2024 CVEs (page 204)
Page 204 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-30188 | High | 8.1 | 2024-08-12 | File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache D… |
CVE-2024-29831 | High | 8.8 | 2024-08-12 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2024-29082 | High | 8.6 | 2024-08-12 | Improper access control vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enab… |
CVE-2024-22123 | Low | 2.7 | 2024-08-12 | Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another… |
CVE-2024-22122 | Low | 3.0 | 2024-08-12 | Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zab… |
CVE-2024-22121 | Medium | 6.1 | 2024-08-12 | A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application. |
CVE-2024-22116 | Critical | 9.9 | 2024-08-12 | An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping f… |
CVE-2024-22114 | Medium | 4.3 | 2024-08-12 | User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard. |
CVE-2024-21881 | | 2024-08-12 | Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects E… | |
CVE-2024-21880 | High | 7.2 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase… |
CVE-2024-21879 | High | 8.8 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enpha… |
CVE-2024-21878 | Critical | 9.8 | 2024-08-12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Com… |
CVE-2024-21877 | Medium | 6.5 | 2024-08-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as E… |
CVE-2024-21876 | Critical | 9.1 | 2024-08-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy… |
CVE-2024-0115 | Medium | 6.1 | 2024-08-12 | NVIDIA CV-CUDA for Ubuntu 20.04, Ubuntu 22.04, and Jetpack contains a vulnerability in Python APIs where a user may cause an uncontrolled resource consumption… |
CVE-2024-0113 | High | 7.5 | 2024-08-12 | NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially… |
CVE-2024-42493 | Medium | 5.3 | 2024-08-08 | Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered JavaScript prior to use… |
CVE-2024-42408 | Medium | 5.3 | 2024-08-08 | The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information expo… |
CVE-2024-41161 | High | 7.5 | 2024-08-08 | Use of hard-coded credentials vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior… |
CVE-2024-39287 | Medium | 5.3 | 2024-08-08 | Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys. |
CVE-2024-37382 | High | 7.2 | 2024-08-08 | An issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitrary code via crafte… |
CVE-2024-0104 | Medium | 4.2 | 2024-08-08 | NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in the LDAP AAA component, where a user can cause improper access. A success… |
CVE-2024-7394 | Medium | 4.8 | 2024-08-08 | Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName(). A rogue administrator could inject malicious cod… |
CVE-2024-42366 | Critical | 9.0 | 2024-08-08 | VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via ov… |
CVE-2024-42365 | High | 7.4 | 2024-08-08 | Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk v… |
CVE-2024-0108 | High | 8.7 | 2024-08-08 | NVIDIA Jetson Linux contains a vulnerability in NvGPU where error handling paths in GPU MMU mapping code fail to clean up a failed mapping attempt. A successfu… |
CVE-2024-0107 | High | 7.8 | 2024-08-08 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |
CVE-2024-0102 | Low | 3.3 | 2024-08-08 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm, where an attacker can cause an out-of-bounds read issue by deceiving a user into re… |
CVE-2024-0101 | High | 7.5 | 2024-08-08 | NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter definitions could enable an attacker to… |
CVE-2024-7480 | Medium | 4.2 | 2024-08-08 | An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administrative privi… |
CVE-2024-7477 | Medium | 6.5 | 2024-08-08 | A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbitrary queries again… |
CVE-2024-41238 | Medium | 5.3 | 2024-08-08 | A SQL injection vulnerability in /smsa/student_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-7490 | Critical | 9.8 | 2024-08-08 | Improper Input Validation vulnerability in Microchip Techology Advanced Software Framework example DHCP server can cause remote code execution through a buffer… |
CVE-2024-42357 | High | 7.3 | 2024-08-08 | Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users… |
CVE-2024-42356 | High | 8.3 | 2024-08-08 | Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to a… |
CVE-2024-42355 | High | 8.3 | 2024-08-08 | Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to ver… |
CVE-2024-42354 | Medium | 5.3 | 2024-08-08 | Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiA… |
CVE-2024-41942 | High | 7.2 | 2024-08-08 | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin… |
CVE-2024-7348 | High | 8.8 | 2024-08-08 | Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_d… |
CVE-2024-3659 | High | 7.2 | 2024-08-08 | Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the en… |
CVE-2024-7610 | Medium | 4.3 | 2024-08-08 | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2… |
CVE-2024-7554 | Medium | 4.9 | 2024-08-08 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versio… |
CVE-2024-5423 | Medium | 6.5 | 2024-08-08 | Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 pr… |
CVE-2024-4207 | Medium | 4.4 | 2024-08-08 | A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 prior 17.0.6, starting from 17.1 prior to 17.1.4, and start… |
CVE-2024-3958 | Medium | 5.3 | 2024-08-08 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allo… |
CVE-2024-3114 | Medium | 4.3 | 2024-08-08 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the pr… |
CVE-2024-3035 | Medium | 6.8 | 2024-08-08 | A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 all… |
CVE-2024-2800 | Medium | 6.5 | 2024-08-08 | ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and… |
CVE-2024-6329 | Medium | 5.7 | 2024-08-08 | An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 p… |
CVE-2024-4784 | Medium | 4.2 | 2024-08-08 | An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the pas… |
CVE-2024-4210 | Medium | 6.5 | 2024-08-08 | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior to 17.1.4, and 17.2… |
CVE-2024-42038 | High | 8.8 | 2024-08-08 | Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect service confidentiality, i… |
CVE-2024-42037 | Critical | 9.3 | 2024-08-08 | Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-42036 | Low | 2.5 | 2024-08-08 | Access permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-42035 | High | 8.4 | 2024-08-08 | Permission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality and confidentiality. |
CVE-2024-42034 | Medium | 6.6 | 2024-08-08 | LaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-42033 | Medium | 6.9 | 2024-08-08 | Access control vulnerability in the security verification module mpact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2024-42257 | High | 7.8 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: ext4: use memtostr_pad() for s_volume_name As with the other strings in struct ext4_super… |
CVE-2024-42256 | High | 7.5 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server re-repick on subrequest retry When a subrequest is marked for needing re… |
CVE-2024-42255 | Medium | 5.5 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() Dereference auth aft… |
CVE-2024-42254 | Medium | 5.5 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: io_uring: fix error pbuf checking Syz reports a problem, which boils down to NULL vs IS_E… |
CVE-2024-42253 | High | 7.8 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race Ensure that `i2c_lock' is held when s… |
CVE-2024-42252 | Medium | 5.5 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: closures: Change BUG_ON() to WARN_ON() If a BUG_ON() can be hit in the wild, it shouldn't… |
CVE-2024-42251 | Medium | 5.5 | 2024-08-08 | In the Linux kernel, the following vulnerability has been resolved: mm: page_ref: remove folio_try_get_rcu() The below bug was reported on a non-SMP kernel: … |
CVE-2024-42032 | Medium | 4.4 | 2024-08-08 | Access permission verification vulnerability in the Contacts module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-42031 | High | 7.5 | 2024-08-08 | Access permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-42030 | Medium | 6.2 | 2024-08-08 | Access permission verification vulnerability in the content sharing pop-up module Impact: Successful exploitation of this vulnerability may affect service conf… |
CVE-2024-22069 | High | 7.1 | 2024-08-08 | There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and cha… |
CVE-2024-7548 | High | 8.8 | 2024-08-08 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and inclu… |
CVE-2024-7150 | High | 8.8 | 2024-08-08 | The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and… |
CVE-2024-6884 | Medium | 5.4 | 2024-08-08 | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.39 does not validate and escape some of its block options before outputting them back i… |
CVE-2024-6824 | Medium | 4.3 | 2024-08-08 | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'che… |
CVE-2024-6481 | Medium | 4.8 | 2024-08-08 | The Search & Filter Pro WordPress plugin before 2.5.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-5226 | Medium | 6.4 | 2024-08-08 | The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all versions up to, and… |
CVE-2024-6987 | Medium | 4.3 | 2024-08-08 | The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchid_store_activate_plugin'… |
CVE-2024-6869 | Medium | 5.4 | 2024-08-08 | The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several fun… |
CVE-2024-5668 | Medium | 6.4 | 2024-08-08 | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in al… |
CVE-2024-6552 | Medium | 5.3 | 2024-08-08 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2… |
CVE-2024-6254 | Medium | 4.3 | 2024-08-08 | The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing o… |
CVE-2024-7492 | High | 8.8 | 2024-08-08 | The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or… |
CVE-2024-7350 | Critical | 9.8 | 2024-08-08 | The Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1… |
CVE-2024-7561 | High | 8.8 | 2024-08-08 | The The Next theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from… |
CVE-2024-7560 | High | 7.2 | 2024-08-08 | The News Flash theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input fro… |
CVE-2024-7486 | High | 8.8 | 2024-08-08 | The MultiPurpose theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.0 via deserialization of untrusted input t… |
CVE-2024-38202 | High | 7.3 | 2024-08-08 | Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileg… |
CVE-2024-21302 | Medium | 6.7 | 2024-08-08 | Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-… |
CVE-2024-6893 | High | 7.5 | 2024-08-08 | The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read… |
CVE-2024-6892 | Medium | 6.1 | 2024-08-08 | Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application. |
CVE-2024-6891 | High | 8.8 | 2024-08-08 | Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow. |
CVE-2024-6890 | High | 8.8 | 2024-08-07 | Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the… |
CVE-2024-6707 | High | 8.8 | 2024-08-07 | Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability. |
CVE-2024-6706 | Medium | 6.1 | 2024-08-07 | Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page. |
CVE-2024-41912 | Critical | 9.8 | 2024-08-07 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access con… |
CVE-2024-41239 | Medium | 4.8 | 2024-08-07 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, which allows remote… |
CVE-2024-41237 | Critical | 9.8 | 2024-08-07 | A SQL injection vulnerability in /smsa/teacher_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-41242 | Medium | 6.1 | 2024-08-07 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /smsa/student_login.php in Kashipara Responsive School Management System v3.2.0, which allows… |
CVE-2024-41241 | Medium | 6.1 | 2024-08-07 | A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/admin_login.php" in Kashipara Responsive School Management System v3.2.0, which allow… |
CVE-2024-41240 | Medium | 6.1 | 2024-08-07 | A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/teacher_login.php" in Kashipara Responsive School Management System v3.2.0, which all… |
CVE-2024-7585 | High | 8.8 | 2024-08-07 | A vulnerability has been found in Tenda i22 1.0.0.3(4687) and classified as critical. Affected by this vulnerability is the function formApPortalWebAuth of the… |
CVE-2024-7584 | High | 8.8 | 2024-08-07 | A vulnerability, which was classified as critical, was found in Tenda i22 1.0.0.3(4687). Affected is the function formApPortalPhoneAuth of the file /goform/apP… |