2024 CVEs (page 190)
Page 190 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45201 | High | 8.8 | 2024-08-22 | An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. |
CVE-2024-42599 | High | 8.8 | 2024-08-22 | SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files… |
CVE-2024-42418 | High | 7.5 | 2024-08-22 | Avtec Outpost uses a default cryptographic key that can be used to decrypt sensitive information. |
CVE-2024-39776 | High | 7.5 | 2024-08-22 | Avtec Outpost stores sensitive information in an insecure location without proper access controls in place. |
CVE-2024-8088 | | 2024-08-22 | There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class i… | |
CVE-2024-39717 | High | 7.2 | 2024-08-22 | The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-D… |
CVE-2024-7634 | Medium | 4.9 | 2024-08-22 | NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secu… |
CVE-2024-42773 | Critical | 9.1 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticat… |
CVE-2024-42767 | High | 7.2 | 2024-08-22 | Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_controller.php. |
CVE-2024-42776 | High | 7.2 | 2024-08-22 | Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php. |
CVE-2024-42775 | Critical | 9.1 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticate… |
CVE-2024-42774 | High | 7.5 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attack… |
CVE-2024-42772 | High | 7.5 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to… |
CVE-2024-42768 | Medium | 6.8 | 2024-08-22 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete_room.php. |
CVE-2024-8041 | Medium | 6.5 | 2024-08-22 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1. A d… |
CVE-2024-7110 | Medium | 6.4 | 2024-08-22 | An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execu… |
CVE-2024-6502 | Medium | 5.7 | 2024-08-22 | An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 pri… |
CVE-2024-45193 | Medium | 4.3 | 2024-08-22 | An issue was discovered in Matrix libolm through 3.2.16. There is Ed25519 signature malleability due to lack of validation criteria (does not ensure that S < n… |
CVE-2024-45192 | Medium | 5.3 | 2024-08-22 | An issue was discovered in Matrix libolm through 3.2.16. Cache-timing attacks can occur due to use of base64 when decoding group session keys. This refers to t… |
CVE-2024-45191 | Medium | 5.3 | 2024-08-22 | An issue was discovered in Matrix libolm through 3.2.16. The AES implementation is vulnerable to cache-timing attacks due to use of S-boxes. This is related to… |
CVE-2024-43780 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload fil… |
CVE-2024-42771 | Medium | 4.8 | 2024-08-22 | A Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashipara Hotel Management System v1.0, which allows r… |
CVE-2024-42770 | Medium | 4.7 | 2024-08-22 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php" of Kashipara Hotel Management System v1.0, which allows remote attackers… |
CVE-2024-42769 | Medium | 6.1 | 2024-08-22 | A Reflected Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php " of Kashipara Hotel Management System v1.0, which allows remote attac… |
CVE-2024-42497 | Medium | 6.0 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems mana… |
CVE-2024-42490 | High | 7.5 | 2024-08-22 | authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoi… |
CVE-2024-40884 | Low | 2.7 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission… |
CVE-2024-3127 | Medium | 4.3 | 2024-08-22 | An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions… |
CVE-2024-36441 | Medium | 5.4 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that are received by th… |
CVE-2024-43787 | Medium | 5.0 | 2024-08-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. M… |
CVE-2024-43785 | Low | 2.5 | 2024-08-22 | gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein comman… |
CVE-2024-43398 | Medium | 5.9 | 2024-08-22 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local nam… |
CVE-2024-36445 | Critical | 9.8 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow a remote attacker to gain a root shell via TELNET without authentication. |
CVE-2024-36444 | High | 8.1 | 2024-08-22 | cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an unauthenticated attacker to gain access to device logs. |
CVE-2024-36442 | High | 8.8 | 2024-08-22 | cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the device's file system. |
CVE-2024-36440 | Medium | 6.8 | 2024-08-22 | An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device passw… |
CVE-2024-36439 | Critical | 9.4 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash value, without know… |
CVE-2024-36443 | High | 7.6 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow a remote attacker to gain read access to almost the whole file system via anonymous FTP. |
CVE-2024-43331 | Medium | 5.3 | 2024-08-22 | Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3. |
CVE-2024-7848 | Medium | 4.3 | 2024-08-22 | The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includ… |
CVE-2024-39746 | Medium | 5.9 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properl… |
CVE-2024-39745 | Medium | 5.9 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt high… |
CVE-2024-39744 | Medium | 4.3 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious… |
CVE-2024-35151 | Medium | 6.5 | 2024-08-22 | IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs. |
CVE-2024-7778 | Medium | 6.4 | 2024-08-22 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.10.36… |
CVE-2024-6870 | Medium | 6.4 | 2024-08-22 | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4… |
CVE-2024-8072 | Medium | 5.3 | 2024-08-22 | Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users |
CVE-2024-8071 | Medium | 4.7 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which a… |
CVE-2024-43813 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any… |
CVE-2024-42411 | Medium | 5.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to ma… |
CVE-2024-40886 | Medium | 4.6 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection… |
CVE-2024-39836 | Medium | 4.8 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or r… |
CVE-2024-39810 | Medium | 4.9 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a Sy… |
CVE-2024-32939 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original e… |
CVE-2024-45169 | Critical | 9.8 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction… |
CVE-2024-45168 | Critical | 9.1 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is transferred over a raw socket without any authentication mechanism. Thus, co… |
CVE-2024-45167 | Critical | 9.8 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction… |
CVE-2024-45166 | Critical | 9.8 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction… |
CVE-2024-45165 | Medium | 5.3 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived… |
CVE-2024-45163 | Critical | 9.1 | 2024-08-22 | The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and control) server. Unauthenticated sessions remain open, caus… |
CVE-2024-7836 | Medium | 4.3 | 2024-08-22 | The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all ver… |
CVE-2024-7384 | High | 7.5 | 2024-08-22 | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due… |
CVE-2024-5583 | Medium | 6.4 | 2024-08-22 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-39576 | High | 8.8 | 2024-08-22 | Dell Power Manager (DPM), versions 3.15.0 and prior, contains an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access coul… |
CVE-2024-43033 | High | 8.8 | 2024-08-22 | JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such… |
CVE-2024-42056 | Medium | 6.5 | 2024-08-22 | Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be… |
CVE-2024-28987 | Critical | 9.1 | 2024-08-21 | The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functi… |
CVE-2024-8035 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2024-8034 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted H… |
CVE-2024-8033 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed an attacker who convinced a user to install a malici… |
CVE-2024-7981 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromi… |
CVE-2024-7980 | High | 7.8 | 2024-08-21 | Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a cra… |
CVE-2024-7979 | High | 7.8 | 2024-08-21 | Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a cra… |
CVE-2024-7978 | Medium | 4.3 | 2024-08-21 | Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to engage in specific U… |
CVE-2024-7977 | High | 7.8 | 2024-08-21 | Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a mal… |
CVE-2024-7976 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromi… |
CVE-2024-7975 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2024-7974 | High | 8.8 | 2024-08-21 | Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted C… |
CVE-2024-7973 | High | 8.8 | 2024-08-21 | Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file… |
CVE-2024-7972 | High | 8.8 | 2024-08-21 | Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds memory access via a c… |
CVE-2024-7971 | Critical | 9.6 | 2024-08-21 | Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security s… |
CVE-2024-7969 | High | 8.8 | 2024-08-21 | Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2024-7968 | High | 8.8 | 2024-08-21 | Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had convinced the user to engage in specific UI interactions t… |
CVE-2024-7967 | High | 8.8 | 2024-08-21 | Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-7966 | High | 8.8 | 2024-08-21 | Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer process to perform out o… |
CVE-2024-7965 | High | 8.8 | 2024-08-21 | Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2024-7964 | High | 8.8 | 2024-08-21 | Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2024-6386 | Critical | 9.9 | 2024-08-21 | The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This… |
CVE-2024-20486 | Medium | 6.5 | 2024-08-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2024-20466 | Medium | 6.5 | 2024-08-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2024-20417 | Medium | 6.5 | 2024-08-21 | Multiple vulnerabilities in the REST API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct blind SQL injection a… |
CVE-2024-41572 | Medium | 6.1 | 2024-08-21 | Learning with Texts (LWT) 2.0.3 is vulnerable to Cross Site Scripting (XSS). The application has a specific function that does not filter special characters in… |
CVE-2024-20488 | Medium | 6.1 | 2024-08-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2024-42786 | High | 8.8 | 2024-08-21 | A SQL injection vulnerability in "/music/view_user.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the… |
CVE-2024-42785 | High | 8.8 | 2024-08-21 | A SQL injection vulnerability in /music/index.php?page=view_playlist in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-42784 | Critical | 9.8 | 2024-08-21 | A SQL injection vulnerability in "/music/controller.php?page=view_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL… |
CVE-2024-42783 | Critical | 9.8 | 2024-08-21 | Kashipara Music Management System v1.0 is vulnerable to SQL Injection via /music/manage_playlist_items.php. An attacker can execute arbitrary SQL commands via… |
CVE-2024-42782 | Critical | 9.8 | 2024-08-21 | A SQL injection vulnerability in "/music/ajax.php?action=find_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-42781 | Critical | 9.8 | 2024-08-21 | A SQL injection vulnerability in "/music/ajax.php?action=login" of Kashipara Music Management System v1.0 allows remote attackers to execute arbitrary SQL comm… |
CVE-2024-42780 | High | 8.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_genre" in Kashipara Music Management System v1.0. This allows attackers to… |