2024 CVEs (page 196)
Page 196 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6004 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printer connect… |
CVE-2024-5210 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to prevent printer serv… |
CVE-2024-5209 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printing capabi… |
CVE-2024-4782 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to disrupt the printer'… |
CVE-2024-4781 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to crash printer commun… |
CVE-2024-4763 | High | 7.8 | 2024-08-16 | An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow a lo… |
CVE-2024-43810 | Medium | 4.6 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin |
CVE-2024-43809 | Low | 3.5 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page |
CVE-2024-43808 | Low | 3.7 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin |
CVE-2024-43807 | Medium | 4.6 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page |
CVE-2024-43381 | Medium | 5.0 | 2024-08-16 | reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. T… |
CVE-2024-42486 | Medium | 5.4 | 2024-08-16 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x bran… |
CVE-2024-2175 | High | 7.8 | 2024-08-16 | An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow… |
CVE-2024-7145 | High | 8.8 | 2024-08-16 | The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_type' parameter. This… |
CVE-2024-7144 | Medium | 6.4 | 2024-08-16 | The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including… |
CVE-2024-42466 | Critical | 9.8 | 2024-08-16 | Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue a… |
CVE-2024-42465 | Critical | 9.8 | 2024-08-16 | Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue a… |
CVE-2024-42464 | Medium | 6.5 | 2024-08-16 | Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resou… |
CVE-2024-42463 | Medium | 6.5 | 2024-08-16 | Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resou… |
CVE-2024-42462 | Critical | 9.8 | 2024-08-16 | Improper Authentication vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Bypass.This issue affects upKeeper Manager: through… |
CVE-2024-7147 | Medium | 6.4 | 2024-08-16 | The JetBlocks for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple placeholder parameters in all versions up to, and in… |
CVE-2024-7146 | High | 8.8 | 2024-08-16 | The JetTabs for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.3 via the 'switcher_preset' para… |
CVE-2024-7136 | Medium | 6.4 | 2024-08-16 | The JetSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.5.2 due to insuf… |
CVE-2024-25008 | Medium | 6.8 | 2024-08-16 | Ericsson RAN Compute and Site Controller 6610 contains a vulnerability in the Control System where Improper Input Validation can lead to arbitrary code executi… |
CVE-2024-7501 | Medium | 4.2 | 2024-08-16 | The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1… |
CVE-2024-6460 | Critical | 9.8 | 2024-08-16 | The Grow by Tradedoubler WordPress plugin through 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attacke… |
CVE-2024-7301 | High | 7.2 | 2024-08-16 | The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.24.8 d… |
CVE-2024-7422 | Medium | 4.3 | 2024-08-16 | The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or inco… |
CVE-2024-7630 | Medium | 5.3 | 2024-08-16 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 (Free) and 2.25.1 (Pre… |
CVE-2024-7853 | Medium | 6.3 | 2024-08-16 | A vulnerability was found in SourceCodester Yoga Class Registration System up to 1.0. It has been classified as critical. Affected is an unknown function of th… |
CVE-2024-7852 | Low | 3.5 | 2024-08-16 | A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as problematic. This issue affects some unknown processing of the… |
CVE-2024-7851 | Medium | 6.3 | 2024-08-16 | A vulnerability has been found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-7849 | High | 8.8 | 2024-08-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320L… |
CVE-2024-7845 | Medium | 6.3 | 2024-08-16 | A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2024-43378 | High | 7.8 | 2024-08-16 | calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS through the graphical inst… |
CVE-2024-43374 | Medium | 4.5 | 2024-08-16 | The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers… |
CVE-2024-43370 | High | 7.2 | 2024-08-16 | gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting (XSS) injection if `.po` dictionary definition files are corrupted… |
CVE-2024-43369 | High | 7.2 | 2024-08-16 | Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branch prior to 4.6.10… |
CVE-2024-7844 | Low | 3.5 | 2024-08-15 | A vulnerability has been found in SourceCodester Online Graduate Tracer System 1.0 and classified as problematic. Affected by this vulnerability is an unknown… |
CVE-2024-7843 | Medium | 5.3 | 2024-08-15 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the fil… |
CVE-2024-7842 | Medium | 5.3 | 2024-08-15 | A vulnerability, which was classified as problematic, has been found in SourceCodester Online Graduate Tracer System 1.0. This issue affects some unknown proce… |
CVE-2024-7841 | Medium | 6.3 | 2024-08-15 | A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System 1.0. This vulnerability affects unknown code of the file /… |
CVE-2024-34743 | High | 7.8 | 2024-08-15 | In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code. This could lead to local escalati… |
CVE-2024-34742 | Medium | 5.5 | 2024-08-15 | In shouldWrite of OwnersData.java, there is a possible edge case that prevents MDM policies from being persisted due to a logic error in the code. This could l… |
CVE-2024-34741 | High | 7.8 | 2024-08-15 | In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaver while lock scre… |
CVE-2024-34740 | High | 7.8 | 2024-08-15 | In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could l… |
CVE-2024-34739 | High | 7.8 | 2024-08-15 | In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a logic error in the code. This could lea… |
CVE-2024-34738 | High | 7.8 | 2024-08-15 | In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due to a logic error in… |
CVE-2024-34737 | High | 7.8 | 2024-08-15 | In ensureSetPipAspectRatioQuotaTracker of ActivityClientController.java, there is a possible way to generate unmovable and undeletable pip windows due to a log… |
CVE-2024-34736 | High | 7.8 | 2024-08-15 | In setupVideoEncoder of StagefrightRecorder.cpp, there is a possible asynchronous playback when B-frame support is enabled. This could lead to local escalation… |
CVE-2024-34734 | High | 7.8 | 2024-08-15 | In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure… |
CVE-2024-34731 | High | 7.0 | 2024-08-15 | In multiple functions of TranscodingResourcePolicy.cpp, there is a possible memory corruption due to a race condition. This could lead to local escalation of p… |
CVE-2024-34727 | High | 7.5 | 2024-08-15 | In sdpu_compare_uuid_with_attr of sdp_utils.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information dis… |
CVE-2024-31333 | High | 7.8 | 2024-08-15 | In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer overflow. This could lead to local escalation of privilege i… |
CVE-2024-7868 | High | 8.2 | 2024-08-15 | In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. The proof-of-concept PDF file… |
CVE-2024-7839 | High | 7.3 | 2024-08-15 | A vulnerability classified as critical has been found in itsourcecode Billing System 1.0. This affects an unknown part of the file addbill.php. The manipulatio… |
CVE-2024-6456 | | 2024-08-15 | AVEVA Historian Server has a vulnerability, if exploited, could allow a malicious SQL command to execute under the privileges of an interactive Historian REST… | |
CVE-2024-43367 | High | 7.5 | 2024-08-15 | Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assumption made when han… |
CVE-2024-43366 | High | 7.5 | 2024-08-15 | zkvyper is a Vyper compiler. Starting in version 1.3.12 and prior to version 1.5.3, since LLL IR has no Turing-incompletness restrictions, it is compiled to a… |
CVE-2024-42488 | Medium | 6.8 | 2024-08-15 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium… |
CVE-2024-42487 | Medium | 4.0 | 2024-08-15 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16… |
CVE-2024-7867 | Medium | 6.2 | 2024-08-15 | In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-zero. |
CVE-2024-7866 | Medium | 5.5 | 2024-08-15 | In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow. |
CVE-2024-7838 | High | 7.3 | 2024-08-15 | A vulnerability was found in itsourcecode Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-43357 | High | 8.6 | 2024-08-15 | ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, intro… |
CVE-2024-42757 | Critical | 9.8 | 2024-08-15 | Command injection vulnerability in Asus RT-N15U 3.0.0.4.376_3754 allows a remote attacker to execute arbitrary code via the netstat function page. |
CVE-2024-42476 | Medium | 6.5 | 2024-08-15 | In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the `state` parameter to prevent cross-site re… |
CVE-2024-42475 | Medium | 6.5 | 2024-08-15 | In the OAuth library for nim prior to version 0.11, the `state` values generated by the `generateState` function do not have sufficient entropy. These can be s… |
CVE-2024-42472 | Critical | 10.0 | 2024-08-15 | Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persis… |
CVE-2024-27731 | Medium | 6.1 | 2024-08-15 | Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the f… |
CVE-2024-27730 | Critical | 9.8 | 2024-08-15 | Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid param… |
CVE-2024-27729 | Medium | 6.1 | 2024-08-15 | Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar e… |
CVE-2024-27728 | Medium | 6.1 | 2024-08-15 | Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the text parameter of the babel debug fe… |
CVE-2024-25633 | Medium | 5.4 | 2024-08-15 | eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vuln… |
CVE-2024-23168 | Critical | 9.8 | 2024-08-15 | Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary cod… |
CVE-2024-32231 | Medium | 6.3 | 2024-08-15 | Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter. |
CVE-2024-22219 | Medium | 6.3 | 2024-08-15 | XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit maliciou… |
CVE-2024-22218 | High | 8.8 | 2024-08-15 | XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit maliciou… |
CVE-2024-22217 | Medium | 6.5 | 2024-08-15 | A Server-Side Request Forgery (SSRF) vulnerability in Terminalfour before 8.3.19 allows authenticated users to use specific features to access internal service… |
CVE-2024-42987 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack-based buffer overflow vulnerability in the fromPptpUserAdd function. The vulnerability can be trigg… |
CVE-2024-42986 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allows a… |
CVE-2024-42985 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromNatlimit function. This vulnerability allows attackers t… |
CVE-2024-42984 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attack… |
CVE-2024-42983 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the pptpPPW parameter in the fromAdvSetWan function. This vulnerability allows attacke… |
CVE-2024-42982 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. This vulnerability allows attackers… |
CVE-2024-42981 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows att… |
CVE-2024-42980 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function. This vulnerability allows attackers to… |
CVE-2024-42979 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ProtForm function. This vulnerability allows attackers… |
CVE-2024-42978 | Critical | 9.8 | 2024-08-15 | An issue in the handler function in /goform/telnet of Tenda FH1206 v02.03.01.35 allows attackers to execute arbitrary commands via a crafted HTTP request. |
CVE-2024-42977 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the qos parameter in the fromqossetting function. This vulnerability allows attackers… |
CVE-2024-42976 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows att… |
CVE-2024-42974 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function. This vulnerability allows… |
CVE-2024-42973 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSetlpBind function. This vulnerability allows attackers… |
CVE-2024-42969 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeUrlFilter function. This vulnerability allows attack… |
CVE-2024-42968 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the Go parameter in the fromSafeUrlFilter function. This vulnerability allows attacker… |
CVE-2024-42967 | Critical | 9.8 | 2024-08-15 | Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the… |
CVE-2024-42966 | Critical | 9.8 | 2024-08-15 | Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the… |
CVE-2024-42955 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows… |
CVE-2024-42954 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function. This vulnerability all… |
CVE-2024-42953 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPW parameter in the fromWizardHandle function. This vulnerability allows attac… |