2024 CVEs (page 191)
Page 191 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-42779 | High | 8.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This allows attackers to… |
CVE-2024-42778 | High | 8.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This allows attackers… |
CVE-2024-42777 | Critical | 9.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which allows attackers to exe… |
CVE-2024-7448 | High | 8.0 | 2024-08-21 | Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2024-6141 | High | 7.8 | 2024-08-21 | Windscribe Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installat… |
CVE-2024-5930 | High | 7.8 | 2024-08-21 | VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2024-5929 | High | 7.8 | 2024-08-21 | VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalat… |
CVE-2024-5928 | High | 7.8 | 2024-08-21 | VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on af… |
CVE-2024-5762 | High | 8.1 | 2024-08-21 | Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-5725 | High | 8.8 | 2024-08-21 | Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst… |
CVE-2024-5723 | High | 8.8 | 2024-08-21 | Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-43022 | High | 7.5 | 2024-08-21 | An issue in the downloader.php component of TOSEI online store management system v4.02, v4.03, and v4.04 allows attackers to execute a directory traversal. |
CVE-2024-42550 | Medium | 5.4 | 2024-08-21 | A cross-site scripting (XSS) vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d allows attackers to… |
CVE-2024-40453 | Critical | 9.8 | 2024-08-21 | squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName. |
CVE-2024-33657 | High | 7.8 | 2024-08-21 | This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMR… |
CVE-2024-33656 | High | 7.8 | 2024-08-21 | The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory. This could lead to privilege escalation, arbi… |
CVE-2024-20375 | High | 8.6 | 2024-08-21 | A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Manag… |
CVE-2024-7795 | High | 8.8 | 2024-08-21 | Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows n… |
CVE-2024-7725 | High | 8.8 | 2024-08-21 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-7724 | High | 8.8 | 2024-08-21 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-7723 | High | 8.8 | 2024-08-21 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-7722 | Medium | 4.3 | 2024-08-21 | Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information o… |
CVE-2024-7604 | High | 7.8 | 2024-08-21 | Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability. This vulnerability allows local attackers to bypass authentication… |
CVE-2024-7603 | High | 8.1 | 2024-08-21 | Logsign Unified SecOps Platform Directory Traversal Arbitrary Directory Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary… |
CVE-2024-7602 | Medium | 6.5 | 2024-08-21 | Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive info… |
CVE-2024-7601 | High | 8.1 | 2024-08-21 | Logsign Unified SecOps Platform Directory data_export_delete_all Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-7600 | High | 8.1 | 2024-08-21 | Logsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files… |
CVE-2024-6814 | High | 8.8 | 2024-08-21 | NETGEAR ProSAFE Network Management System getFilterString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… |
CVE-2024-6813 | High | 8.8 | 2024-08-21 | NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2024-6812 | High | 7.8 | 2024-08-21 | IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2024-6811 | High | 7.8 | 2024-08-21 | IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2024-43411 | Low | 3.1 | 2024-08-21 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly… |
CVE-2024-43410 | High | 7.5 | 2024-08-21 | Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. An SSH packet cons… |
CVE-2024-43027 | High | 8.0 | 2024-08-21 | DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before v1.5.1.5_Beta were discovered to contain a comma… |
CVE-2024-41937 | Medium | 6.1 | 2024-08-21 | Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when cl… |
CVE-2024-39344 | High | 8.1 | 2024-08-21 | An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the market… |
CVE-2024-21690 | High | 8.2 | 2024-08-21 | This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4… |
CVE-2024-43407 | Medium | 6.1 | 2024-08-21 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. Th… |
CVE-2024-43371 | Medium | 4.5 | 2024-08-21 | CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resou… |
CVE-2024-41675 | Medium | 6.8 | 2024-08-21 | CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming fr… |
CVE-2024-41674 | Medium | 5.3 | 2024-08-21 | CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr… |
CVE-2024-8007 | High | 8.1 | 2024-08-21 | A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy… |
CVE-2024-7885 | High | 7.5 | 2024-08-21 | A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs wh… |
CVE-2024-28000 | Critical | 9.8 | 2024-08-21 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <=… |
CVE-2024-37008 | High | 7.8 | 2024-08-21 | A maliciously crafted DWG file, when parsed in Revit, can force a stack-based buffer overflow. A malicious actor can leverage this vulnerability to execute arb… |
CVE-2024-5335 | Critical | 9.8 | 2024-08-21 | The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is v… |
CVE-2024-6339 | Medium | 6.1 | 2024-08-21 | The Phlox PRO theme for WordPress is vulnerable to Reflected Cross-Site Scripting via search parameters in all versions up to, and including, 5.16.4 due to ins… |
CVE-2024-7998 | Low | 2.6 | 2024-08-21 | In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan. |
CVE-2024-7854 | Critical | 10.0 | 2024-08-21 | The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied… |
CVE-2024-7651 | Medium | 5.6 | 2024-08-21 | The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ param… |
CVE-2024-7647 | Medium | 6.1 | 2024-08-21 | The OTA Sync Booking Engine Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to… |
CVE-2024-7629 | Medium | 6.4 | 2024-08-21 | The Responsive video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's video settings function in all versions up to, and incl… |
CVE-2024-7390 | Medium | 5.3 | 2024-08-21 | The WP Testimonial Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnSaveTestimonailOrd… |
CVE-2024-7134 | High | 7.2 | 2024-08-21 | The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘form_data’ parameter in al… |
CVE-2024-7090 | Medium | 6.1 | 2024-08-21 | The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lh_add_media_from_url-file_url’ parameter in all versio… |
CVE-2024-7032 | Medium | 6.5 | 2024-08-21 | The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'moo_deactivateAndCl… |
CVE-2024-7030 | Medium | 4.3 | 2024-08-21 | The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several function… |
CVE-2024-7013 | High | 7.8 | 2024-08-21 | Stack-based buffer overflow in Control FPWIN Pro version 7.7.2.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafte… |
CVE-2024-6883 | Medium | 4.3 | 2024-08-21 | The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings modification due to… |
CVE-2024-6767 | Medium | 5.5 | 2024-08-21 | The WordSurvey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sounding_title’ parameter in all versions up to, and including, 3.2 d… |
CVE-2024-6568 | Medium | 5.3 | 2024-08-21 | The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. Th… |
CVE-2024-6508 | High | 8.0 | 2024-08-21 | An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulner… |
CVE-2024-5880 | Medium | 4.3 | 2024-08-21 | The Hide My Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 due to the plugin not restricti… |
CVE-2024-42939 | Medium | 5.4 | 2024-08-21 | A cross-site scripting (XSS) vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2024-38305 | High | 7.3 | 2024-08-21 | Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privileged authenticate… |
CVE-2024-43882 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec vi… |
CVE-2024-43881 | High | 8.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: change DMA direction while mapping reinjected packets For fragmented packet… |
CVE-2024-43880 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_erp: Fix object nesting warning ACLs in Spectrum-2 and newer ASICs ca… |
CVE-2024-43879 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() Currently N… |
CVE-2024-43878 | High | 8.1 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state… |
CVE-2024-43877 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: media: pci: ivtv: Add check for DMA map result In case DMA fails, 'dma->SG_length' is 0… |
CVE-2024-43876 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() Avoid large back… |
CVE-2024-43875 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Clean up error handling in vpci_scan_bus() Smatch complains about inconsis… |
CVE-2024-43874 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix null pointer dereference in __sev_snp_shutdown_locked Fix a null pointe… |
CVE-2024-43873 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: always initialize seqpacket_allow There are two issues around seqpacket_allo… |
CVE-2024-43872 | High | 7.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix soft lockup under heavy CEQE load CEQEs are handled in interrupt handler cu… |
CVE-2024-43871 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() It will cause memory l… |
CVE-2024-43870 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries a… |
CVE-2024-43869 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exec and file release The perf pending task work is never waite… |
CVE-2024-8023 | Medium | 6.3 | 2024-08-21 | A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list… |
CVE-2024-8022 | Low | 3.5 | 2024-08-21 | A vulnerability was found in Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05. It has been rated as problematic. This issue affects some unknown processing o… |
CVE-2024-43868 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: riscv/purgatory: align riscv_kernel_entry When alignment handling is delegated to the ker… |
CVE-2024-43867 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix refcount underflow Calling nouveau_bo_ref() on a nouveau_bo witho… |
CVE-2024-43866 | Medium | 4.7 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always drain health in shutdown callback There is no point in recovery during d… |
CVE-2024-43865 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Re-add exception handling in load_fpu_state() With the recent rewrite of the fp… |
CVE-2024-43864 | Critical | 9.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix CT entry update leaks of modify header context The cited commit allocates… |
CVE-2024-43863 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a deadlock in dma buf fence polling Introduce a version of the fence ops… |
CVE-2024-43862 | Medium | 5.5 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: net: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex The carrier_lock spinloc… |
CVE-2024-22281 | High | 7.5 | 2024-08-20 | ** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their… |
CVE-2024-43861 | Medium | 5.5 | 2024-08-20 | In the Linux kernel, the following vulnerability has been resolved: net: usb: qmi_wwan: fix memory leak for not ip packets Free the unused skb when not ip pa… |
CVE-2024-43403 | High | 8.8 | 2024-08-20 | Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with a ClusterRole calle… |
CVE-2024-43396 | Medium | 5.4 | 2024-08-20 | Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting i… |
CVE-2024-42363 | High | 8.8 | 2024-08-20 | Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the Role… |
CVE-2024-42362 | High | 8.8 | 2024-08-20 | Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. Th… |
CVE-2024-42361 | High | 7.5 | 2024-08-20 | Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to downl… |
CVE-2024-41658 | Medium | 6.1 | 2024-08-20 | Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, he purchase URL that is created to… |
CVE-2024-41657 | High | 8.1 | 2024-08-20 | Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the… |
CVE-2024-7711 | Medium | 4.3 | 2024-08-20 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any iss… |
CVE-2024-6800 | Critical | 9.8 | 2024-08-20 | An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizin… |
CVE-2024-6337 | Medium | 6.5 | 2024-08-20 | An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pull_request_write: w… |