2024 CVEs (page 203)
Page 203 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7636 | High | 7.3 | 2024-08-12 | A vulnerability was found in code-projects Simple Ticket Booking 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2024-7635 | High | 7.3 | 2024-08-12 | A vulnerability was found in code-projects Simple Ticket Booking 1.0. It has been classified as critical. Affected is an unknown function of the file register_… |
CVE-2024-7621 | Medium | 5.4 | 2024-08-12 | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized modification of data due to a missi… |
CVE-2024-7616 | Medium | 5.5 | 2024-08-12 | A vulnerability was found in Edimax IC-6220DC and IC-5150W up to 3.06. It has been rated as critical. Affected by this issue is the function cgiFormString of t… |
CVE-2024-7615 | High | 8.8 | 2024-08-12 | A vulnerability was found in Tenda FH1206 1.2.0.8. It has been declared as critical. Affected by this vulnerability is the function fromSafeClientFilter/fromSa… |
CVE-2024-7614 | High | 8.8 | 2024-08-12 | A vulnerability was found in Tenda FH1206 1.2.0.8(8155). It has been classified as critical. Affected is the function fromqossetting of the file /goform/qosset… |
CVE-2024-7613 | High | 8.8 | 2024-08-12 | A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromGstDhcpSetSer of the file /goform/GstDh… |
CVE-2024-7589 | High | 8.1 | 2024-08-12 | A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate withi… |
CVE-2024-7574 | Medium | 6.1 | 2024-08-12 | The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to missing nonce valida… |
CVE-2024-7557 | High | 8.8 | 2024-08-12 | A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deployin… |
CVE-2024-7512 | Medium | 4.8 | 2024-08-12 | Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The… |
CVE-2024-7503 | Critical | 9.8 | 2024-08-12 | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of l… |
CVE-2024-7416 | Medium | 5.3 | 2024-08-12 | The Reveal Template plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.7. This is due to the plugin allowing di… |
CVE-2024-7414 | Medium | 5.3 | 2024-08-12 | The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin… |
CVE-2024-7413 | Medium | 5.3 | 2024-08-12 | The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing… |
CVE-2024-7412 | Medium | 5.3 | 2024-08-12 | The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to the plugin allowing d… |
CVE-2024-7410 | Medium | 5.3 | 2024-08-12 | The My Custom CSS PHP & ADS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.3. This is due the plugin not pr… |
CVE-2024-7408 | Medium | 6.5 | 2024-08-12 | This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode. An attac… |
CVE-2024-7399 | High | 8.8 | 2024-08-12 | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitr… |
CVE-2024-7382 | Medium | 5.3 | 2024-08-12 | The Linkify Text plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.9.1. This is due to the plugin utilizing bo… |
CVE-2024-7272 | Medium | 6.3 | 2024-08-12 | A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This affects the function fill_audiodata of the file /libswresample/swresam… |
CVE-2024-7006 | High | 7.5 | 2024-08-12 | A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certai… |
CVE-2024-6760 | High | 7.5 | 2024-08-12 | A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users… |
CVE-2024-6759 | Medium | 5.3 | 2024-08-12 | When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdi… |
CVE-2024-6758 | Medium | 6.5 | 2024-08-12 | Improper Privilege Management in Sprecher Automation SPRECON-E below version 8.71j allows a remote attacker with low privileges to save unauthorized protection… |
CVE-2024-6692 | Low | 3.3 | 2024-08-12 | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-6691 | Medium | 4.4 | 2024-08-12 | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-6684 | | 2024-08-12 | Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass. This issue affect… | |
CVE-2024-6640 | Medium | 6.3 | 2024-08-12 | In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after… |
CVE-2024-6562 | Medium | 5.3 | 2024-08-12 | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5. This… |
CVE-2024-6158 | Medium | 4.8 | 2024-08-12 | The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some… |
CVE-2024-6136 | Medium | 5.4 | 2024-08-12 | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users pe… |
CVE-2024-6134 | Medium | 5.4 | 2024-08-12 | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-6133 | Medium | 6.5 | 2024-08-12 | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-5801 | | 2024-08-12 | Enabled IP Forwarding feature in B&R Automation Runtime versions before 6.0.2 may allow remote attack-ers to compromise network security by routing IP-based pa… | |
CVE-2024-5800 | High | 7.5 | 2024-08-12 | Diffie-Hellman groups with insufficient strength are used in the SSL/TLS stack of B&R Automation Runtime versions before 6.0.2, allowing a network attacker to… |
CVE-2024-5651 | High | 8.8 | 2024-08-12 | A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying an arbitrary comma… |
CVE-2024-5527 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration. |
CVE-2024-5487 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option. |
CVE-2024-5445 | Low | 3.8 | 2024-08-12 | Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious… |
CVE-2024-4360 | Medium | 6.4 | 2024-08-12 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-4359 | Medium | 6.5 | 2024-08-12 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to arbitrary fil… |
CVE-2024-4350 | Medium | 4.8 | 2024-08-12 | Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses… |
CVE-2024-43168 | Medium | 4.8 | 2024-08-12 | DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected f… |
CVE-2024-43167 | Low | 2.8 | 2024-08-12 | DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected f… |
CVE-2024-42473 | High | 7.5 | 2024-08-12 | OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses `… |
CVE-2024-42470 | Medium | 6.5 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4… |
CVE-2024-42469 | Critical | 9.8 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, CometVisu's file… |
CVE-2024-42468 | Medium | 5.3 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4… |
CVE-2024-42467 | Critical | 10.0 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. In versions 3.4.0.M4 through 4.2.0,, the… |
CVE-2024-42370 | High | 8.3 | 2024-08-12 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to En… |
CVE-2024-42367 | Medium | 4.8 | 2024-08-12 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which con… |
CVE-2024-42167 | Critical | 9.1 | 2024-08-12 | The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command prop… |
CVE-2024-42166 | Critical | 9.1 | 2024-08-12 | The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properl… |
CVE-2024-42165 | Medium | 6.3 | 2024-08-12 | Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token… |
CVE-2024-42164 | Medium | 4.3 | 2024-08-12 | Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by pr… |
CVE-2024-42163 | High | 8.3 | 2024-08-12 | Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting th… |
CVE-2024-42001 | High | 8.6 | 2024-08-12 | An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and p… |
CVE-2024-41936 | High | 7.5 | 2024-08-12 | A directory traversal vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables… |
CVE-2024-41890 | Medium | 5.3 | 2024-08-12 | Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple pas… |
CVE-2024-41888 | Medium | 5.3 | 2024-08-12 | Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link… |
CVE-2024-41577 | Critical | 9.8 | 2024-08-12 | An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uploading a crafted PNG… |
CVE-2024-41570 | Critical | 9.8 | 2024-08-12 | An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating… |
CVE-2024-41482 | Medium | 6.1 | 2024-08-12 | Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component. |
CVE-2024-41481 | Medium | 6.1 | 2024-08-12 | Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component. |
CVE-2024-41476 | Critical | 9.8 | 2024-08-12 | AMTT Hotel Broadband Operation System (HiBOS) V3.0.3.151204 and before is vulnerable to SQL Injection via /manager/card/card_detail.php. |
CVE-2024-41332 | Medium | 6.5 | 2024-08-12 | Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-l… |
CVE-2024-40488 | High | 8.8 | 2024-08-12 | A Cross-Site Request Forgery (CSRF) vulnerability was found in the Kashipara Live Membership System v1.0. This could lead to an attacker tricking the administr… |
CVE-2024-40487 | High | 7.6 | 2024-08-12 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/view_type.php" of Kashipara Live Membership System v1.0, which allows remote attackers to exec… |
CVE-2024-40486 | Critical | 9.8 | 2024-08-12 | A SQL injection vulnerability in "/index.php" of Kashipara Live Membership System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Log… |
CVE-2024-40484 | Medium | 6.1 | 2024-08-12 | A Reflected Cross Site Scripting (XSS) vulnerability was found in "/oahms/search.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote at… |
CVE-2024-40482 | Critical | 9.8 | 2024-08-12 | An Unrestricted file upload vulnerability was found in "/Membership/edit_member.php" of Kashipara Live Membership System v1.0, which allows attackers to execut… |
CVE-2024-40481 | Medium | 5.4 | 2024-08-12 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/view-enquiry.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote… |
CVE-2024-40480 | Critical | 9.8 | 2024-08-12 | A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which allows remote unauthe… |
CVE-2024-40479 | High | 8.1 | 2024-08-12 | A SQL injection vulnerability in "/admin/quizquestion.php" in Kashipara Online Exam System v1.0 allows remote attackers to execute arbitrary SQL commands via t… |
CVE-2024-40478 | Medium | 5.4 | 2024-08-12 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/afeedback.php" in Kashipara Online Exam System v1.0, which allows remote attackers to ex… |
CVE-2024-40477 | Critical | 9.8 | 2024-08-12 | A SQL injection vulnerability in "/oahms/admin/forgot-password.php" in PHPGurukul Old Age Home Management System v1.0 allows an attacker to execute arbitrary S… |
CVE-2024-40476 | High | 8.0 | 2024-08-12 | A Cross-Site Request Forgery (CSRF) vulnerability was found in SourceCodester Best House Rental Management System v1.0. This could lead to an attacker tricking… |
CVE-2024-40475 | High | 8.8 | 2024-08-12 | SourceCodester Best House Rental Management System v1.0 is vulnerable to Incorrect Access Control via /rental/payment_report.php, /rental/balance_report.php, /… |
CVE-2024-40474 | Medium | 5.4 | 2024-08-12 | A Reflected Cross Site Scripting (XSS) vulnerability was found in "edit-cate.php" in SourceCodester House Rental Management System v1.0. |
CVE-2024-40473 | Medium | 5.4 | 2024-08-12 | A Stored Cross Site Scripting (XSS) vulnerability was found in "manage_houses.php" in SourceCodester Best House Rental Management System v1.0. It allows remote… |
CVE-2024-40472 | Critical | 9.8 | 2024-08-12 | Sourcecodester Daily Calories Monitoring Tool v1.0 is vulnerable to SQL Injection via "delete-calorie.php." |
CVE-2024-3279 | Critical | 9.1 | 2024-08-12 | An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allo… |
CVE-2024-39815 | Critical | 9.1 | 2024-08-12 | Improper check or handling of exceptional conditions vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software ver… |
CVE-2024-39791 | Critical | 10.0 | 2024-08-12 | Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and… |
CVE-2024-39338 | High | 7.5 | 2024-08-12 | axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs. |
CVE-2024-38989 | Critical | 9.8 | 2024-08-12 | izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to execute arbitrary cod… |
CVE-2024-38219 | Medium | 6.5 | 2024-08-12 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-38218 | High | 8.4 | 2024-08-12 | Microsoft Edge (HTML-based) Memory Corruption Vulnerability |
CVE-2024-38200 | Medium | 6.5 | 2024-08-12 | Microsoft Office Spoofing Vulnerability |
CVE-2024-37826 | High | 7.5 | 2024-08-12 | A NULL pointer dereference in vercot Serva v4.6.0 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. |
CVE-2024-37283 | Medium | 6.5 | 2024-08-12 | An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By defa… |
CVE-2024-37023 | Critical | 9.1 | 2024-08-12 | Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and pr… |
CVE-2024-36518 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard. |
CVE-2024-36462 | High | 7.5 | 2024-08-12 | Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandw… |
CVE-2024-36461 | Critical | 9.1 | 2024-08-12 | Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine. |
CVE-2024-36460 | High | 8.1 | 2024-08-12 | The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. |
CVE-2024-36035 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording. |
CVE-2024-36034 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option. |
CVE-2024-32765 | Medium | 4.2 | 2024-08-12 | A vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow local authenticated administrators to gain ac… |