2024 CVEs (page 197)
Page 197 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25633 | Medium | 5.4 | 2024-08-15 | eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vuln… |
CVE-2024-23168 | Critical | 9.8 | 2024-08-15 | Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary cod… |
CVE-2024-32231 | Medium | 6.3 | 2024-08-15 | Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter. |
CVE-2024-22219 | Medium | 6.3 | 2024-08-15 | XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit maliciou… |
CVE-2024-22218 | High | 8.8 | 2024-08-15 | XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit maliciou… |
CVE-2024-22217 | Medium | 6.5 | 2024-08-15 | A Server-Side Request Forgery (SSRF) vulnerability in Terminalfour before 8.3.19 allows authenticated users to use specific features to access internal service… |
CVE-2024-42987 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack-based buffer overflow vulnerability in the fromPptpUserAdd function. The vulnerability can be trigg… |
CVE-2024-42986 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allows a… |
CVE-2024-42985 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromNatlimit function. This vulnerability allows attackers t… |
CVE-2024-42984 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attack… |
CVE-2024-42983 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the pptpPPW parameter in the fromAdvSetWan function. This vulnerability allows attacke… |
CVE-2024-42982 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. This vulnerability allows attackers… |
CVE-2024-42981 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows att… |
CVE-2024-42980 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function. This vulnerability allows attackers to… |
CVE-2024-42979 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ProtForm function. This vulnerability allows attackers… |
CVE-2024-42978 | Critical | 9.8 | 2024-08-15 | An issue in the handler function in /goform/telnet of Tenda FH1206 v02.03.01.35 allows attackers to execute arbitrary commands via a crafted HTTP request. |
CVE-2024-42977 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the qos parameter in the fromqossetting function. This vulnerability allows attackers… |
CVE-2024-42976 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows att… |
CVE-2024-42974 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function. This vulnerability allows… |
CVE-2024-42973 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSetlpBind function. This vulnerability allows attackers… |
CVE-2024-42969 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeUrlFilter function. This vulnerability allows attack… |
CVE-2024-42968 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the Go parameter in the fromSafeUrlFilter function. This vulnerability allows attacker… |
CVE-2024-42967 | Critical | 9.8 | 2024-08-15 | Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the… |
CVE-2024-42966 | Critical | 9.8 | 2024-08-15 | Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the… |
CVE-2024-42955 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows… |
CVE-2024-42954 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function. This vulnerability all… |
CVE-2024-42953 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPW parameter in the fromWizardHandle function. This vulnerability allows attac… |
CVE-2024-42952 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromqossetting function. This vulnerability allows attack… |
CVE-2024-42951 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the mit_pptpusrpw parameter in the fromWizardHandle function. This vulnerability al… |
CVE-2024-42950 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the Go parameter in the fromSafeClientFilter function. This vulnerability allows at… |
CVE-2024-42949 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the qos parameter in the fromqossetting function. This vulnerability allows attacke… |
CVE-2024-42948 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows… |
CVE-2024-42947 | Critical | 9.8 | 2024-08-15 | An issue in the handler function in /goform/telnet of Tenda FH1201 v1.2.0.14 (408) allows attackers to execute arbitrary commands via a crafted HTTP request. |
CVE-2024-42946 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. This vulnerability allows attack… |
CVE-2024-42945 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromAddressNat function. This vulnerability allows attack… |
CVE-2024-42944 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromNatlimit function. This vulnerability allows attacker… |
CVE-2024-42943 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allow… |
CVE-2024-42942 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function. This vulnerability allows attackers… |
CVE-2024-42941 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the wanmode parameter in the fromAdvSetWan function. This vulnerability allows atta… |
CVE-2024-42940 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows att… |
CVE-2024-42843 | Critical | 9.8 | 2024-08-15 | Projectworlds Online Examination System v1.0 is vulnerable to SQL Injection via the subject parameter in feed.php. |
CVE-2024-42681 | High | 8.8 | 2024-08-15 | Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component. |
CVE-2024-40705 | Medium | 6.5 | 2024-08-15 | IBM InfoSphere Information Server could allow an authenticated user to consume file space resources due to unrestricted file uploads. IBM X-Force ID: 298279. |
CVE-2024-40704 | Medium | 4.9 | 2024-08-15 | IBM InfoSphere Information Server 11.7 could allow a privileged user to obtain sensitive information from authentication request headers. IBM X-Force ID: 29… |
CVE-2024-31905 | Medium | 5.9 | 2024-08-15 | IBM QRadar Network Packet Capture 7.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Trans… |
CVE-2024-31800 | Medium | 6.8 | 2024-08-15 | Authentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to gain a privileged command shell via the UART Debugg… |
CVE-2024-31799 | Medium | 4.6 | 2024-08-15 | Information Disclosure in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to read the WiFi passphrase via the UART Debugging Po… |
CVE-2024-31798 | Medium | 6.8 | 2024-08-15 | Identical Hardcoded Root Password for All Devices in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to retrieve the root passw… |
CVE-2024-7263 | High | 7.8 | 2024-08-15 | Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an at… |
CVE-2024-7262 | High | 7.8 | 2024-08-15 | Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an at… |
CVE-2024-6347 | Medium | 6.5 | 2024-08-15 | * Unprotected privileged mode access through UDS session in the Blind Spot Detection Sensor ECU firmware in Nissan Altima (2022) allows attackers to trigger d… |
CVE-2024-43373 | High | 7.7 | 2024-08-15 | webcrack is a tool for reverse engineering javascript. An arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted… |
CVE-2024-7833 | Medium | 6.3 | 2024-08-15 | A vulnerability was found in D-Link DI-8100 16.07. It has been classified as critical. This affects the function upgrade_filter_asp of the file upgrade_filter… |
CVE-2024-7832 | High | 8.8 | 2024-08-15 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-… |
CVE-2024-42680 | Medium | 5.5 | 2024-08-15 | An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by entering a single quotatio… |
CVE-2024-42679 | High | 7.8 | 2024-08-15 | SQL Injection vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted scrip… |
CVE-2024-42678 | Medium | 6.1 | 2024-08-15 | Cross Site Scripting vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafte… |
CVE-2024-42677 | Medium | 5.5 | 2024-08-15 | An issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker to obtain sensitive information via the /nssys/common/filehan… |
CVE-2024-42676 | High | 8.8 | 2024-08-15 | File Upload vulnerability in Huizhi enterprise resource management system v.1.0 and before allows a remote attacker to execute arbitrary code via the /nssys/co… |
CVE-2024-7831 | High | 8.8 | 2024-08-15 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323… |
CVE-2024-7830 | High | 8.8 | 2024-08-15 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320L… |
CVE-2024-7829 | High | 8.8 | 2024-08-15 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS… |
CVE-2024-7828 | High | 8.8 | 2024-08-15 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321… |
CVE-2024-7411 | Medium | 5.3 | 2024-08-15 | The Newsletters plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.9.9. This is due the plugin not preventing d… |
CVE-2024-7064 | Medium | 6.4 | 2024-08-15 | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.6.5 due to… |
CVE-2024-7063 | Medium | 4.3 | 2024-08-15 | The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the 'render_raw' funct… |
CVE-2024-7815 | Low | 2.4 | 2024-08-15 | A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown f… |
CVE-2024-7814 | Low | 2.4 | 2024-08-15 | A vulnerability, which was classified as problematic, was found in CodeAstro Online Railway Reservation System 1.0. Affected is an unknown function of the file… |
CVE-2024-6534 | Medium | 4.3 | 2024-08-15 | Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because… |
CVE-2024-7813 | Medium | 5.3 | 2024-08-15 | A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. This issue affects some unknown processing… |
CVE-2024-7812 | Low | 3.5 | 2024-08-15 | A vulnerability classified as problematic was found in SourceCodester Best House Rental Management System 1.0. This vulnerability affects unknown code of the f… |
CVE-2024-7811 | Medium | 6.3 | 2024-08-15 | A vulnerability classified as critical has been found in SourceCodester Daily Expenses Monitoring App 1.0. This affects an unknown part of the file /endpoint/d… |
CVE-2024-7628 | High | 8.1 | 2024-08-15 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4… |
CVE-2024-7624 | High | 8.1 | 2024-08-15 | The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the… |
CVE-2024-7420 | Medium | 5.8 | 2024-08-15 | The Insert PHP Code Snippet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6. This is due to missin… |
CVE-2024-6533 | Medium | 5.4 | 2024-08-15 | Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an… |
CVE-2024-25024 | Medium | 5.5 | 2024-08-15 | IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text whi… |
CVE-2024-7810 | Medium | 6.3 | 2024-08-15 | A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been rated as critical. Affected by this issue is some unknown functional… |
CVE-2024-7809 | Medium | 5.3 | 2024-08-15 | A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknow… |
CVE-2024-7808 | High | 7.3 | 2024-08-15 | A vulnerability was found in code-projects Job Portal 1.0. It has been classified as critical. Affected is an unknown function of the file logindbc.php. The ma… |
CVE-2024-7800 | Medium | 6.3 | 2024-08-15 | A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file /simple-onli… |
CVE-2024-7799 | Medium | 5.3 | 2024-08-15 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionali… |
CVE-2024-7798 | High | 7.3 | 2024-08-15 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fu… |
CVE-2024-7797 | High | 7.3 | 2024-08-15 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. Affected is an unknown function of the file /… |
CVE-2024-7625 | Medium | 5.8 | 2024-08-15 | In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocatio… |
CVE-2024-43368 | Medium | 6.5 | 2024-08-14 | The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjq… |
CVE-2024-7794 | Medium | 6.3 | 2024-08-14 | A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2024-7793 | Low | 3.5 | 2024-08-14 | A vulnerability was found in SourceCodester Task Progress Tracker 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2024-42353 | Medium | 6.1 | 2024-08-14 | WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing t… |
CVE-2024-7515 | High | 7.5 | 2024-08-14 | CVE-2024-7515 IMPACT A denial-of-service vulnerability exists in the affected products. A malformed PTP management packet can cause a major nonrecoverable fau… |
CVE-2024-7513 | High | 8.8 | 2024-08-14 | CVE-2024-7513 IMPACT A code execution vulnerability exists in the affected product. The vulnerability occurs due to improper default file permissions allowing… |
CVE-2024-7507 | Medium | 6.5 | 2024-08-14 | CVE-2024-7507 IMPACT A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received… |
CVE-2024-6078 | | 2024-08-14 | CVE-2024-6078 IMPACT An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generate cookies for any u… | |
CVE-2024-42360 | Critical | 9.8 | 2024-08-14 | SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sani… |
CVE-2024-40620 | High | 7.5 | 2024-08-14 | CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data bei… |
CVE-2024-40619 | High | 7.5 | 2024-08-14 | CVE-2024-40619 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the… |
CVE-2024-27120 | High | 7.5 | 2024-08-14 | A Local File Inclusion vulnerability has been found in ComfortKey, a product of Celsius Benelux. Using this vulnerability, an unauthenticated attacker may retr… |
CVE-2024-7792 | Medium | 6.3 | 2024-08-14 | A vulnerability was found in SourceCodester Task Progress Tracker 1.0. It has been classified as critical. Affected is an unknown function of the file /endpoin… |
CVE-2024-37529 | Medium | 6.5 | 2024-08-14 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 could allow an authenticated user to cause a denial of service with a specially… |
CVE-2024-35152 | Medium | 6.5 | 2024-08-14 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to cause a denial of service with a specially crafted… |