2024 CVEs (page 189)
Page 189 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8142 | Low | 3.5 | 2024-08-25 | A vulnerability was found in SourceCodester Daily Calories Monitoring Tool 1.0. It has been declared as problematic. This vulnerability affects unknown code of… |
CVE-2024-8141 | Low | 3.5 | 2024-08-25 | A vulnerability was found in SourceCodester Daily Calories Monitoring Tool 1.0. It has been classified as problematic. This affects an unknown part of the file… |
CVE-2024-8140 | Low | 3.5 | 2024-08-25 | A vulnerability was found in SourceCodester Task Progress Tracker 1.0 and classified as problematic. Affected by this issue is some unknown functionality of th… |
CVE-2024-45244 | Medium | 5.3 | 2024-08-25 | Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window. |
CVE-2024-8139 | Medium | 6.3 | 2024-08-25 | A vulnerability has been found in itsourcecode E-Commerce Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-8138 | Medium | 6.3 | 2024-08-25 | A vulnerability, which was classified as critical, was found in code-projects Pharmacy Management System 1.0. Affected is the function editManager of the file… |
CVE-2024-8137 | Low | 3.5 | 2024-08-24 | A vulnerability has been found in SourceCodester Record Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the fil… |
CVE-2024-45240 | High | 7.4 | 2024-08-24 | The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal (i… |
CVE-2024-45239 | High | 7.5 | 2024-08-24 | An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a… |
CVE-2024-45238 | High | 7.5 | 2024-08-24 | An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource… |
CVE-2024-45237 | Critical | 9.8 | 2024-08-24 | An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource… |
CVE-2024-45236 | High | 7.5 | 2024-08-24 | An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a signed ob… |
CVE-2024-45235 | High | 7.5 | 2024-08-24 | An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource… |
CVE-2024-45234 | High | 7.5 | 2024-08-24 | An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a… |
CVE-2024-8136 | Low | 3.5 | 2024-08-24 | A vulnerability, which was classified as problematic, was found in SourceCodester Record Management System 1.0. This affects an unknown part of the file sort1_… |
CVE-2024-8135 | Medium | 6.3 | 2024-08-24 | A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the… |
CVE-2024-8134 | Medium | 6.3 | 2024-08-24 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-8133 | Medium | 6.3 | 2024-08-24 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-8132 | Medium | 6.3 | 2024-08-24 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-8131 | Medium | 6.3 | 2024-08-24 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-8130 | Medium | 6.3 | 2024-08-24 | A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR… |
CVE-2024-8129 | Medium | 6.3 | 2024-08-24 | A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, D… |
CVE-2024-8128 | Medium | 6.3 | 2024-08-24 | A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-3… |
CVE-2024-7656 | High | 8.8 | 2024-08-24 | The Image Hotspot by DevVN plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.5 via deserialization of untrus… |
CVE-2024-8127 | Medium | 6.3 | 2024-08-24 | A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-… |
CVE-2024-7351 | High | 7.2 | 2024-08-24 | The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted i… |
CVE-2024-6499 | Medium | 5.3 | 2024-08-24 | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it po… |
CVE-2024-8120 | Medium | 4.7 | 2024-08-24 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is… |
CVE-2024-6631 | Medium | 5.0 | 2024-08-24 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several A… |
CVE-2024-2254 | Medium | 6.4 | 2024-08-24 | The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions… |
CVE-2024-7568 | Critical | 9.6 | 2024-08-24 | The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorre… |
CVE-2024-38207 | Medium | 6.3 | 2024-08-23 | Microsoft Edge (HTML-based) Memory Corruption Vulnerability |
CVE-2024-40111 | Medium | 4.8 | 2024-08-23 | A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject m… |
CVE-2024-37392 | Medium | 6.1 | 2024-08-23 | A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0. The vulnerability arises because the application did… |
CVE-2024-45190 | Medium | 6.5 | 2024-08-23 | Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" request |
CVE-2024-45189 | Medium | 6.5 | 2024-08-23 | Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" request |
CVE-2024-45188 | Medium | 6.5 | 2024-08-23 | Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" request |
CVE-2024-45187 | High | 7.1 | 2024-08-23 | Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access… |
CVE-2024-42914 | Critical | 9.1 | 2024-08-23 | A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the… |
CVE-2024-42845 | High | 8.0 | 2024-08-23 | An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to execute arbitrary cod… |
CVE-2024-7954 | Critical | 9.8 | 2024-08-23 | The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthentic… |
CVE-2024-42852 | Medium | 6.1 | 2024-08-23 | Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php component. |
CVE-2024-7428 | | 2024-08-23 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in OpenText™ Network Node Manager i (NNMi) allows URL Redirector Abuse.This issue affects Net… | |
CVE-2024-7427 | | 2024-08-23 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Network Node Manager i (NNMi) could allo… | |
CVE-2024-44390 | High | 8.8 | 2024-08-23 | Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function formWrlsafeset. |
CVE-2024-44387 | Medium | 6.5 | 2024-08-23 | Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the functino formWrlExtraGet. |
CVE-2024-43794 | Medium | 6.1 | 2024-08-23 | OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of… |
CVE-2024-42918 | Medium | 5.4 | 2024-08-23 | itsourcecode Online Accreditation Management System contains a Cross Site Scripting vulnerability, which allows an attacker to execute arbitrary code via a cra… |
CVE-2024-42531 | Critical | 9.8 | 2024-08-23 | Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live video stream by crafting a set of RTSP packets with a specific se… |
CVE-2024-41878 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an at… |
CVE-2024-41877 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41876 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a… |
CVE-2024-41875 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41849 | Medium | 4.1 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. A… |
CVE-2024-41848 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a… |
CVE-2024-41847 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a… |
CVE-2024-41846 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41845 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41844 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41843 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41842 | Medium | 4.8 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41841 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a… |
CVE-2024-39841 | High | 8.8 | 2024-08-23 | A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before… |
CVE-2024-33854 | Critical | 9.1 | 2024-08-23 | A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19… |
CVE-2024-33853 | Critical | 9.1 | 2024-08-23 | A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and… |
CVE-2024-33852 | Critical | 9.1 | 2024-08-23 | A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22… |
CVE-2024-32501 | Critical | 9.8 | 2024-08-23 | A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23… |
CVE-2024-44386 | High | 7.3 | 2024-08-23 | Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function fromSetIpBind. |
CVE-2024-44382 | Critical | 9.8 | 2024-08-23 | D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in the jhttpd upgrade_filter_asp function. |
CVE-2024-44381 | Critical | 9.8 | 2024-08-23 | D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in jhttpd msp_info_htm function. |
CVE-2024-43032 | Medium | 4.3 | 2024-08-23 | autMan v2.9.6 allows attackers to bypass authentication via a crafted web request. |
CVE-2024-43031 | Medium | 4.3 | 2024-08-23 | autMan v2.9.6 was discovered to contain an access control issue. |
CVE-2024-42756 | High | 8.8 | 2024-08-23 | An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page |
CVE-2024-42636 | High | 7.2 | 2024-08-23 | DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath. |
CVE-2024-42523 | High | 7.2 | 2024-08-23 | publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData |
CVE-2024-42364 | Medium | 6.5 | 2024-08-23 | Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepa… |
CVE-2024-8113 | Medium | 5.4 | 2024-08-23 | Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page… |
CVE-2024-8112 | Medium | 4.3 | 2024-08-23 | A vulnerability was found in thinkgem JeeSite 5.3. It has been rated as problematic. This issue affects some unknown processing of the file /js/a/login of the… |
CVE-2024-43791 | High | 7.8 | 2024-08-23 | RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are worl… |
CVE-2024-43782 | High | 7.7 | 2024-08-23 | This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translat… |
CVE-2024-42915 | High | 8.0 | 2024-08-23 | A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted pa… |
CVE-2024-42766 | Medium | 5.4 | 2024-08-23 | Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php. |
CVE-2024-42765 | Critical | 9.8 | 2024-08-23 | A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and… |
CVE-2024-42764 | Critical | 9.4 | 2024-08-23 | Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php. |
CVE-2024-42040 | High | 8.1 | 2024-08-23 | Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on th… |
CVE-2024-41150 | Medium | 6.3 | 2024-08-23 | An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This… |
CVE-2024-38869 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Cen… |
CVE-2024-37311 | High | 8.2 | 2024-08-23 | Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections from coolwsd to other… |
CVE-2024-5586 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in extranet lockouts report option. |
CVE-2024-5556 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module. |
CVE-2024-5490 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in aggregate reports option. |
CVE-2024-5467 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report. |
CVE-2024-5466 | High | 8.8 | 2024-08-23 | Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the… |
CVE-2024-36517 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in alerts module. |
CVE-2024-36516 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different fr… |
CVE-2024-36515 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different fr… |
CVE-2024-36514 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in file summary option. |
CVE-2024-43883 | Critical | 9.8 | 2024-08-23 | In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not drop references before new references are gained At a few places th… |
CVE-2024-7986 | High | 7.5 | 2024-08-23 | A vulnerability exists in the Rockwell Automation ThinManager® ThinServer that allows a threat actor to disclose sensitive information. A threat actor can expl… |
CVE-2024-5502 | Medium | 6.4 | 2024-08-23 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion, Dual Heading, and Vertical… |