2024 CVEs (page 178)
Page 178 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-44116 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to id… |
CVE-2024-44115 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify u… |
CVE-2024-44114 | Low | 2.0 | 2024-09-10 | SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This resu… |
CVE-2024-44113 | Medium | 4.3 | 2024-09-10 | Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is oth… |
CVE-2024-42380 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each nod… |
CVE-2024-42378 | Medium | 6.1 | 2024-09-10 | Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to… |
CVE-2024-42371 | Medium | 5.4 | 2024-09-10 | The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify u… |
CVE-2024-41729 | Medium | 4.3 | 2024-09-10 | Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On… |
CVE-2024-6342 | Critical | 9.8 | 2024-09-10 | **UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542… |
CVE-2024-38270 | Medium | 5.3 | 2024-09-10 | An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in t… |
CVE-2024-8611 | Medium | 6.3 | 2024-09-09 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-8610 | Low | 3.5 | 2024-09-09 | A vulnerability classified as problematic has been found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file… |
CVE-2024-44411 | Critical | 9.8 | 2024-09-09 | D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function. |
CVE-2024-44410 | Critical | 9.8 | 2024-09-09 | D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function. |
CVE-2024-27365 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos W920… |
CVE-2024-6796 | High | 8.2 | 2024-09-09 | In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker… |
CVE-2024-6795 | Critical | 10.0 | 2024-09-09 | In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthor… |
CVE-2024-44902 | Critical | 9.8 | 2024-09-09 | A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code. |
CVE-2024-44725 | High | 7.2 | 2024-09-09 | AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php. |
CVE-2024-44724 | High | 7.2 | 2024-09-09 | AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsite_url parameter at /admin/site_add.php. This vulnerability allows attac… |
CVE-2024-44085 | Medium | 6.1 | 2024-09-09 | ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expres… |
CVE-2024-42500 | Critical | 9.3 | 2024-09-09 | HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services. |
CVE-2024-27387 | Medium | 6.7 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_rx_range_done_ind()… |
CVE-2024-27383 | Medium | 6.7 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_get_scan_extra_ies(… |
CVE-2024-27368 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380… |
CVE-2024-27367 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exyno… |
CVE-2024-27366 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor, Wearable Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exyn… |
CVE-2024-27364 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos… |
CVE-2024-7341 | High | 7.1 | 2024-09-09 | A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even whe… |
CVE-2024-7318 | Medium | 4.8 | 2024-09-09 | A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead… |
CVE-2024-7260 | Medium | 6.1 | 2024-09-09 | An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to tri… |
CVE-2024-45411 | High | 8.5 | 2024-09-09 | Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sa… |
CVE-2024-45296 | High | 7.5 | 2024-09-09 | path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause… |
CVE-2024-42759 | Medium | 6.3 | 2024-09-09 | An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint. |
CVE-2024-24510 | Medium | 6.1 | 2024-09-09 | Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail componen… |
CVE-2024-44849 | Critical | 9.8 | 2024-09-09 | Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php. |
CVE-2024-44335 | High | 8.8 | 2024-09-09 | D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7… |
CVE-2024-44334 | High | 8.8 | 2024-09-09 | D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 ar… |
CVE-2024-45406 | Medium | 5.5 | 2024-09-09 | Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input. |
CVE-2024-44333 | High | 8.8 | 2024-09-09 | D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 ar… |
CVE-2024-8605 | Medium | 4.3 | 2024-09-09 | A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. This vulnerability affects unknown code of the file /view/regist… |
CVE-2024-8604 | Medium | 4.3 | 2024-09-09 | A vulnerability classified as problematic has been found in SourceCodester Online Food Ordering System 2.0. This affects an unknown part of the file index.php… |
CVE-2024-44721 | Critical | 9.8 | 2024-09-09 | SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php. |
CVE-2024-44720 | High | 7.5 | 2024-09-09 | SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php. |
CVE-2024-8373 | Medium | 4.8 | 2024-09-09 | Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions… |
CVE-2024-8372 | Medium | 4.8 | 2024-09-09 | Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a… |
CVE-2024-8042 | Low | 2.4 | 2024-09-09 | Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local req… |
CVE-2024-45041 | High | 8.3 | 2024-09-09 | External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-ext… |
CVE-2024-40643 | Critical | 9.6 | 2024-09-09 | Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter character will not be cons… |
CVE-2024-7015 | Critical | 9.8 | 2024-09-09 | Missing Authentication for Critical Function vulnerability in Profelis Informatics and Consulting PassBox allows Authentication Abuse. This issue affects Pass… |
CVE-2024-44375 | High | 7.5 | 2024-09-09 | D-Link DI-8100 v16.07.26A1 has a stack overflow vulnerability in the dbsrv_asp function. |
CVE-2024-8601 | Medium | 6.5 | 2024-09-09 | This vulnerability exists in TechExcel Back Office Software versions prior to 1.0.0 due to improper access controls on certain API endpoints. An authenticated… |
CVE-2024-6572 | High | 7.4 | 2024-09-09 | Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' in Checkmk before Checkmk 2.3.0p15, 2.2.0p33, 2.1… |
CVE-2024-37288 | Critical | 9.9 | 2024-09-09 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue o… |
CVE-2024-45203 | Medium | 4.3 | 2024-09-09 | Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS versions prior to 6.74… |
CVE-2024-7918 | Medium | 4.8 | 2024-09-09 | The Pocket Widget WordPress plugin through 0.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-7689 | Medium | 4.3 | 2024-09-09 | The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2024-7688 | Medium | 6.5 | 2024-09-09 | The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin delete arbitrary index… |
CVE-2024-7687 | Medium | 4.3 | 2024-09-09 | The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacker… |
CVE-2024-6910 | Medium | 4.8 | 2024-09-09 | The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform C… |
CVE-2024-5561 | Medium | 4.8 | 2024-09-09 | The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-45625 | Medium | 6.1 | 2024-09-09 | Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on th… |
CVE-2024-8586 | Medium | 6.1 | 2024-09-09 | WebITR from Uniong has an Open Redirect vulnerability, which allows unauthorized remote attackers to exploit this vulnerability to forge URLs. Users, believing… |
CVE-2024-8585 | Medium | 6.5 | 2024-09-09 | Orca HCM from LEARNING DIGITA does not properly restrict a specific parameter of the file download functionality, allowing a remote attacker with regular privi… |
CVE-2024-8584 | Critical | 9.8 | 2024-09-09 | Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an… |
CVE-2024-8583 | Low | 3.5 | 2024-09-08 | A vulnerability was found in SourceCodester Online Bank Management System and Online Bank Management System - 1.0. It has been classified as problematic. This… |
CVE-2024-8582 | Low | 3.5 | 2024-09-08 | A vulnerability was found in SourceCodester Food Ordering Management System 1.0 and classified as problematic. Affected by this issue is some unknown functiona… |
CVE-2024-8580 | High | 8.1 | 2024-09-08 | A vulnerability classified as critical was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. This vulnerability affects unknown code of the file /etc/shadow.s… |
CVE-2024-8579 | High | 8.8 | 2024-09-08 | A vulnerability classified as critical has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. This affects the function setWiFiRepeaterCfg of the file /cg… |
CVE-2024-8578 | High | 8.8 | 2024-09-08 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. It has been rated as critical. Affected by this issue is the function setWiFiMeshName of… |
CVE-2024-8577 | High | 8.8 | 2024-09-08 | A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been declared as critical. Affected by this vulnerabi… |
CVE-2024-8576 | High | 8.8 | 2024-09-08 | A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been classified as critical. Affected is the function… |
CVE-2024-8575 | High | 8.8 | 2024-09-08 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This issue affects the function setWiFiScheduleCfg of the fil… |
CVE-2024-42343 | Medium | 5.3 | 2024-09-08 | Loway - CWE-204: Observable Response Discrepancy |
CVE-2024-42342 | Medium | 4.3 | 2024-09-08 | Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
CVE-2024-42341 | Medium | 6.1 | 2024-09-08 | Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') |
CVE-2024-8574 | Medium | 6.3 | 2024-09-08 | A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This vulnerability affects the function setParentalRules… |
CVE-2024-8573 | High | 8.8 | 2024-09-08 | A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function… |
CVE-2024-8572 | Low | 3.5 | 2024-09-08 | A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of… |
CVE-2024-8571 | Low | 3.5 | 2024-09-08 | A vulnerability was found in erjemin roll_cms up to 1484fe2c4e0805946a7bcf46218509fcb34883a9. It has been classified as problematic. This affects an unknown pa… |
CVE-2024-8570 | Medium | 6.3 | 2024-09-08 | A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of t… |
CVE-2024-6928 | Critical | 9.8 | 2024-09-08 | The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action avail… |
CVE-2024-6925 | Medium | 4.3 | 2024-09-08 | The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2024-6924 | Critical | 9.8 | 2024-09-08 | The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available… |
CVE-2024-6859 | Medium | 5.4 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2024-6856 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-6855 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perf… |
CVE-2024-6853 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins p… |
CVE-2024-6852 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-8569 | High | 7.3 | 2024-09-08 | A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-8568 | Medium | 6.3 | 2024-09-08 | A vulnerability, which was classified as critical, was found in Mini-Tmall up to 20240901. Affected is the function rewardMapper.select of the file tmall/admin… |
CVE-2024-8567 | High | 7.3 | 2024-09-08 | A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0. This issue affects some unknown processing of… |
CVE-2024-8566 | Medium | 4.3 | 2024-09-08 | A vulnerability classified as problematic was found in code-projects Online Shop Store 1.0. This vulnerability affects unknown code of the file /settings.php… |
CVE-2024-8565 | High | 7.3 | 2024-09-07 | A vulnerability was found in SourceCodesters Clinics Patient Management System 2.0. It has been rated as critical. This issue affects some unknown processing o… |
CVE-2024-8564 | Medium | 6.3 | 2024-09-07 | A vulnerability was found in SourceCodester PHP CRUD 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/updat… |
CVE-2024-8563 | Low | 3.5 | 2024-09-07 | A vulnerability was found in SourceCodester PHP CRUD 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/update.php… |
CVE-2024-8562 | Low | 3.5 | 2024-09-07 | A vulnerability was found in SourceCodester PHP CRUD 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /endpo… |
CVE-2024-8561 | Medium | 6.3 | 2024-09-07 | A vulnerability has been found in SourceCodester PHP CRUD 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2024-8560 | Medium | 6.3 | 2024-09-07 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Invoice Generator System 1.0. Affected is an unknown function of the file… |
CVE-2024-8559 | Medium | 4.7 | 2024-09-07 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Food Menu 1.0. This issue affects some unknown processing of the fil… |