2024 CVEs (page 186)
Page 186 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45057 | Medium | 6.1 | 2024-08-28 | i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-… |
CVE-2024-45048 | High | 8.8 | 2024-08-28 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XX… |
CVE-2024-45046 | Medium | 5.4 | 2024-08-28 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In affected versions `\PhpOffice\PhpSpreadsheet\Writer\Html` doesn't sanitize s… |
CVE-2024-45054 | Low | 2.8 | 2024-08-28 | Hwameistor is an HA local storage system for cloud-native stateful workloads. This ClusterRole has * verbs of * resources. If a malicious user can access the w… |
CVE-2024-45043 | Medium | 5.3 | 2024-08-28 | The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received b… |
CVE-2024-44760 | High | 7.5 | 2024-08-28 | Incorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.0 through v18.8 allows attackers to acce… |
CVE-2024-43805 | High | 7.6 | 2024-08-28 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on u… |
CVE-2024-42793 | High | 8.0 | 2024-08-28 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=save_… |
CVE-2024-34195 | Critical | 9.8 | 2024-08-28 | TOTOLINK AC1200 Wireless Router A3002R Firmware V1.1.1-B20200824 is vulnerable to Buffer Overflow. In the boa server program's CGI handling function formWlEncr… |
CVE-2024-44761 | Critical | 9.8 | 2024-08-28 | An issue in EQ Enterprise Management System before v2.0.0 allows attackers to execute a directory traversal via crafted requests. |
CVE-2024-44915 | Medium | 5.5 | 2024-08-28 | An issue in the component EXR!ReadEXR+0x4eef0 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability c… |
CVE-2024-44914 | Medium | 5.5 | 2024-08-28 | An issue in the component EXR!ReadEXR+0x3df50 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability c… |
CVE-2024-44913 | Medium | 5.5 | 2024-08-28 | An issue in the component EXR!ReadEXR+0x40ef1 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability c… |
CVE-2024-42905 | Critical | 9.8 | 2024-08-28 | Beijing Digital China Cloud Technology Co., Ltd. DCME-320 v.7.4.12.60 has a command execution vulnerability, which can be exploited to obtain device administra… |
CVE-2024-41236 | High | 7.2 | 2024-08-28 | A SQL injection vulnerability in /smsa/admin_login.php in Kashipara Responsive School Management System v3.2.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-7745 | Medium | 6.5 | 2024-08-28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the s… |
CVE-2024-7744 | Medium | 6.5 | 2024-08-28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web T… |
CVE-2024-6053 | Medium | 4.3 | 2024-08-28 | Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior version 15.55.3 can… |
CVE-2024-41565 | Medium | 4.3 | 2024-08-28 | JustEnoughItems (JEI) 19.5.0.33 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue i… |
CVE-2024-41564 | Medium | 4.3 | 2024-08-28 | EMI v.1.1.10 and before, fixed in v.1.1.11, contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue… |
CVE-2024-20478 | Medium | 6.5 | 2024-08-28 | A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerl… |
CVE-2024-20446 | High | 8.6 | 2024-08-28 | A vulnerability in the DHCPv6 relay agent of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition… |
CVE-2024-20413 | Medium | 6.7 | 2024-08-28 | A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to elevate privileges to network-… |
CVE-2024-20411 | Medium | 6.7 | 2024-08-28 | A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to execute arbitrary code as… |
CVE-2024-20289 | Medium | 4.4 | 2024-08-28 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to execute arbitrary commands on the underlying… |
CVE-2024-20286 | Medium | 5.3 | 2024-08-28 | A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and… |
CVE-2024-20285 | Medium | 5.3 | 2024-08-28 | A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and… |
CVE-2024-20284 | Medium | 5.3 | 2024-08-28 | A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and… |
CVE-2024-20279 | Medium | 4.3 | 2024-08-28 | A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, rem… |
CVE-2024-42900 | Medium | 6.1 | 2024-08-28 | Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the sql parameter of the createTable() function at /tool/gen/c… |
CVE-2024-42698 | Medium | 4.3 | 2024-08-28 | Roughly Enough Items (REI) v.16.0.729 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific i… |
CVE-2024-34198 | Critical | 9.8 | 2024-08-28 | TOTOLINK AC1200 Wireless Router A3002RU V2.1.1-B20230720.1011 is vulnerable to Buffer Overflow. The formWlEncrypt CGI handler in the boa program fails to limit… |
CVE-2024-8195 | Medium | 5.3 | 2024-08-28 | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug_data', 'debug_quer… |
CVE-2024-7447 | Medium | 5.3 | 2024-08-28 | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modifica… |
CVE-2024-6450 | Medium | 6.1 | 2024-08-28 | HyperView Geoportal Toolkit in versions lower than 8.5.0 is vulnerable to Reflected Cross-Site Scripting (XSS). An unauthenticated attacker might trick somebod… |
CVE-2024-6449 | Medium | 6.5 | 2024-08-28 | HyperView Geoportal Toolkit in versions lower than 8.5.0 does not restrict cross-domain requests when fetching remote content pointed by one of GET request par… |
CVE-2024-7269 | Medium | 5.4 | 2024-08-28 | Improper Neutralization of Input During Web Page Generation vulnerability in "Update of Personal Details" form in ConnX ESP HR Management allows Stored XSS att… |
CVE-2024-5546 | High | 8.3 | 2024-08-28 | Zohocorp ManageEngine Password Manager Pro versions before 12431 and ManageEngine PAM360 versions before 7001 are affected by authenticated SQL Injection vulne… |
CVE-2024-44943 | Medium | 5.5 | 2024-08-28 | In the Linux kernel, the following vulnerability has been resolved: mm: gup: stop abusing try_grab_folio A kernel warning was reported when pinning folio in… |
CVE-2024-6312 | Medium | 6.5 | 2024-08-28 | The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af2DeleteFontFile' fu… |
CVE-2024-6311 | High | 7.2 | 2024-08-28 | The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' function in all ver… |
CVE-2024-4556 | Medium | 5.7 | 2024-08-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access the sensitive infor… |
CVE-2024-4555 | High | 7.7 | 2024-08-28 | Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ A… |
CVE-2024-4554 | High | 7.3 | 2024-08-28 | Improper Input Validation vulnerability in OpenText NetIQ Access Manager leads to Cross-Site Scripting (XSS) attack. This issue affects Access Manager before 5… |
CVE-2024-45346 | High | 8.8 | 2024-08-28 | The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same t… |
CVE-2024-39771 | Medium | 6.8 | 2024-08-28 | QBiC CLOUD CC-2L v1.1.30 and earlier and Safie One v1.8.2 and earlier do not properly validate certificates, which may allow a network-adjacent unauthenticated… |
CVE-2024-39584 | High | 8.2 | 2024-08-28 | Dell Client Platform BIOS contains a Use of Default Cryptographic Key Vulnerability. A high privileged attacker with local access could potentially exploit th… |
CVE-2024-6448 | Medium | 5.3 | 2024-08-28 | The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. This is due to the… |
CVE-2024-8030 | Critical | 9.8 | 2024-08-28 | The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is v… |
CVE-2024-7573 | Medium | 5.3 | 2024-08-28 | The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient… |
CVE-2024-8231 | High | 8.8 | 2024-08-28 | A vulnerability classified as critical has been found in Tenda O6 1.0.0.7(2054). Affected is the function fromVirtualSet of the file /goform/setPortForward. Th… |
CVE-2024-8230 | High | 8.8 | 2024-08-28 | A vulnerability was found in Tenda O6 1.0.0.7(2054). It has been rated as critical. This issue affects the function fromSafeSetMacFilter of the file /goform/se… |
CVE-2024-8229 | High | 8.8 | 2024-08-28 | A vulnerability was found in Tenda O6 1.0.0.7(2054). It has been declared as critical. This vulnerability affects the function frommacFilterModify of the file… |
CVE-2024-8228 | High | 8.8 | 2024-08-28 | A vulnerability was found in Tenda O5 1.0.0.8(5017). It has been classified as critical. This affects the function fromSafeSetMacFilter of the file /goform/set… |
CVE-2024-8227 | High | 8.8 | 2024-08-28 | A vulnerability was found in Tenda O1 1.0.0.7(10648) and classified as critical. Affected by this issue is the function fromDhcpSetSer of the file /goform/Dhcp… |
CVE-2024-8226 | High | 8.8 | 2024-08-28 | A vulnerability has been found in Tenda O1 1.0.0.7(10648) and classified as critical. Affected by this vulnerability is the function formSetCfm of the file /go… |
CVE-2024-8225 | High | 8.8 | 2024-08-27 | A vulnerability, which was classified as critical, was found in Tenda G3 15.11.0.20. Affected is the function formSetSysTime of the file /goform/SetSysTimeCfg… |
CVE-2024-8224 | High | 8.8 | 2024-08-27 | A vulnerability, which was classified as critical, has been found in Tenda G3 15.11.0.20. This issue affects the function formSetDebugCfg of the file /goform/s… |
CVE-2024-8223 | Medium | 6.3 | 2024-08-27 | A vulnerability classified as critical was found in SourceCodester Music Gallery Site 1.0. This vulnerability affects unknown code of the file /classes/Master… |
CVE-2024-8222 | Medium | 6.3 | 2024-08-27 | A vulnerability classified as critical has been found in SourceCodester Music Gallery Site 1.0. This affects an unknown part of the file /admin/?page=musics/ma… |
CVE-2024-8221 | Medium | 6.3 | 2024-08-27 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-8220 | Medium | 6.3 | 2024-08-27 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown funct… |
CVE-2024-8219 | High | 7.3 | 2024-08-27 | A vulnerability was found in code-projects Responsive Hotel Site 1.0. It has been classified as critical. Affected is an unknown function of the file index.php… |
CVE-2024-8218 | High | 7.3 | 2024-08-27 | A vulnerability was found in code-projects Online Quiz Site 1.0 and classified as critical. This issue affects some unknown processing of the file index.php. T… |
CVE-2024-8217 | High | 7.3 | 2024-08-27 | A vulnerability has been found in SourceCodester E-Commerce Website 1.0 and classified as critical. This vulnerability affects unknown code of the file /Admin/… |
CVE-2024-8216 | Medium | 5.4 | 2024-08-27 | A vulnerability, which was classified as critical, has been found in nafisulbari/itsourcecode Insurance Management System 1.0. Affected by this issue is some u… |
CVE-2024-45049 | High | 7.5 | 2024-08-27 | Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the s… |
CVE-2024-45038 | High | 7.5 | 2024-08-27 | Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-po… |
CVE-2024-8214 | Medium | 6.3 | 2024-08-27 | A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-… |
CVE-2024-8213 | Medium | 6.3 | 2024-08-27 | A vulnerability classified as critical has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325… |
CVE-2024-8212 | Medium | 6.3 | 2024-08-27 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-8211 | Medium | 6.3 | 2024-08-27 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-8210 | Medium | 6.3 | 2024-08-27 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-5991 | High | 7.5 | 2024-08-27 | In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X50… |
CVE-2024-5814 | Medium | 5.3 | 2024-08-27 | A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection… |
CVE-2024-5288 | Medium | 5.1 | 2024-08-27 | An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSL_CHECK_SIG_F… |
CVE-2024-45037 | Medium | 6.4 | 2024-08-27 | The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications… |
CVE-2024-1544 | Medium | 4.1 | 2024-08-27 | Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the order of the elliptic… |
CVE-2024-8209 | Low | 3.5 | 2024-08-27 | A vulnerability was found in nafisulbari/itsourcecode Insurance Management System 1.0 and classified as problematic. Affected by this issue is some unknown fun… |
CVE-2024-8208 | Low | 3.5 | 2024-08-27 | A vulnerability has been found in nafisulbari/itsourcecode Insurance Management System 1.0 and classified as problematic. Affected by this vulnerability is an… |
CVE-2024-7720 | Critical | 9.8 | 2024-08-27 | HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product's solution open-source libraries. |
CVE-2024-43783 | High | 7.5 | 2024-08-27 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Instances… |
CVE-2024-43414 | High | 7.5 | 2024-08-27 | Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowerin… |
CVE-2024-42851 | High | 7.8 | 2024-08-27 | Buffer Overflow vulnerability in open source exiftags v.1.01 allows a local attacker to execute arbitrary code via the paresetag function. |
CVE-2024-36068 | Critical | 9.8 | 2024-08-27 | An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network access to execute a… |
CVE-2024-43788 | Medium | 6.4 | 2024-08-27 | Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packag… |
CVE-2024-8200 | Medium | 4.3 | 2024-08-27 | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Requ… |
CVE-2024-8199 | Medium | 4.3 | 2024-08-27 | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to unauthorized mo… |
CVE-2024-45264 | High | 8.8 | 2024-08-27 | A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator… |
CVE-2024-44342 | Critical | 9.8 | 2024-08-27 | D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the wl(0).(0)_ssid parameter. This vulnerability is ex… |
CVE-2024-44341 | Critical | 9.8 | 2024-08-27 | D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vulnerabil… |
CVE-2024-44340 | High | 8.8 | 2024-08-27 | D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via keys smartqos_express_devices and smartqos_normal_devi… |
CVE-2024-41622 | Critical | 9.8 | 2024-08-27 | D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter in /HNAP1/ inter… |
CVE-2024-40395 | Medium | 6.5 | 2024-08-27 | An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level. |
CVE-2024-6633 | Critical | 9.8 | 2024-08-27 | The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credent… |
CVE-2024-6632 | High | 7.2 | 2024-08-27 | A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to… |
CVE-2024-7071 | Critical | 9.8 | 2024-08-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in Brain Information T… |
CVE-2024-8182 | High | 7.5 | 2024-08-27 | An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable versi… |
CVE-2024-8181 | Critical | 9.8 | 2024-08-27 | An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an admin… |
CVE-2024-7941 | Medium | 4.3 | 2024-08-27 | An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a mal… |