2024 CVEs (page 192)
Page 192 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41773 | Medium | 6.5 | 2024-08-20 | IBM Global Configuration Management 7.0.2 and 7.0.3 could allow an authenticated user to archive a global baseline due to improper access controls. |
CVE-2024-41659 | High | 8.1 | 2024-08-20 | memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected wi… |
CVE-2024-31842 | High | 8.8 | 2024-08-20 | An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string f… |
CVE-2024-42619 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?id=0&list=whitelist&remove=pligg… |
CVE-2024-38175 | Critical | 9.6 | 2024-08-20 | An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privileges over a netwo… |
CVE-2024-6322 | Medium | 5.4 | 2024-08-20 | Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associat… |
CVE-2024-42612 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?whitelist_add |
CVE-2024-35214 | | 2024-08-20 | A tampering vulnerability in the CylanceOPTICS Windows Installer Package of CylanceOPTICS for Windows version 3.2 and 3.3 could allow an attacker to potentiall… | |
CVE-2024-43408 | Medium | 6.3 | 2024-08-20 | Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post. The vulnerability… |
CVE-2024-42919 | Critical | 9.8 | 2024-08-20 | eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport. |
CVE-2024-42598 | Medium | 6.7 | 2024-08-20 | SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_editplayer.php imposes restrictions on edited f… |
CVE-2024-40743 | Medium | 6.1 | 2024-08-20 | The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. |
CVE-2024-27187 | High | 7.5 | 2024-08-20 | Improper Access Controls allows backend users to overwrite their username when disallowed. |
CVE-2024-27186 | Medium | 6.1 | 2024-08-20 | The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. |
CVE-2024-27185 | Critical | 9.1 | 2024-08-20 | The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors. |
CVE-2024-27184 | Medium | 6.1 | 2024-08-20 | Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.. |
CVE-2024-43409 | Medium | 6.5 | 2024-08-20 | Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only… |
CVE-2024-43406 | High | 8.8 | 2024-08-20 | LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit… |
CVE-2024-43404 | Critical | 9.8 | 2024-08-20 | MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execut… |
CVE-2024-43397 | Medium | 4.3 | 2024-08-20 | Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests t… |
CVE-2024-43377 | Medium | 5.4 | 2024-08-20 | Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2. |
CVE-2024-43376 | Medium | 4.3 | 2024-08-20 | Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability… |
CVE-2024-42662 | High | 7.5 | 2024-08-20 | An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request. |
CVE-2024-42621 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_editor.php |
CVE-2024-42618 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karma |
CVE-2024-42617 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_config.php?action=save&var_id=32 |
CVE-2024-42616 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=remove&widget=Statistics |
CVE-2024-42613 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=install&widget=akismet |
CVE-2024-42611 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/admin_page.php?link_id=1&mode=delete |
CVE-2024-42610 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=files |
CVE-2024-42609 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=avatars |
CVE-2024-42607 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=database |
CVE-2024-42606 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_log.php?clear=1 |
CVE-2024-42605 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/edit_page.php?link_id=1 |
CVE-2024-42604 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_group.php?mode=delete&group_id=3 |
CVE-2024-42603 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=clearall |
CVE-2024-42369 | Medium | 4.1 | 2024-08-20 | matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predeces… |
CVE-2024-39690 | High | 8.4 | 2024-08-20 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that ha… |
CVE-2024-35540 | Critical | 9.0 | 2024-08-20 | A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2024-30949 | Critical | 9.8 | 2024-08-20 | An issue in newlib v.4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the _gettimeofday function. |
CVE-2024-8005 | High | 7.3 | 2024-08-20 | A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.g… |
CVE-2024-8003 | Low | 3.5 | 2024-08-20 | A vulnerability was found in Go-Tribe gotribe-admin 1.0 and classified as problematic. Affected by this issue is the function InitRoutes of the file internal/a… |
CVE-2024-6379 | High | 7.7 | 2024-08-20 | A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker… |
CVE-2024-6378 | High | 8.7 | 2024-08-20 | A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPER… |
CVE-2024-6377 | High | 8.1 | 2024-08-20 | An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIEN… |
CVE-2024-42608 | High | 8.8 | 2024-08-20 | Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/submit_page.php. |
CVE-2024-42006 | High | 7.5 | 2024-08-20 | Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure. |
CVE-2024-39094 | Medium | 5.4 | 2024-08-20 | Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters. |
CVE-2024-34458 | High | 7.5 | 2024-08-20 | Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure. |
CVE-2024-33872 | Critical | 9.8 | 2024-08-20 | Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges. |
CVE-2024-6918 | High | 7.5 | 2024-08-20 | CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the Accutech Manager when rece… |
CVE-2024-42586 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42585 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42584 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42583 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42582 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42581 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42580 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42579 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42578 | High | 8.0 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42577 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42576 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges. |
CVE-2024-42575 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php. |
CVE-2024-42574 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at attendance.php. |
CVE-2024-42573 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at dtmarks.php. |
CVE-2024-42572 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at unitmarks.php. |
CVE-2024-42571 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at insertattendance.php. |
CVE-2024-42570 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at admininsert.php. |
CVE-2024-42569 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php. |
CVE-2024-42568 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php. |
CVE-2024-42567 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at /search.php?action=2. |
CVE-2024-42566 | Critical | 9.8 | 2024-08-20 | School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.php |
CVE-2024-42565 | Critical | 9.8 | 2024-08-20 | ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete. |
CVE-2024-42564 | High | 7.6 | 2024-08-20 | ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/inventory/delete?action=delete. |
CVE-2024-42563 | Critical | 9.8 | 2024-08-20 | An arbitrary file upload vulnerability in ERP commit 44bd04 allows attackers to execute arbitrary code via uploading a crafted HTML file. |
CVE-2024-42562 | Critical | 9.8 | 2024-08-20 | Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice_number parameter at preview.php. |
CVE-2024-42561 | High | 8.8 | 2024-08-20 | Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice_number parameter at sales_report.php. |
CVE-2024-42560 | Medium | 6.1 | 2024-08-20 | A cross-site scripting (XSS) vulnerability in the component update_page_details.php of Blood Bank And Donation Management System commit dc9e039 allows attacker… |
CVE-2024-42559 | Critical | 9.8 | 2024-08-20 | An issue in the login component (process_login.php) of Hotel Management System commit 79d688 allows attackers to authenticate without providing a valid passwor… |
CVE-2024-42558 | Critical | 9.8 | 2024-08-20 | Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_modify_room.php. |
CVE-2024-42557 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component admin_modify_room.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges. |
CVE-2024-42556 | Critical | 9.8 | 2024-08-20 | Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_removed.php. |
CVE-2024-42555 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component admin_room_removed.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges. |
CVE-2024-42554 | High | 8.8 | 2024-08-20 | Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_added.php. |
CVE-2024-42553 | High | 8.8 | 2024-08-20 | A Cross-Site Request Forgery (CSRF) in the component admin_room_added.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges. |
CVE-2024-42552 | High | 8.6 | 2024-08-20 | Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_room_history.php. |
CVE-2024-42336 | High | 8.2 | 2024-08-20 | Servision - CWE-287: Improper Authentication |
CVE-2024-42335 | Medium | 5.4 | 2024-08-20 | 7Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2024-41700 | High | 7.5 | 2024-08-20 | Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-41699 | Medium | 4.4 | 2024-08-20 | Priority – CWE-552: Files or Directories Accessible to External Parties |
CVE-2024-41698 | Medium | 4.3 | 2024-08-20 | Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2024-41697 | Medium | 6.1 | 2024-08-20 | Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
CVE-2024-25009 | Medium | 6.5 | 2024-08-20 | Ericsson Packet Core Controller (PCC) contains a vulnerability in Access and Mobility Management Function (AMF) where improper input validation can lead to den… |
CVE-2024-7054 | Medium | 6.4 | 2024-08-20 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-28829 | High | 7.8 | 2024-08-20 | Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0p12, 2.2.0p32, 2.1.0p47 and 2.0.0 (EOL)… |
CVE-2024-21689 | High | 8.0 | 2024-08-20 | This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo… |
CVE-2024-43202 | Critical | 9.8 | 2024-08-20 | Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache… |
CVE-2024-38808 | Medium | 4.3 | 2024-08-20 | In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language… |
CVE-2024-6847 | Critical | 9.8 | 2024-08-20 | The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL i… |
CVE-2024-5576 | Medium | 6.4 | 2024-08-20 | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute within the plugin's C… |