2024 CVEs (page 177)
Page 177 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45412 | Medium | 5.3 | 2024-09-10 | Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach… |
CVE-2024-45407 | Medium | 6.5 | 2024-09-10 | Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an… |
CVE-2024-44815 | Medium | 4.6 | 2024-09-10 | Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash Firmware W25Q64JV. |
CVE-2024-44677 | Critical | 9.8 | 2024-09-10 | eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the DatabaseController.java… |
CVE-2024-44676 | Medium | 4.8 | 2024-09-10 | eladmin v2.7 and before is vulnerable to Cross Site Scripting (XSS) which allows an attacker to execute arbitrary code via LocalStoreController. java. |
CVE-2024-31960 | High | 7.8 | 2024-09-10 | An issue was discovered in Samsung Mobile Processor Exynos 1480, Exynos 2400. The xclipse amdgpu driver has a reference count bug. This can lead to a use after… |
CVE-2024-45393 | Medium | 6.4 | 2024-09-10 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account can access webhoo… |
CVE-2024-45323 | Medium | 4.3 | 2024-09-10 | An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an a… |
CVE-2024-45044 | High | 8.8 | 2024-09-10 | Bareos is open source software for backup, archiving, and recovery of data for operating systems. When a command ACL is in place and a user executes a command… |
CVE-2024-43800 | Medium | 5.0 | 2024-09-10 | serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is… |
CVE-2024-43799 | Medium | 5.0 | 2024-09-10 | Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrust… |
CVE-2024-43796 | Medium | 5.0 | 2024-09-10 | Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute… |
CVE-2024-42423 | Medium | 6.1 | 2024-09-10 | Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. A local… |
CVE-2024-36511 | Low | 3.7 | 2024-09-10 | An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4, 7.2 all versions… |
CVE-2024-35282 | Medium | 4.2 | 2024-09-10 | A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all versio… |
CVE-2024-33508 | High | 7.3 | 2024-09-10 | An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7… |
CVE-2024-31490 | Medium | 4.3 | 2024-09-10 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, For… |
CVE-2024-31489 | Medium | 6.8 | 2024-09-10 | AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 thr… |
CVE-2024-27257 | Medium | 4.3 | 2024-09-10 | IBM OpenPages 8.3 and 9.0 potentially exposes information about client-side source code through use of JavaScript source maps to unauthorized users. |
CVE-2024-25074 | Medium | 5.9 | 2024-09-10 | An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2… |
CVE-2024-25073 | Medium | 5.9 | 2024-09-10 | An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2… |
CVE-2024-23185 | High | 7.5 | 2024-09-10 | Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when… |
CVE-2024-23184 | Medium | 5.0 | 2024-09-10 | Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, a… |
CVE-2024-21753 | Medium | 5.5 | 2024-09-10 | A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13… |
CVE-2024-8654 | Medium | 5.0 | 2024-09-10 | MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This i… |
CVE-2024-8443 | Low | 2.9 | 2024-09-10 | A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to the APDUs… |
CVE-2024-44867 | High | 7.5 | 2024-09-10 | phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php. |
CVE-2024-37728 | High | 7.5 | 2024-09-10 | Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensit… |
CVE-2024-8369 | Medium | 5.3 | 2024-09-10 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to… |
CVE-2024-6282 | Medium | 5.4 | 2024-09-10 | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-7770 | High | 8.8 | 2024-09-10 | The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to m… |
CVE-2024-40754 | Critical | 9.8 | 2024-09-10 | Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0. |
CVE-2024-8645 | Medium | 5.5 | 2024-09-10 | SPRT dissector crash in Wireshark 4.2.0 to 4.0.5 and 4.0.0 to 4.0.15 allows denial of service via packet injection or crafted capture file |
CVE-2024-8543 | Medium | 6.4 | 2024-09-10 | The Slider comparison image before and after plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [sciba] shortcode in all versio… |
CVE-2024-8241 | Medium | 6.4 | 2024-09-10 | The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block… |
CVE-2024-45032 | Critical | 10.0 | 2024-09-10 | A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1). Af… |
CVE-2024-44087 | High | 8.6 | 2024-09-10 | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SP12 Upd3), Automatio… |
CVE-2024-43781 | Medium | 5.5 | 2024-09-10 | A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in connection with using Cr… |
CVE-2024-43647 | High | 7.5 | 2024-09-10 | A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (A… |
CVE-2024-42345 | Medium | 4.3 | 2024-09-10 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP2). The affected application does not properly handle user session e… |
CVE-2024-42344 | Medium | 4.4 | 2024-09-10 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application inserts sensitive information into a lo… |
CVE-2024-41171 | High | 8.8 | 2024-09-10 | A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMER… |
CVE-2024-41170 | High | 7.8 | 2024-09-10 | A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0015), Tecnomatix Plant Simulation V2404 (All versions < V2404.0… |
CVE-2024-37995 | Low | 2.7 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-37994 | Medium | 4.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-37993 | Medium | 5.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-37992 | Medium | 4.9 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-37991 | Medium | 5.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-37990 | Medium | 6.5 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-35783 | Critical | 9.1 | 2024-09-10 | A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Informat… |
CVE-2024-33698 | Critical | 9.8 | 2024-09-10 | A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMA… |
CVE-2024-32006 | Medium | 4.3 | 2024-09-10 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application does not expire the user session on reb… |
CVE-2024-8258 | High | 7.8 | 2024-09-10 | Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute a… |
CVE-2024-7699 | High | 8.8 | 2024-09-10 | An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data. |
CVE-2024-7698 | Medium | 5.7 | 2024-09-10 | A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks. |
CVE-2024-43393 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43392 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43391 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43390 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP enviro… |
CVE-2024-43389 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment… |
CVE-2024-43388 | High | 8.8 | 2024-09-10 | A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation. |
CVE-2024-43387 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mG… |
CVE-2024-43386 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable… |
CVE-2024-43385 | High | 8.8 | 2024-09-10 | A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable… |
CVE-2024-42425 | Low | 3.8 | 2024-09-10 | Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacke… |
CVE-2024-39583 | High | 8.1 | 2024-09-10 | Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker wit… |
CVE-2024-39582 | Low | 2.3 | 2024-09-10 | Dell PowerScale InsightIQ, version 5.0, contain a Use of hard coded Credentials vulnerability. A high privileged attacker with local access could potentially e… |
CVE-2024-39581 | High | 7.3 | 2024-09-10 | Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability. An unauthenticated attacker w… |
CVE-2024-39580 | Medium | 6.7 | 2024-09-10 | Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains an Improper Access Control vulnerability. A high privileged attacker with local access could pote… |
CVE-2024-39574 | Medium | 6.7 | 2024-09-10 | Dell PowerScale InsightIQ, version 5.1, contain an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially… |
CVE-2024-7734 | Medium | 5.3 | 2024-09-10 | An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the… |
CVE-2024-7655 | Medium | 4.4 | 2024-09-10 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all vers… |
CVE-2024-7618 | Medium | 4.4 | 2024-09-10 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘co… |
CVE-2024-6596 | Critical | 9.8 | 2024-09-10 | An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context. |
CVE-2024-42427 | High | 7.6 | 2024-09-10 | Dell ThinOS versions 2402 and 2405, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthent… |
CVE-2024-42424 | Medium | 5.3 | 2024-09-10 | Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Improper Input Validation vulnerability. A high privileged attacker with local access… |
CVE-2024-44072 | Medium | 5.7 | 2024-09-10 | OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a spec… |
CVE-2024-7955 | Medium | 4.8 | 2024-09-10 | The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2024-7891 | Medium | 4.8 | 2024-09-10 | The Floating Contact Button WordPress plugin before 2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-7784 | Medium | 6.1 | 2024-09-10 | During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot… |
CVE-2024-6979 | Medium | 6.8 | 2024-09-10 | Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer account… |
CVE-2024-6509 | Medium | 6.5 | 2024-09-10 | Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource… |
CVE-2024-6173 | Medium | 6.5 | 2024-09-10 | 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowing for an attacker… |
CVE-2024-45504 | Medium | 6.5 | 2024-09-10 | Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hi… |
CVE-2024-45285 | Medium | 5.4 | 2024-09-10 | The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes. By sending a c… |
CVE-2024-45284 | Low | 2.4 | 2024-09-10 | An authenticated attacker with high privilege can use functions of SLCM transactions to which access should be restricted. This may result in an escalation of… |
CVE-2024-45283 | Medium | 6.0 | 2024-09-10 | SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an R… |
CVE-2024-45281 | Medium | 5.8 | 2024-09-10 | SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally s… |
CVE-2024-45280 | Medium | 4.8 | 2024-09-10 | Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limi… |
CVE-2024-45279 | Medium | 6.1 | 2024-09-10 | Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker t… |
CVE-2024-44121 | Medium | 4.3 | 2024-09-10 | Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted… |
CVE-2024-44120 | Medium | 4.7 | 2024-09-10 | SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attac… |
CVE-2024-44117 | Medium | 5.4 | 2024-09-10 | The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook… |
CVE-2024-21528 | Medium | 5.9 | 2024-09-10 | All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sani… |
CVE-2024-0067 | Medium | 4.3 | 2024-09-10 | Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folde… |
CVE-2024-45286 | Medium | 6.5 | 2024-09-10 | Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue Accounting allows una… |
CVE-2024-44112 | Medium | 4.3 | 2024-09-10 | Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative user could call a… |
CVE-2024-41728 | Low | 2.7 | 2024-09-10 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects con… |
CVE-2024-8478 | High | 7.3 | 2024-09-10 | The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due… |
CVE-2024-8268 | High | 8.8 | 2024-09-10 | The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the aj… |