2024 CVEs (page 179)
Page 179 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-42024 | High | 8.8 | 2024-09-07 | A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where… |
CVE-2024-42023 | High | 8.8 | 2024-09-07 | An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. |
CVE-2024-42022 | Medium | 5.3 | 2024-09-07 | An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. |
CVE-2024-42021 | Medium | 6.5 | 2024-09-07 | An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. |
CVE-2024-42020 | Medium | 5.4 | 2024-09-07 | A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection. |
CVE-2024-42019 | High | 8.0 | 2024-09-07 | A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user interaction and data c… |
CVE-2024-40718 | High | 8.8 | 2024-09-07 | A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vulnerability. |
CVE-2024-40714 | High | 8.3 | 2024-09-07 | An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during… |
CVE-2024-40713 | High | 7.8 | 2024-09-07 | A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) set… |
CVE-2024-40712 | High | 7.8 | 2024-09-07 | A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). |
CVE-2024-40711 | Critical | 9.8 | 2024-09-07 | A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). |
CVE-2024-40710 | High | 8.8 | 2024-09-07 | A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive inf… |
CVE-2024-40709 | High | 7.8 | 2024-09-07 | A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level. |
CVE-2024-39718 | High | 8.1 | 2024-09-07 | An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the… |
CVE-2024-39715 | High | 8.5 | 2024-09-07 | A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST… |
CVE-2024-39714 | Critical | 9.9 | 2024-09-07 | A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server. |
CVE-2024-38651 | High | 8.5 | 2024-09-07 | A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server. |
CVE-2024-38650 | Critical | 9.9 | 2024-09-07 | An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server. |
CVE-2024-8558 | Medium | 4.3 | 2024-09-07 | A vulnerability classified as problematic was found in SourceCodester Food Ordering Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2024-36138 | High | 8.1 | 2024-09-07 | Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / ch… |
CVE-2024-36137 | Low | 3.3 | 2024-09-07 | A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permiss… |
CVE-2024-8557 | Medium | 6.3 | 2024-09-07 | A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System 1.0. This affects an unknown part of the file /foms/rou… |
CVE-2024-8555 | Medium | 4.3 | 2024-09-07 | A vulnerability was found in SourceCodester Clinics Patient Management System 2.0. It has been classified as problematic. Affected is an unknown function of th… |
CVE-2024-40681 | High | 7.5 | 2024-09-07 | IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions… |
CVE-2024-8554 | Low | 3.5 | 2024-09-07 | A vulnerability was found in SourceCodester Clinics Patient Management System 2.0 and classified as problematic. This issue affects some unknown processing of… |
CVE-2024-40680 | Medium | 5.5 | 2024-09-07 | IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault. |
CVE-2024-37068 | Medium | 5.9 | 2024-09-07 | IBM Maximo Application Suite - Manage Component 8.10, 8.11, and 9.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt… |
CVE-2024-7620 | Medium | 6.6 | 2024-09-07 | The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all… |
CVE-2024-7112 | High | 8.8 | 2024-09-07 | The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter in all versions up t… |
CVE-2024-6010 | Medium | 5.3 | 2024-09-07 | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin… |
CVE-2024-1596 | High | 7.2 | 2024-09-07 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, an… |
CVE-2024-8538 | Medium | 4.3 | 2024-09-07 | The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2… |
CVE-2024-8523 | Medium | 4.7 | 2024-09-07 | A vulnerability was found in lmxcms up to 1.4 and classified as critical. Affected by this issue is the function formatData of the file /admin.php?m=Acquisi&a=… |
CVE-2024-6849 | Medium | 6.4 | 2024-09-07 | The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up… |
CVE-2024-8521 | Medium | 4.3 | 2024-09-07 | A vulnerability, which was classified as problematic, was found in Wavelog up to 1.8.0. Affected is the function index of the file /qso of the component Live Q… |
CVE-2024-45498 | High | 8.8 | 2024-09-07 | Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG tr… |
CVE-2024-45034 | High | 8.8 | 2024-09-07 | Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler… |
CVE-2024-45771 | Critical | 9.8 | 2024-09-06 | RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password parameter at /resource/runlogin.php. |
CVE-2024-44839 | Critical | 9.8 | 2024-09-06 | RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid parameter at /default/article.php. |
CVE-2024-44838 | Critical | 9.8 | 2024-09-06 | RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php. |
CVE-2024-44845 | High | 8.8 | 2024-09-06 | DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filter_string function. |
CVE-2024-44844 | High | 8.8 | 2024-09-06 | DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the run_command function. |
CVE-2024-34158 | High | 7.5 | 2024-09-06 | Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. |
CVE-2024-34156 | High | 7.5 | 2024-09-06 | Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635. |
CVE-2024-34155 | Medium | 4.3 | 2024-09-06 | Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. |
CVE-2024-7652 | High | 7.5 | 2024-09-06 | An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an ex… |
CVE-2024-8394 | Medium | 6.5 | 2024-09-06 | When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vuln… |
CVE-2024-38642 | High | 7.8 | 2024-09-06 | An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local network users to compro… |
CVE-2024-38641 | High | 7.8 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local net… |
CVE-2024-38640 | Medium | 5.4 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to inj… |
CVE-2024-32771 | Low | 2.6 | 2024-09-06 | An improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating system versions. If exploited, th… |
CVE-2024-32763 | High | 8.8 | 2024-09-06 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-32762 | High | 8.2 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow users to inject malicious code… |
CVE-2024-27126 | Medium | 6.3 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inje… |
CVE-2024-27125 | Low | 3.5 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated administrators to in… |
CVE-2024-27122 | Medium | 6.3 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inje… |
CVE-2024-21906 | Medium | 4.7 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2024-21904 | Medium | 5.9 | 2024-09-06 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read th… |
CVE-2024-21903 | Medium | 6.6 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2024-21898 | High | 8.8 | 2024-09-06 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2024-21897 | High | 8.9 | 2024-09-06 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow auth… |
CVE-2024-8517 | Critical | 9.8 | 2024-09-06 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating syste… |
CVE-2024-8509 | High | 7.5 | 2024-09-06 | A vulnerability was found in Forklift Controller. There is no verification against the authorization header except to ensure it uses bearer authentication. Wi… |
CVE-2024-45758 | Critical | 9.1 | 2024-09-06 | H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitati… |
CVE-2024-45294 | High | 8.6 | 2024-09-06 | The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperabil… |
CVE-2024-44408 | High | 7.5 | 2024-09-06 | D-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure. The device allows unauthorized configuration file downloads, and the downloaded con… |
CVE-2024-44402 | Critical | 9.8 | 2024-09-06 | D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm. |
CVE-2024-44401 | Critical | 9.8 | 2024-09-06 | D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file |
CVE-2024-25584 | Medium | 5.3 | 2024-09-06 | Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail… |
CVE-2024-8428 | High | 8.8 | 2024-09-06 | The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions u… |
CVE-2024-7622 | Medium | 4.3 | 2024-09-06 | The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the _a_ajaxQuickEmailT… |
CVE-2024-7611 | Medium | 6.4 | 2024-09-06 | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Eve… |
CVE-2024-7599 | Medium | 6.4 | 2024-09-06 | The Advanced Sermons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sermon_video_embed’ parameter in all versions up to, and includ… |
CVE-2024-7493 | Critical | 9.8 | 2024-09-06 | The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing a… |
CVE-2024-6445 | High | 7.5 | 2024-09-06 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DataFlowX Technology DataDiodeX allows Path Traversal. This is… |
CVE-2024-44837 | Medium | 5.4 | 2024-09-06 | A cross-site scripting (XSS) vulnerability in the component \bean\Manager.java of Drug v1.0 allows attackers to execute arbitrary web scripts or HTML via a cra… |
CVE-2024-45405 | Medium | 6.0 | 2024-09-06 | `gix-path` is a crate of the `gitoxide` project (an implementation of `git` written in Rust) dealing paths and their conversions. Prior to version 0.10.11, `gi… |
CVE-2024-45300 | High | 7.5 | 2024-09-06 | alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the u… |
CVE-2024-45299 | Medium | 6.5 | 2024-09-06 | alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is… |
CVE-2024-45040 | Medium | 5.9 | 2024-09-06 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.11.0, commitments to private witnesses in Groth16 as imple… |
CVE-2024-45039 | Medium | 6.2 | 2024-09-06 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundness issue - in case of multiple commitm… |
CVE-2024-44739 | High | 8.8 | 2024-09-06 | Sourcecodester Simple Forum Website v1.0 has a SQL injection vulnerability in /php-sqlite-forum/?page=manage_user&id=. |
CVE-2024-1744 | High | 7.5 | 2024-09-06 | Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Ariva Computer Accord ORS allows Retrieve Embedded Sensitive Data. Th… |
CVE-2024-8427 | Medium | 4.3 | 2024-09-06 | The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2024-8317 | Medium | 6.4 | 2024-09-06 | The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ad_alignment’ attribute in all versions u… |
CVE-2024-8292 | Critical | 9.8 | 2024-09-06 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and i… |
CVE-2024-7349 | High | 7.2 | 2024-09-06 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all vers… |
CVE-2024-6792 | Low | 3.5 | 2024-09-06 | The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page. |
CVE-2024-45751 | Medium | 5.9 | 2024-09-06 | tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of c… |
CVE-2024-39585 | High | 7.9 | 2024-09-06 | Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Password vulnerability. A low privileged at… |
CVE-2024-38486 | High | 7.5 | 2024-09-06 | Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special Elements used in a Comman… |
CVE-2024-8480 | High | 8.8 | 2024-09-06 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 's… |
CVE-2024-8247 | High | 8.8 | 2024-09-06 | The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the plugin not restric… |
CVE-2024-7415 | Medium | 5.3 | 2024-09-06 | The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin allo… |
CVE-2024-40865 | Medium | 5.3 | 2024-09-06 | The issue was addressed by suspending Persona when the virtual keyboard is active. This issue is fixed in visionOS 1.3. Inputs to the virtual keyboard may be i… |
CVE-2024-44082 | Medium | 4.3 | 2024-09-06 | In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used b… |
CVE-2024-45400 | Medium | 6.1 | 2024-09-06 | ckeditor-plugin-openlink is a plugin for the CKEditor JavaScript text editor that extends the context menu with a possibility to open a link in a new tab. A vu… |
CVE-2024-42495 | Medium | 6.5 | 2024-09-05 | Credentials to access device configuration were transmitted using an unencrypted protocol. These credentials would allow read-only access to network configurat… |
CVE-2024-39278 | Medium | 4.2 | 2024-09-05 | Credentials to access device configuration information stored unencrypted in flash memory. These credentials would allow read-only access to network configurat… |
CVE-2024-8395 | Critical | 9.8 | 2024-09-05 | FlyCASS CASS and KCM systems did not correctly filter SQL queries, which made them vulnerable to attack by outside attackers with no authentication. |