2024 CVEs (page 189)
Page 189 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8120 | Medium | 4.7 | 2024-08-24 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is… |
CVE-2024-6631 | Medium | 5.0 | 2024-08-24 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several A… |
CVE-2024-2254 | Medium | 6.4 | 2024-08-24 | The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions… |
CVE-2024-7568 | Critical | 9.6 | 2024-08-24 | The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorre… |
CVE-2024-38207 | Medium | 6.3 | 2024-08-23 | Microsoft Edge (HTML-based) Memory Corruption Vulnerability |
CVE-2024-40111 | Medium | 4.8 | 2024-08-23 | A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject m… |
CVE-2024-37392 | Medium | 6.1 | 2024-08-23 | A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0. The vulnerability arises because the application did… |
CVE-2024-45190 | Medium | 6.5 | 2024-08-23 | Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" request |
CVE-2024-45189 | Medium | 6.5 | 2024-08-23 | Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" request |
CVE-2024-45188 | Medium | 6.5 | 2024-08-23 | Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" request |
CVE-2024-45187 | High | 7.1 | 2024-08-23 | Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access… |
CVE-2024-42914 | Critical | 9.1 | 2024-08-23 | A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the… |
CVE-2024-42845 | High | 8.0 | 2024-08-23 | An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to execute arbitrary cod… |
CVE-2024-7954 | Critical | 9.8 | 2024-08-23 | The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthentic… |
CVE-2024-42852 | Medium | 6.1 | 2024-08-23 | Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php component. |
CVE-2024-7428 | | 2024-08-23 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in OpenText™ Network Node Manager i (NNMi) allows URL Redirector Abuse.This issue affects Net… | |
CVE-2024-7427 | | 2024-08-23 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Network Node Manager i (NNMi) could allo… | |
CVE-2024-44390 | High | 8.8 | 2024-08-23 | Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function formWrlsafeset. |
CVE-2024-44387 | Medium | 6.5 | 2024-08-23 | Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the functino formWrlExtraGet. |
CVE-2024-43794 | Medium | 6.1 | 2024-08-23 | OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of… |
CVE-2024-42918 | Medium | 5.4 | 2024-08-23 | itsourcecode Online Accreditation Management System contains a Cross Site Scripting vulnerability, which allows an attacker to execute arbitrary code via a cra… |
CVE-2024-42531 | Critical | 9.8 | 2024-08-23 | Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live video stream by crafting a set of RTSP packets with a specific se… |
CVE-2024-41878 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an at… |
CVE-2024-41877 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41876 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a… |
CVE-2024-41875 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41849 | Medium | 4.1 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. A… |
CVE-2024-41848 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a… |
CVE-2024-41847 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a… |
CVE-2024-41846 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41845 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41844 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41843 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41842 | Medium | 4.8 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-41841 | Medium | 5.4 | 2024-08-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a… |
CVE-2024-39841 | High | 8.8 | 2024-08-23 | A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before… |
CVE-2024-33854 | Critical | 9.1 | 2024-08-23 | A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19… |
CVE-2024-33853 | Critical | 9.1 | 2024-08-23 | A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and… |
CVE-2024-33852 | Critical | 9.1 | 2024-08-23 | A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22… |
CVE-2024-32501 | Critical | 9.8 | 2024-08-23 | A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23… |
CVE-2024-44386 | High | 7.3 | 2024-08-23 | Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function fromSetIpBind. |
CVE-2024-44382 | Critical | 9.8 | 2024-08-23 | D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in the jhttpd upgrade_filter_asp function. |
CVE-2024-44381 | Critical | 9.8 | 2024-08-23 | D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in jhttpd msp_info_htm function. |
CVE-2024-43032 | Medium | 4.3 | 2024-08-23 | autMan v2.9.6 allows attackers to bypass authentication via a crafted web request. |
CVE-2024-43031 | Medium | 4.3 | 2024-08-23 | autMan v2.9.6 was discovered to contain an access control issue. |
CVE-2024-42756 | High | 8.8 | 2024-08-23 | An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page |
CVE-2024-42636 | High | 7.2 | 2024-08-23 | DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath. |
CVE-2024-42523 | High | 7.2 | 2024-08-23 | publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData |
CVE-2024-42364 | Medium | 6.5 | 2024-08-23 | Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepa… |
CVE-2024-8113 | Medium | 5.4 | 2024-08-23 | Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page… |
CVE-2024-8112 | Medium | 4.3 | 2024-08-23 | A vulnerability was found in thinkgem JeeSite 5.3. It has been rated as problematic. This issue affects some unknown processing of the file /js/a/login of the… |
CVE-2024-43791 | High | 7.8 | 2024-08-23 | RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are worl… |
CVE-2024-43782 | High | 7.7 | 2024-08-23 | This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translat… |
CVE-2024-42915 | High | 8.0 | 2024-08-23 | A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted pa… |
CVE-2024-42766 | Medium | 5.4 | 2024-08-23 | Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php. |
CVE-2024-42765 | Critical | 9.8 | 2024-08-23 | A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and… |
CVE-2024-42764 | Critical | 9.4 | 2024-08-23 | Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php. |
CVE-2024-42040 | High | 8.1 | 2024-08-23 | Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on th… |
CVE-2024-41150 | Medium | 6.3 | 2024-08-23 | An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This… |
CVE-2024-38869 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Cen… |
CVE-2024-37311 | High | 8.2 | 2024-08-23 | Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections from coolwsd to other… |
CVE-2024-5586 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in extranet lockouts report option. |
CVE-2024-5556 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module. |
CVE-2024-5490 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in aggregate reports option. |
CVE-2024-5467 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report. |
CVE-2024-5466 | High | 8.8 | 2024-08-23 | Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the… |
CVE-2024-36517 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in alerts module. |
CVE-2024-36516 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different fr… |
CVE-2024-36515 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different fr… |
CVE-2024-36514 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in file summary option. |
CVE-2024-43883 | Critical | 9.8 | 2024-08-23 | In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not drop references before new references are gained At a few places th… |
CVE-2024-7986 | High | 7.5 | 2024-08-23 | A vulnerability exists in the Rockwell Automation ThinManager® ThinServer that allows a threat actor to disclose sensitive information. A threat actor can expl… |
CVE-2024-5502 | Medium | 6.4 | 2024-08-23 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion, Dual Heading, and Vertical… |
CVE-2024-38807 | Medium | 6.3 | 2024-08-23 | Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be… |
CVE-2024-43105 | Medium | 4.3 | 2024-08-23 | Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume excessive resource by… |
CVE-2024-40766 | Critical | 9.8 | 2024-08-23 | An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access an… |
CVE-2024-6715 | Medium | 6.1 | 2024-08-23 | The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46… |
CVE-2024-3282 | Medium | 4.8 | 2024-08-23 | The WP Table Builder WordPress plugin through 1.5.0 does not sanitise and escape some of its Table data, which could allow high privilege users such as admin… |
CVE-2024-7258 | High | 8.8 | 2024-08-23 | The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedF… |
CVE-2024-7559 | High | 8.8 | 2024-08-23 | The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_fold… |
CVE-2024-43477 | High | 7.5 | 2024-08-23 | Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on an… |
CVE-2024-8089 | Medium | 6.3 | 2024-08-23 | A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been classified as critical. Affected is an unknown function of the file /ecommerce/a… |
CVE-2024-8087 | Medium | 6.3 | 2024-08-22 | A vulnerability was found in SourceCodester E-Commerce System 1.0 and classified as critical. This issue affects some unknown processing of the file /ecommerce… |
CVE-2024-8086 | High | 7.3 | 2024-08-22 | A vulnerability has been found in SourceCodester E-Commerce System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ecommer… |
CVE-2024-38210 | High | 7.8 | 2024-08-22 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-38209 | High | 7.8 | 2024-08-22 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-38208 | Medium | 6.1 | 2024-08-22 | Microsoft Edge for Android Spoofing Vulnerability |
CVE-2024-8084 | Low | 2.4 | 2024-08-22 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the fil… |
CVE-2024-8083 | Medium | 6.3 | 2024-08-22 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknow… |
CVE-2024-8081 | High | 7.3 | 2024-08-22 | A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-43790 | Medium | 4.5 | 2024-08-22 | Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern… |
CVE-2024-8080 | Medium | 6.3 | 2024-08-22 | A vulnerability classified as critical has been found in SourceCodester Online Health Care System 1.0. Affected is an unknown function of the file search.php… |
CVE-2024-8079 | High | 8.8 | 2024-08-22 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been rated as critical. This issue affects the function exportOvpn. The manipulat… |
CVE-2024-8078 | High | 8.8 | 2024-08-22 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been declared as critical. This vulnerability affects the function setTracerouteC… |
CVE-2024-42763 | Medium | 5.4 | 2024-08-22 | A Reflected Cross Site Scripting (XSS) vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1.0, which allows re… |
CVE-2024-42762 | Medium | 5.4 | 2024-08-22 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to… |
CVE-2024-42761 | Medium | 6.1 | 2024-08-22 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin_schedule.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attac… |
CVE-2024-8077 | Medium | 6.3 | 2024-08-22 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been classified as critical. This affects the function setTracerouteCfg. The mani… |
CVE-2024-8076 | High | 8.8 | 2024-08-22 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this issue is the function setDiagnosisCfg. The m… |
CVE-2024-8075 | Medium | 6.3 | 2024-08-22 | A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this vulnerability is the function setDiagno… |