32840 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-29847 | Critical | 9.8 | 2024-09-12 | Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to a… |
CVE-2024-8707 | Medium | 4.3 | 2024-09-12 | A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function do… |
CVE-2024-8706 | Medium | 4.3 | 2024-09-12 | A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/upda… |
CVE-2024-28981 | High | 8.5 | 2024-09-12 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadat… |
CVE-2024-8705 | Medium | 6.3 | 2024-09-11 | A vulnerability was found in Shandong Star Measurement and Control Equipment Heating Network Wireless Monitoring System 5.6.2 and classified as critical. Affec… |
CVE-2024-7890 | High | 7.3 | 2024-09-11 | Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
CVE-2024-7889 | High | 7.3 | 2024-09-11 | Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
CVE-2024-8694 | Low | 3.8 | 2024-09-11 | A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/updat… |
CVE-2024-8693 | Low | 2.4 | 2024-09-11 | A vulnerability, which was classified as problematic, has been found in Kaon CG3000 1.01.43. Affected by this issue is some unknown functionality of the compon… |
CVE-2024-8692 | Medium | 5.3 | 2024-09-11 | A vulnerability classified as critical was found in TDuckCloud TDuckPro up to 6.3. Affected by this vulnerability is an unknown functionality. The manipulation… |
CVE-2024-44541 | Critical | 9.8 | 2024-09-11 | evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin." |
CVE-2024-42760 | High | 7.5 | 2024-09-11 | SQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain sensitive information via the /api/mob/instrucao/conta/destinatarios com… |
CVE-2024-8691 | High | 7.1 | 2024-09-11 | A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another G… |
CVE-2024-8690 | Medium | 4.4 | 2024-09-11 | A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disa… |
CVE-2024-8689 | | 2024-09-11 | A problem with the ActiveMQ integration for both Cortex XSOAR and Cortex XSIAM can result in the cleartext exposure of the configured ActiveMQ credentials in l… | |
CVE-2024-8688 | Medium | 4.4 | 2024-09-11 | An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated administrators… |
CVE-2024-8687 | High | 7.1 | 2024-09-11 | An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalPro… |
CVE-2024-8686 | High | 7.2 | 2024-09-11 | A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary… |
CVE-2024-8097 | | 2024-09-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted… | |
CVE-2024-44577 | High | 8.8 | 2024-09-11 | RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the time_date function. |
CVE-2024-44575 | Low | 3.7 | 2024-09-11 | RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies… |
CVE-2024-44574 | High | 8.8 | 2024-09-11 | RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the sys_conf function. |
CVE-2024-44573 | Medium | 4.7 | 2024-09-11 | A stored cross-site scripting (XSS) vulnerability in the VLAN configuration of RELY-PCIe v22.2.1 to v23.1.0 allows attackers to execute arbitrary web scripts o… |