2024 CVEs (page 178)
Page 178 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7618 | Medium | 4.4 | 2024-09-10 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘co… |
CVE-2024-6596 | Critical | 9.8 | 2024-09-10 | An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context. |
CVE-2024-42427 | High | 7.6 | 2024-09-10 | Dell ThinOS versions 2402 and 2405, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthent… |
CVE-2024-42424 | Medium | 5.3 | 2024-09-10 | Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Improper Input Validation vulnerability. A high privileged attacker with local access… |
CVE-2024-44072 | Medium | 5.7 | 2024-09-10 | OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a spec… |
CVE-2024-7955 | Medium | 4.8 | 2024-09-10 | The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2024-7891 | Medium | 4.8 | 2024-09-10 | The Floating Contact Button WordPress plugin before 2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-7784 | Medium | 6.1 | 2024-09-10 | During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot… |
CVE-2024-6979 | Medium | 6.8 | 2024-09-10 | Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer account… |
CVE-2024-6509 | Medium | 6.5 | 2024-09-10 | Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource… |
CVE-2024-6173 | Medium | 6.5 | 2024-09-10 | 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowing for an attacker… |
CVE-2024-45504 | Medium | 6.5 | 2024-09-10 | Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticated attacker to hi… |
CVE-2024-45285 | Medium | 5.4 | 2024-09-10 | The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes. By sending a c… |
CVE-2024-45284 | Low | 2.4 | 2024-09-10 | An authenticated attacker with high privilege can use functions of SLCM transactions to which access should be restricted. This may result in an escalation of… |
CVE-2024-45283 | Medium | 6.0 | 2024-09-10 | SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an R… |
CVE-2024-45281 | Medium | 5.8 | 2024-09-10 | SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally s… |
CVE-2024-45280 | Medium | 4.8 | 2024-09-10 | Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limi… |
CVE-2024-45279 | Medium | 6.1 | 2024-09-10 | Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker t… |
CVE-2024-44121 | Medium | 4.3 | 2024-09-10 | Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted… |
CVE-2024-44120 | Medium | 4.7 | 2024-09-10 | SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attac… |
CVE-2024-44117 | Medium | 5.4 | 2024-09-10 | The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook… |
CVE-2024-21528 | Medium | 5.9 | 2024-09-10 | All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sani… |
CVE-2024-0067 | Medium | 4.3 | 2024-09-10 | Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folde… |
CVE-2024-45286 | Medium | 6.5 | 2024-09-10 | Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue Accounting allows una… |
CVE-2024-44112 | Medium | 4.3 | 2024-09-10 | Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative user could call a… |
CVE-2024-41728 | Low | 2.7 | 2024-09-10 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects con… |
CVE-2024-8478 | High | 7.3 | 2024-09-10 | The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due… |
CVE-2024-8268 | High | 8.8 | 2024-09-10 | The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the aj… |
CVE-2024-44116 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to id… |
CVE-2024-44115 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify u… |
CVE-2024-44114 | Low | 2.0 | 2024-09-10 | SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This resu… |
CVE-2024-44113 | Medium | 4.3 | 2024-09-10 | Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is oth… |
CVE-2024-42380 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each nod… |
CVE-2024-42378 | Medium | 6.1 | 2024-09-10 | Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to… |
CVE-2024-42371 | Medium | 5.4 | 2024-09-10 | The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify u… |
CVE-2024-41729 | Medium | 4.3 | 2024-09-10 | Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On… |
CVE-2024-6342 | Critical | 9.8 | 2024-09-10 | **UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542… |
CVE-2024-38270 | Medium | 5.3 | 2024-09-10 | An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in t… |
CVE-2024-8611 | Medium | 6.3 | 2024-09-09 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-8610 | Low | 3.5 | 2024-09-09 | A vulnerability classified as problematic has been found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file… |
CVE-2024-44411 | Critical | 9.8 | 2024-09-09 | D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function. |
CVE-2024-44410 | Critical | 9.8 | 2024-09-09 | D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function. |
CVE-2024-27365 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos W920… |
CVE-2024-6796 | High | 8.2 | 2024-09-09 | In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker… |
CVE-2024-6795 | Critical | 10.0 | 2024-09-09 | In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthor… |
CVE-2024-44902 | Critical | 9.8 | 2024-09-09 | A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code. |
CVE-2024-44725 | High | 7.2 | 2024-09-09 | AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php. |
CVE-2024-44724 | High | 7.2 | 2024-09-09 | AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsite_url parameter at /admin/site_add.php. This vulnerability allows attac… |
CVE-2024-44085 | Medium | 6.1 | 2024-09-09 | ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expres… |
CVE-2024-42500 | Critical | 9.3 | 2024-09-09 | HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services. |
CVE-2024-27387 | Medium | 6.7 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_rx_range_done_ind()… |
CVE-2024-27383 | Medium | 6.7 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_get_scan_extra_ies(… |
CVE-2024-27368 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380… |
CVE-2024-27367 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor Exynos Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exyno… |
CVE-2024-27366 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Samsung Mobile Processor, Wearable Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exyn… |
CVE-2024-27364 | Medium | 4.4 | 2024-09-09 | An issue was discovered in Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos… |
CVE-2024-7341 | High | 7.1 | 2024-09-09 | A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even whe… |
CVE-2024-7318 | Medium | 4.8 | 2024-09-09 | A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead… |
CVE-2024-7260 | Medium | 6.1 | 2024-09-09 | An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to tri… |
CVE-2024-45411 | High | 8.5 | 2024-09-09 | Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sa… |
CVE-2024-45296 | High | 7.5 | 2024-09-09 | path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause… |
CVE-2024-42759 | Medium | 6.3 | 2024-09-09 | An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint. |
CVE-2024-24510 | Medium | 6.1 | 2024-09-09 | Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail componen… |
CVE-2024-44849 | Critical | 9.8 | 2024-09-09 | Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php. |
CVE-2024-44335 | High | 8.8 | 2024-09-09 | D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7… |
CVE-2024-44334 | High | 8.8 | 2024-09-09 | D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 ar… |
CVE-2024-45406 | Medium | 5.5 | 2024-09-09 | Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input. |
CVE-2024-44333 | High | 8.8 | 2024-09-09 | D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 ar… |
CVE-2024-8605 | Medium | 4.3 | 2024-09-09 | A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. This vulnerability affects unknown code of the file /view/regist… |
CVE-2024-8604 | Medium | 4.3 | 2024-09-09 | A vulnerability classified as problematic has been found in SourceCodester Online Food Ordering System 2.0. This affects an unknown part of the file index.php… |
CVE-2024-44721 | Critical | 9.8 | 2024-09-09 | SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php. |
CVE-2024-44720 | High | 7.5 | 2024-09-09 | SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php. |
CVE-2024-8373 | Medium | 4.8 | 2024-09-09 | Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions… |
CVE-2024-8372 | Medium | 4.8 | 2024-09-09 | Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a… |
CVE-2024-8042 | Low | 2.4 | 2024-09-09 | Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local req… |
CVE-2024-45041 | High | 8.3 | 2024-09-09 | External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-ext… |
CVE-2024-40643 | Critical | 9.6 | 2024-09-09 | Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter character will not be cons… |
CVE-2024-7015 | Critical | 9.8 | 2024-09-09 | Missing Authentication for Critical Function vulnerability in Profelis Informatics and Consulting PassBox allows Authentication Abuse. This issue affects Pass… |
CVE-2024-44375 | High | 7.5 | 2024-09-09 | D-Link DI-8100 v16.07.26A1 has a stack overflow vulnerability in the dbsrv_asp function. |
CVE-2024-8601 | Medium | 6.5 | 2024-09-09 | This vulnerability exists in TechExcel Back Office Software versions prior to 1.0.0 due to improper access controls on certain API endpoints. An authenticated… |
CVE-2024-6572 | High | 7.4 | 2024-09-09 | Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' in Checkmk before Checkmk 2.3.0p15, 2.2.0p33, 2.1… |
CVE-2024-37288 | Critical | 9.9 | 2024-09-09 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue o… |
CVE-2024-45203 | Medium | 4.3 | 2024-09-09 | Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS versions prior to 6.74… |
CVE-2024-7918 | Medium | 4.8 | 2024-09-09 | The Pocket Widget WordPress plugin through 0.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-7689 | Medium | 4.3 | 2024-09-09 | The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2024-7688 | Medium | 6.5 | 2024-09-09 | The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin delete arbitrary index… |
CVE-2024-7687 | Medium | 4.3 | 2024-09-09 | The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacker… |
CVE-2024-6910 | Medium | 4.8 | 2024-09-09 | The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform C… |
CVE-2024-5561 | Medium | 4.8 | 2024-09-09 | The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-45625 | Medium | 6.1 | 2024-09-09 | Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on th… |
CVE-2024-8586 | Medium | 6.1 | 2024-09-09 | WebITR from Uniong has an Open Redirect vulnerability, which allows unauthorized remote attackers to exploit this vulnerability to forge URLs. Users, believing… |
CVE-2024-8585 | Medium | 6.5 | 2024-09-09 | Orca HCM from LEARNING DIGITA does not properly restrict a specific parameter of the file download functionality, allowing a remote attacker with regular privi… |
CVE-2024-8584 | Critical | 9.8 | 2024-09-09 | Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an… |
CVE-2024-8583 | Low | 3.5 | 2024-09-08 | A vulnerability was found in SourceCodester Online Bank Management System and Online Bank Management System - 1.0. It has been classified as problematic. This… |
CVE-2024-8582 | Low | 3.5 | 2024-09-08 | A vulnerability was found in SourceCodester Food Ordering Management System 1.0 and classified as problematic. Affected by this issue is some unknown functiona… |
CVE-2024-8580 | High | 8.1 | 2024-09-08 | A vulnerability classified as critical was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. This vulnerability affects unknown code of the file /etc/shadow.s… |
CVE-2024-8579 | High | 8.8 | 2024-09-08 | A vulnerability classified as critical has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. This affects the function setWiFiRepeaterCfg of the file /cg… |
CVE-2024-8578 | High | 8.8 | 2024-09-08 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. It has been rated as critical. Affected by this issue is the function setWiFiMeshName of… |
CVE-2024-8577 | High | 8.8 | 2024-09-08 | A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been declared as critical. Affected by this vulnerabi… |
CVE-2024-8576 | High | 8.8 | 2024-09-08 | A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been classified as critical. Affected is the function… |