2024 CVEs (page 179)
Page 179 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8575 | High | 8.8 | 2024-09-08 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This issue affects the function setWiFiScheduleCfg of the fil… |
CVE-2024-42343 | Medium | 5.3 | 2024-09-08 | Loway - CWE-204: Observable Response Discrepancy |
CVE-2024-42342 | Medium | 4.3 | 2024-09-08 | Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
CVE-2024-42341 | Medium | 6.1 | 2024-09-08 | Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') |
CVE-2024-8574 | Medium | 6.3 | 2024-09-08 | A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This vulnerability affects the function setParentalRules… |
CVE-2024-8573 | High | 8.8 | 2024-09-08 | A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function… |
CVE-2024-8572 | Low | 3.5 | 2024-09-08 | A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of… |
CVE-2024-8571 | Low | 3.5 | 2024-09-08 | A vulnerability was found in erjemin roll_cms up to 1484fe2c4e0805946a7bcf46218509fcb34883a9. It has been classified as problematic. This affects an unknown pa… |
CVE-2024-8570 | Medium | 6.3 | 2024-09-08 | A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of t… |
CVE-2024-6928 | Critical | 9.8 | 2024-09-08 | The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action avail… |
CVE-2024-6925 | Medium | 4.3 | 2024-09-08 | The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2024-6924 | Critical | 9.8 | 2024-09-08 | The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available… |
CVE-2024-6859 | Medium | 5.4 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2024-6856 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-6855 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perf… |
CVE-2024-6853 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins p… |
CVE-2024-6852 | Medium | 4.3 | 2024-09-08 | The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-8569 | High | 7.3 | 2024-09-08 | A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-8568 | Medium | 6.3 | 2024-09-08 | A vulnerability, which was classified as critical, was found in Mini-Tmall up to 20240901. Affected is the function rewardMapper.select of the file tmall/admin… |
CVE-2024-8567 | High | 7.3 | 2024-09-08 | A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0. This issue affects some unknown processing of… |
CVE-2024-8566 | Medium | 4.3 | 2024-09-08 | A vulnerability classified as problematic was found in code-projects Online Shop Store 1.0. This vulnerability affects unknown code of the file /settings.php… |
CVE-2024-8565 | High | 7.3 | 2024-09-07 | A vulnerability was found in SourceCodesters Clinics Patient Management System 2.0. It has been rated as critical. This issue affects some unknown processing o… |
CVE-2024-8564 | Medium | 6.3 | 2024-09-07 | A vulnerability was found in SourceCodester PHP CRUD 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/updat… |
CVE-2024-8563 | Low | 3.5 | 2024-09-07 | A vulnerability was found in SourceCodester PHP CRUD 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/update.php… |
CVE-2024-8562 | Low | 3.5 | 2024-09-07 | A vulnerability was found in SourceCodester PHP CRUD 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /endpo… |
CVE-2024-8561 | Medium | 6.3 | 2024-09-07 | A vulnerability has been found in SourceCodester PHP CRUD 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2024-8560 | Medium | 6.3 | 2024-09-07 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Invoice Generator System 1.0. Affected is an unknown function of the file… |
CVE-2024-8559 | Medium | 4.7 | 2024-09-07 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Food Menu 1.0. This issue affects some unknown processing of the fil… |
CVE-2024-42024 | High | 8.8 | 2024-09-07 | A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where… |
CVE-2024-42023 | High | 8.8 | 2024-09-07 | An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. |
CVE-2024-42022 | Medium | 5.3 | 2024-09-07 | An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. |
CVE-2024-42021 | Medium | 6.5 | 2024-09-07 | An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. |
CVE-2024-42020 | Medium | 5.4 | 2024-09-07 | A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection. |
CVE-2024-42019 | High | 8.0 | 2024-09-07 | A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user interaction and data c… |
CVE-2024-40718 | High | 8.8 | 2024-09-07 | A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vulnerability. |
CVE-2024-40714 | High | 8.3 | 2024-09-07 | An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during… |
CVE-2024-40713 | High | 7.8 | 2024-09-07 | A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) set… |
CVE-2024-40712 | High | 7.8 | 2024-09-07 | A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). |
CVE-2024-40711 | Critical | 9.8 | 2024-09-07 | A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). |
CVE-2024-40710 | High | 8.8 | 2024-09-07 | A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive inf… |
CVE-2024-40709 | High | 7.8 | 2024-09-07 | A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level. |
CVE-2024-39718 | High | 8.1 | 2024-09-07 | An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the… |
CVE-2024-39715 | High | 8.5 | 2024-09-07 | A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST… |
CVE-2024-39714 | Critical | 9.9 | 2024-09-07 | A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server. |
CVE-2024-38651 | High | 8.5 | 2024-09-07 | A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server. |
CVE-2024-38650 | Critical | 9.9 | 2024-09-07 | An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server. |
CVE-2024-8558 | Medium | 4.3 | 2024-09-07 | A vulnerability classified as problematic was found in SourceCodester Food Ordering Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2024-36138 | High | 8.1 | 2024-09-07 | Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / ch… |
CVE-2024-36137 | Low | 3.3 | 2024-09-07 | A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permiss… |
CVE-2024-8557 | Medium | 6.3 | 2024-09-07 | A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System 1.0. This affects an unknown part of the file /foms/rou… |
CVE-2024-8555 | Medium | 4.3 | 2024-09-07 | A vulnerability was found in SourceCodester Clinics Patient Management System 2.0. It has been classified as problematic. Affected is an unknown function of th… |
CVE-2024-40681 | High | 7.5 | 2024-09-07 | IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions… |
CVE-2024-8554 | Low | 3.5 | 2024-09-07 | A vulnerability was found in SourceCodester Clinics Patient Management System 2.0 and classified as problematic. This issue affects some unknown processing of… |
CVE-2024-40680 | Medium | 5.5 | 2024-09-07 | IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault. |
CVE-2024-37068 | Medium | 5.9 | 2024-09-07 | IBM Maximo Application Suite - Manage Component 8.10, 8.11, and 9.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt… |
CVE-2024-7620 | Medium | 6.6 | 2024-09-07 | The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all… |
CVE-2024-7112 | High | 8.8 | 2024-09-07 | The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter in all versions up t… |
CVE-2024-6010 | Medium | 5.3 | 2024-09-07 | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin… |
CVE-2024-1596 | High | 7.2 | 2024-09-07 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, an… |
CVE-2024-8538 | Medium | 4.3 | 2024-09-07 | The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2… |
CVE-2024-8523 | Medium | 4.7 | 2024-09-07 | A vulnerability was found in lmxcms up to 1.4 and classified as critical. Affected by this issue is the function formatData of the file /admin.php?m=Acquisi&a=… |
CVE-2024-6849 | Medium | 6.4 | 2024-09-07 | The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up… |
CVE-2024-8521 | Medium | 4.3 | 2024-09-07 | A vulnerability, which was classified as problematic, was found in Wavelog up to 1.8.0. Affected is the function index of the file /qso of the component Live Q… |
CVE-2024-45498 | High | 8.8 | 2024-09-07 | Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG tr… |
CVE-2024-45034 | High | 8.8 | 2024-09-07 | Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler… |
CVE-2024-45771 | Critical | 9.8 | 2024-09-06 | RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password parameter at /resource/runlogin.php. |
CVE-2024-44839 | Critical | 9.8 | 2024-09-06 | RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid parameter at /default/article.php. |
CVE-2024-44838 | Critical | 9.8 | 2024-09-06 | RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php. |
CVE-2024-44845 | High | 8.8 | 2024-09-06 | DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filter_string function. |
CVE-2024-44844 | High | 8.8 | 2024-09-06 | DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the run_command function. |
CVE-2024-34158 | High | 7.5 | 2024-09-06 | Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. |
CVE-2024-34156 | High | 7.5 | 2024-09-06 | Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635. |
CVE-2024-34155 | Medium | 4.3 | 2024-09-06 | Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. |
CVE-2024-7652 | High | 7.5 | 2024-09-06 | An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an ex… |
CVE-2024-8394 | Medium | 6.5 | 2024-09-06 | When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vuln… |
CVE-2024-38642 | High | 7.8 | 2024-09-06 | An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local network users to compro… |
CVE-2024-38641 | High | 7.8 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local net… |
CVE-2024-38640 | Medium | 5.4 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to inj… |
CVE-2024-32771 | Low | 2.6 | 2024-09-06 | An improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating system versions. If exploited, th… |
CVE-2024-32763 | High | 8.8 | 2024-09-06 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-32762 | High | 8.2 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow users to inject malicious code… |
CVE-2024-27126 | Medium | 6.3 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inje… |
CVE-2024-27125 | Low | 3.5 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated administrators to in… |
CVE-2024-27122 | Medium | 6.3 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inje… |
CVE-2024-21906 | Medium | 4.7 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2024-21904 | Medium | 5.9 | 2024-09-06 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2024-21903 | Medium | 6.6 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2024-21898 | High | 8.8 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2024-21897 | High | 8.9 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow auth… |
CVE-2024-8517 | Critical | 9.8 | 2024-09-06 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating syste… |
CVE-2024-8509 | High | 7.5 | 2024-09-06 | A vulnerability was found in Forklift Controller. There is no verification against the authorization header except to ensure it uses bearer authentication. Wi… |
CVE-2024-45758 | Critical | 9.1 | 2024-09-06 | H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitati… |
CVE-2024-45294 | High | 8.6 | 2024-09-06 | The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperabil… |
CVE-2024-44408 | High | 7.5 | 2024-09-06 | D-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure. The device allows unauthorized configuration file downloads, and the downloaded con… |
CVE-2024-44402 | Critical | 9.8 | 2024-09-06 | D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm. |
CVE-2024-44401 | Critical | 9.8 | 2024-09-06 | D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file |
CVE-2024-25584 | Medium | 5.3 | 2024-09-06 | Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail… |
CVE-2024-8428 | High | 8.8 | 2024-09-06 | The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions u… |
CVE-2024-7622 | Medium | 4.3 | 2024-09-06 | The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the _a_ajaxQuickEmailT… |
CVE-2024-7611 | Medium | 6.4 | 2024-09-06 | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Eve… |