2024 CVEs (page 190)
Page 190 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38807 | Medium | 6.3 | 2024-08-23 | Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be… |
CVE-2024-43105 | Medium | 4.3 | 2024-08-23 | Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume excessive resource by… |
CVE-2024-40766 | Critical | 9.8 | 2024-08-23 | An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access an… |
CVE-2024-6715 | Medium | 6.1 | 2024-08-23 | The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46… |
CVE-2024-3282 | Medium | 4.8 | 2024-08-23 | The WP Table Builder WordPress plugin through 1.5.0 does not sanitise and escape some of its Table data, which could allow high privilege users such as admin… |
CVE-2024-7258 | High | 8.8 | 2024-08-23 | The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedF… |
CVE-2024-7559 | High | 8.8 | 2024-08-23 | The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_fold… |
CVE-2024-43477 | High | 7.5 | 2024-08-23 | Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on an… |
CVE-2024-8089 | Medium | 6.3 | 2024-08-23 | A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been classified as critical. Affected is an unknown function of the file /ecommerce/a… |
CVE-2024-8087 | Medium | 6.3 | 2024-08-22 | A vulnerability was found in SourceCodester E-Commerce System 1.0 and classified as critical. This issue affects some unknown processing of the file /ecommerce… |
CVE-2024-8086 | High | 7.3 | 2024-08-22 | A vulnerability has been found in SourceCodester E-Commerce System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ecommer… |
CVE-2024-38210 | High | 7.8 | 2024-08-22 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-38209 | High | 7.8 | 2024-08-22 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-38208 | Medium | 6.1 | 2024-08-22 | Microsoft Edge for Android Spoofing Vulnerability |
CVE-2024-8084 | Low | 2.4 | 2024-08-22 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the fil… |
CVE-2024-8083 | Medium | 6.3 | 2024-08-22 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknow… |
CVE-2024-8081 | High | 7.3 | 2024-08-22 | A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-43790 | Medium | 4.5 | 2024-08-22 | Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern… |
CVE-2024-8080 | Medium | 6.3 | 2024-08-22 | A vulnerability classified as critical has been found in SourceCodester Online Health Care System 1.0. Affected is an unknown function of the file search.php… |
CVE-2024-8079 | High | 8.8 | 2024-08-22 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been rated as critical. This issue affects the function exportOvpn. The manipulat… |
CVE-2024-8078 | High | 8.8 | 2024-08-22 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been declared as critical. This vulnerability affects the function setTracerouteC… |
CVE-2024-42763 | Medium | 5.4 | 2024-08-22 | A Reflected Cross Site Scripting (XSS) vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1.0, which allows re… |
CVE-2024-42762 | Medium | 5.4 | 2024-08-22 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to… |
CVE-2024-42761 | Medium | 6.1 | 2024-08-22 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin_schedule.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attac… |
CVE-2024-8077 | Medium | 6.3 | 2024-08-22 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been classified as critical. This affects the function setTracerouteCfg. The mani… |
CVE-2024-8076 | High | 8.8 | 2024-08-22 | A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this issue is the function setDiagnosisCfg. The m… |
CVE-2024-8075 | Medium | 6.3 | 2024-08-22 | A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this vulnerability is the function setDiagno… |
CVE-2024-45201 | High | 8.8 | 2024-08-22 | An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. |
CVE-2024-42599 | High | 8.8 | 2024-08-22 | SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files… |
CVE-2024-42418 | High | 7.5 | 2024-08-22 | Avtec Outpost uses a default cryptographic key that can be used to decrypt sensitive information. |
CVE-2024-39776 | High | 7.5 | 2024-08-22 | Avtec Outpost stores sensitive information in an insecure location without proper access controls in place. |
CVE-2024-8088 | | 2024-08-22 | There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class i… | |
CVE-2024-39717 | High | 7.2 | 2024-08-22 | The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-D… |
CVE-2024-7634 | Medium | 4.9 | 2024-08-22 | NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secu… |
CVE-2024-42773 | Critical | 9.1 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticat… |
CVE-2024-42767 | High | 7.2 | 2024-08-22 | Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_controller.php. |
CVE-2024-42776 | High | 7.2 | 2024-08-22 | Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php. |
CVE-2024-42775 | Critical | 9.1 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticate… |
CVE-2024-42774 | High | 7.5 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attack… |
CVE-2024-42772 | High | 7.5 | 2024-08-22 | An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to… |
CVE-2024-42768 | Medium | 6.8 | 2024-08-22 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete_room.php. |
CVE-2024-8041 | Medium | 6.5 | 2024-08-22 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1. A d… |
CVE-2024-7110 | Medium | 6.4 | 2024-08-22 | An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execu… |
CVE-2024-6502 | Medium | 5.7 | 2024-08-22 | An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 pri… |
CVE-2024-45193 | Medium | 4.3 | 2024-08-22 | An issue was discovered in Matrix libolm through 3.2.16. There is Ed25519 signature malleability due to lack of validation criteria (does not ensure that S < n… |
CVE-2024-45192 | Medium | 5.3 | 2024-08-22 | An issue was discovered in Matrix libolm through 3.2.16. Cache-timing attacks can occur due to use of base64 when decoding group session keys. This refers to t… |
CVE-2024-45191 | Medium | 5.3 | 2024-08-22 | An issue was discovered in Matrix libolm through 3.2.16. The AES implementation is vulnerable to cache-timing attacks due to use of S-boxes. This is related to… |
CVE-2024-43780 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload fil… |
CVE-2024-42771 | Medium | 4.8 | 2024-08-22 | A Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashipara Hotel Management System v1.0, which allows r… |
CVE-2024-42770 | Medium | 4.7 | 2024-08-22 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php" of Kashipara Hotel Management System v1.0, which allows remote attackers… |
CVE-2024-42769 | Medium | 6.1 | 2024-08-22 | A Reflected Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php " of Kashipara Hotel Management System v1.0, which allows remote attac… |
CVE-2024-42497 | Medium | 6.0 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems mana… |
CVE-2024-42490 | High | 7.5 | 2024-08-22 | authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoi… |
CVE-2024-40884 | Low | 2.7 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission… |
CVE-2024-3127 | Medium | 4.3 | 2024-08-22 | An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions… |
CVE-2024-36441 | Medium | 5.4 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that are received by th… |
CVE-2024-43787 | Medium | 5.0 | 2024-08-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. M… |
CVE-2024-43785 | Low | 2.5 | 2024-08-22 | gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein comman… |
CVE-2024-43398 | Medium | 5.9 | 2024-08-22 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local nam… |
CVE-2024-36445 | Critical | 9.8 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow a remote attacker to gain a root shell via TELNET without authentication. |
CVE-2024-36444 | High | 8.1 | 2024-08-22 | cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an unauthenticated attacker to gain access to device logs. |
CVE-2024-36442 | High | 8.8 | 2024-08-22 | cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the device's file system. |
CVE-2024-36440 | Medium | 6.8 | 2024-08-22 | An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device passw… |
CVE-2024-36439 | Critical | 9.4 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash value, without know… |
CVE-2024-36443 | High | 7.6 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow a remote attacker to gain read access to almost the whole file system via anonymous FTP. |
CVE-2024-43331 | Medium | 5.3 | 2024-08-22 | Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3. |
CVE-2024-7848 | Medium | 4.3 | 2024-08-22 | The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includ… |
CVE-2024-39746 | Medium | 5.9 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properl… |
CVE-2024-39745 | Medium | 5.9 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt high… |
CVE-2024-39744 | Medium | 4.3 | 2024-08-22 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious… |
CVE-2024-35151 | Medium | 6.5 | 2024-08-22 | IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs. |
CVE-2024-7778 | Medium | 6.4 | 2024-08-22 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.10.36… |
CVE-2024-6870 | Medium | 6.4 | 2024-08-22 | The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4… |
CVE-2024-8072 | Medium | 5.3 | 2024-08-22 | Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users |
CVE-2024-8071 | Medium | 4.7 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which a… |
CVE-2024-43813 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any… |
CVE-2024-42411 | Medium | 5.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to ma… |
CVE-2024-40886 | Medium | 4.6 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection… |
CVE-2024-39836 | Medium | 4.8 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or r… |
CVE-2024-39810 | Medium | 4.9 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a Sy… |
CVE-2024-32939 | Medium | 4.3 | 2024-08-22 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original e… |
CVE-2024-45169 | Critical | 9.8 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction… |
CVE-2024-45168 | Critical | 9.1 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is transferred over a raw socket without any authentication mechanism. Thus, co… |
CVE-2024-45167 | Critical | 9.8 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction… |
CVE-2024-45166 | Critical | 9.8 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction… |
CVE-2024-45165 | Medium | 5.3 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived… |
CVE-2024-45163 | Critical | 9.1 | 2024-08-22 | The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and control) server. Unauthenticated sessions remain open, caus… |
CVE-2024-7836 | Medium | 4.3 | 2024-08-22 | The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all ver… |
CVE-2024-7384 | High | 7.5 | 2024-08-22 | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due… |
CVE-2024-5583 | Medium | 6.4 | 2024-08-22 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-39576 | High | 8.8 | 2024-08-22 | Dell Power Manager (DPM), versions 3.15.0 and prior, contains an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access coul… |
CVE-2024-43033 | High | 8.8 | 2024-08-22 | JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such… |
CVE-2024-42056 | Medium | 6.5 | 2024-08-22 | Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be… |
CVE-2024-28987 | Critical | 9.1 | 2024-08-21 | The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functi… |
CVE-2024-8035 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2024-8034 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted H… |
CVE-2024-8033 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed an attacker who convinced a user to install a malici… |
CVE-2024-7981 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromi… |
CVE-2024-7980 | High | 7.8 | 2024-08-21 | Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a cra… |
CVE-2024-7979 | High | 7.8 | 2024-08-21 | Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a cra… |