2024 CVEs (page 203)
Page 203 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6684 | | 2024-08-12 | Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass. This issue affect… | |
CVE-2024-6640 | Medium | 6.3 | 2024-08-12 | In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after… |
CVE-2024-6562 | Medium | 5.3 | 2024-08-12 | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.5. This… |
CVE-2024-6158 | Medium | 4.8 | 2024-08-12 | The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some… |
CVE-2024-6136 | Medium | 5.4 | 2024-08-12 | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users pe… |
CVE-2024-6134 | Medium | 5.4 | 2024-08-12 | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-6133 | Medium | 6.5 | 2024-08-12 | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-5801 | | 2024-08-12 | Enabled IP Forwarding feature in B&R Automation Runtime versions before 6.0.2 may allow remote attack-ers to compromise network security by routing IP-based pa… | |
CVE-2024-5800 | High | 7.5 | 2024-08-12 | Diffie-Hellman groups with insufficient strength are used in the SSL/TLS stack of B&R Automation Runtime versions before 6.0.2, allowing a network attacker to… |
CVE-2024-5651 | High | 8.8 | 2024-08-12 | A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying an arbitrary comma… |
CVE-2024-5527 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration. |
CVE-2024-5487 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option. |
CVE-2024-5445 | Low | 3.8 | 2024-08-12 | Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious… |
CVE-2024-4360 | Medium | 6.4 | 2024-08-12 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-4359 | Medium | 6.5 | 2024-08-12 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to arbitrary fil… |
CVE-2024-4350 | Medium | 4.8 | 2024-08-12 | Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses… |
CVE-2024-43168 | Medium | 4.8 | 2024-08-12 | DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected f… |
CVE-2024-43167 | Low | 2.8 | 2024-08-12 | DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected f… |
CVE-2024-42473 | High | 7.5 | 2024-08-12 | OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses `… |
CVE-2024-42470 | Medium | 6.5 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4… |
CVE-2024-42469 | Critical | 9.8 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, CometVisu's file… |
CVE-2024-42468 | Medium | 5.3 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4… |
CVE-2024-42467 | Critical | 10.0 | 2024-08-12 | openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. In versions 3.4.0.M4 through 4.2.0,, the… |
CVE-2024-42370 | High | 8.3 | 2024-08-12 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to En… |
CVE-2024-42367 | Medium | 4.8 | 2024-08-12 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which con… |
CVE-2024-42167 | Critical | 9.1 | 2024-08-12 | The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command prop… |
CVE-2024-42166 | Critical | 9.1 | 2024-08-12 | The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properl… |
CVE-2024-42165 | Medium | 6.3 | 2024-08-12 | Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activate accounts of any user by predicting the token… |
CVE-2024-42164 | Medium | 4.3 | 2024-08-12 | Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by pr… |
CVE-2024-42163 | High | 8.3 | 2024-08-12 | Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting th… |
CVE-2024-42001 | High | 8.6 | 2024-08-12 | An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and p… |
CVE-2024-41936 | High | 7.5 | 2024-08-12 | A directory traversal vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables… |
CVE-2024-41890 | Medium | 5.3 | 2024-08-12 | Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple pas… |
CVE-2024-41888 | Medium | 5.3 | 2024-08-12 | Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link… |
CVE-2024-41577 | Critical | 9.8 | 2024-08-12 | An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uploading a crafted PNG… |
CVE-2024-41570 | Critical | 9.8 | 2024-08-12 | An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating… |
CVE-2024-41482 | Medium | 6.1 | 2024-08-12 | Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component. |
CVE-2024-41481 | Medium | 6.1 | 2024-08-12 | Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component. |
CVE-2024-41476 | Critical | 9.8 | 2024-08-12 | AMTT Hotel Broadband Operation System (HiBOS) V3.0.3.151204 and before is vulnerable to SQL Injection via /manager/card/card_detail.php. |
CVE-2024-41332 | Medium | 6.5 | 2024-08-12 | Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-l… |
CVE-2024-40488 | High | 8.8 | 2024-08-12 | A Cross-Site Request Forgery (CSRF) vulnerability was found in the Kashipara Live Membership System v1.0. This could lead to an attacker tricking the administr… |
CVE-2024-40487 | High | 7.6 | 2024-08-12 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/view_type.php" of Kashipara Live Membership System v1.0, which allows remote attackers to exec… |
CVE-2024-40486 | Critical | 9.8 | 2024-08-12 | A SQL injection vulnerability in "/index.php" of Kashipara Live Membership System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Log… |
CVE-2024-40484 | Medium | 6.1 | 2024-08-12 | A Reflected Cross Site Scripting (XSS) vulnerability was found in "/oahms/search.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote at… |
CVE-2024-40482 | Critical | 9.8 | 2024-08-12 | An Unrestricted file upload vulnerability was found in "/Membership/edit_member.php" of Kashipara Live Membership System v1.0, which allows attackers to execut… |
CVE-2024-40481 | Medium | 5.4 | 2024-08-12 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/view-enquiry.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote… |
CVE-2024-40480 | Critical | 9.8 | 2024-08-12 | A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which allows remote unauthe… |
CVE-2024-40479 | High | 8.1 | 2024-08-12 | A SQL injection vulnerability in "/admin/quizquestion.php" in Kashipara Online Exam System v1.0 allows remote attackers to execute arbitrary SQL commands via t… |
CVE-2024-40478 | Medium | 5.4 | 2024-08-12 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/afeedback.php" in Kashipara Online Exam System v1.0, which allows remote attackers to ex… |
CVE-2024-40477 | Critical | 9.8 | 2024-08-12 | A SQL injection vulnerability in "/oahms/admin/forgot-password.php" in PHPGurukul Old Age Home Management System v1.0 allows an attacker to execute arbitrary S… |
CVE-2024-40476 | High | 8.0 | 2024-08-12 | A Cross-Site Request Forgery (CSRF) vulnerability was found in SourceCodester Best House Rental Management System v1.0. This could lead to an attacker tricking… |
CVE-2024-40475 | High | 8.8 | 2024-08-12 | SourceCodester Best House Rental Management System v1.0 is vulnerable to Incorrect Access Control via /rental/payment_report.php, /rental/balance_report.php, /… |
CVE-2024-40474 | Medium | 5.4 | 2024-08-12 | A Reflected Cross Site Scripting (XSS) vulnerability was found in "edit-cate.php" in SourceCodester House Rental Management System v1.0. |
CVE-2024-40473 | Medium | 5.4 | 2024-08-12 | A Stored Cross Site Scripting (XSS) vulnerability was found in "manage_houses.php" in SourceCodester Best House Rental Management System v1.0. It allows remote… |
CVE-2024-40472 | Critical | 9.8 | 2024-08-12 | Sourcecodester Daily Calories Monitoring Tool v1.0 is vulnerable to SQL Injection via "delete-calorie.php." |
CVE-2024-3279 | Critical | 9.1 | 2024-08-12 | An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allo… |
CVE-2024-39815 | Critical | 9.1 | 2024-08-12 | Improper check or handling of exceptional conditions vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software ver… |
CVE-2024-39791 | Critical | 10.0 | 2024-08-12 | Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and… |
CVE-2024-39338 | High | 7.5 | 2024-08-12 | axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs. |
CVE-2024-38989 | Critical | 9.8 | 2024-08-12 | izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to execute arbitrary cod… |
CVE-2024-38219 | Medium | 6.5 | 2024-08-12 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-38218 | High | 8.4 | 2024-08-12 | Microsoft Edge (HTML-based) Memory Corruption Vulnerability |
CVE-2024-38200 | Medium | 6.5 | 2024-08-12 | Microsoft Office Spoofing Vulnerability |
CVE-2024-37826 | High | 7.5 | 2024-08-12 | A NULL pointer dereference in vercot Serva v4.6.0 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. |
CVE-2024-37283 | Medium | 6.5 | 2024-08-12 | An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By defa… |
CVE-2024-37023 | Critical | 9.1 | 2024-08-12 | Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and pr… |
CVE-2024-36518 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard. |
CVE-2024-36462 | High | 7.5 | 2024-08-12 | Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandw… |
CVE-2024-36461 | Critical | 9.1 | 2024-08-12 | Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine. |
CVE-2024-36460 | High | 8.1 | 2024-08-12 | The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text. |
CVE-2024-36035 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording. |
CVE-2024-36034 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option. |
CVE-2024-32765 | Medium | 4.2 | 2024-08-12 | A vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow local authenticated administrators to gain ac… |
CVE-2024-30188 | High | 8.1 | 2024-08-12 | File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache D… |
CVE-2024-29831 | High | 8.8 | 2024-08-12 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2024-29082 | High | 8.6 | 2024-08-12 | Improper access control vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enab… |
CVE-2024-22123 | Low | 2.7 | 2024-08-12 | Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another… |
CVE-2024-22122 | Low | 3.0 | 2024-08-12 | Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zab… |
CVE-2024-22121 | Medium | 6.1 | 2024-08-12 | A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. |
CVE-2024-22116 | Critical | 9.9 | 2024-08-12 | An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping f… |
CVE-2024-22114 | Medium | 4.3 | 2024-08-12 | User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard. |
CVE-2024-21881 | | 2024-08-12 | Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects E… | |
CVE-2024-21880 | High | 7.2 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase… |
CVE-2024-21879 | High | 8.8 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enpha… |
CVE-2024-21878 | Critical | 9.8 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Com… |
CVE-2024-21877 | Medium | 6.5 | 2024-08-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as E… |
CVE-2024-21876 | Critical | 9.1 | 2024-08-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy… |
CVE-2024-0115 | Medium | 6.1 | 2024-08-12 | NVIDIA CV-CUDA for Ubuntu 20.04, Ubuntu 22.04, and Jetpack contains a vulnerability in Python APIs where a user may cause an uncontrolled resource consumption… |
CVE-2024-0113 | High | 7.5 | 2024-08-12 | NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially… |
CVE-2024-42493 | Medium | 5.3 | 2024-08-08 | Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered JavaScript prior to use… |
CVE-2024-42408 | Medium | 5.3 | 2024-08-08 | The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information expo… |
CVE-2024-41161 | High | 7.5 | 2024-08-08 | Use of hard-coded credentials vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior… |
CVE-2024-39287 | Medium | 5.3 | 2024-08-08 | Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys. |
CVE-2024-37382 | High | 7.2 | 2024-08-08 | An issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitrary code via crafte… |
CVE-2024-0104 | Medium | 4.2 | 2024-08-08 | NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in the LDAP AAA component, where a user can cause improper access. A success… |
CVE-2024-7394 | Medium | 4.8 | 2024-08-08 | Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName(). A rogue administrator could inject malicious cod… |
CVE-2024-42366 | Critical | 9.0 | 2024-08-08 | VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via ov… |
CVE-2024-42365 | High | 7.4 | 2024-08-08 | Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk v… |
CVE-2024-0108 | High | 8.7 | 2024-08-08 | NVIDIA Jetson Linux contains a vulnerability in NvGPU where error handling paths in GPU MMU mapping code fail to clean up a failed mapping attempt. A successfu… |
CVE-2024-0107 | High | 7.8 | 2024-08-08 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |