2024 CVEs (page 207)
Page 207 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-33958 | Critical | 9.8 | 2024-08-06 | SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the… |
CVE-2024-33957 | Critical | 9.8 | 2024-08-06 | SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the… |
CVE-2024-41995 | High | 7.5 | 2024-08-06 | Initialization of a resource with an insecure default vulnerability exists in JavaTM Platform Ver.12.89 and earlier. If this vulnerability is exploited, the pr… |
CVE-2024-7084 | Medium | 4.8 | 2024-08-06 | The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perfo… |
CVE-2024-7082 | Medium | 6.1 | 2024-08-06 | The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to… |
CVE-2024-7055 | Medium | 6.3 | 2024-08-06 | A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmd… |
CVE-2024-6766 | Medium | 5.4 | 2024-08-06 | The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2024-6651 | Medium | 6.1 | 2024-08-06 | The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-6203 | High | 8.3 | 2024-08-06 | HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users… |
CVE-2024-6202 | Critical | 9.8 | 2024-08-06 | HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors… |
CVE-2024-6201 | Medium | 5.3 | 2024-08-06 | HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead to the leakage of p… |
CVE-2024-6200 | High | 8.0 | 2024-08-06 | HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. The injected JavaScript code can execute arbitrary action on… |
CVE-2024-5709 | High | 8.8 | 2024-08-06 | The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layout_name' paramet… |
CVE-2024-5708 | Medium | 6.4 | 2024-08-06 | The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 7… |
CVE-2024-7506 | Medium | 6.3 | 2024-08-06 | A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-39817 | Medium | 6.5 | 2024-08-06 | Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view d… |
CVE-2024-7505 | High | 7.3 | 2024-08-06 | A vulnerability, which was classified as critical, was found in itsourcecode Bike Delivery System 1.0. Affected is an unknown function of the file contact_us_a… |
CVE-2024-7500 | Medium | 6.3 | 2024-08-06 | A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been rated as critical. Affected by this issue is the function save_settings o… |
CVE-2024-7009 | Medium | 4.2 | 2024-08-06 | Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database. |
CVE-2024-7008 | Medium | 5.4 | 2024-08-06 | Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting. |
CVE-2024-6886 | | 2024-08-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored X… | |
CVE-2024-6782 | Critical | 9.8 | 2024-08-06 | Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution. |
CVE-2024-6781 | High | 7.5 | 2024-08-06 | Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. |
CVE-2024-28962 | Medium | 6.5 | 2024-08-06 | Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnerability. An unauthen… |
CVE-2024-7499 | Medium | 6.3 | 2024-08-06 | A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-7498 | High | 7.3 | 2024-08-06 | A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been classified as critical. Affected is the function login/login2 of the file… |
CVE-2024-5963 | Medium | 6.7 | 2024-08-06 | Unquoted Executable Path vulnerability in Hitachi Device Manager on Windows (Device Manager Server component).This issue affects Hitachi Device Manager: before… |
CVE-2024-5828 | High | 8.6 | 2024-08-06 | Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manage… |
CVE-2024-7497 | Medium | 6.3 | 2024-08-06 | A vulnerability was found in itsourcecode Airline Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /ad… |
CVE-2024-7496 | Medium | 6.3 | 2024-08-06 | A vulnerability has been found in itsourcecode Airline Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file /… |
CVE-2024-7485 | High | 7.2 | 2024-08-06 | The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in the 'UserWebStat' AJAX function in all versio… |
CVE-2024-7484 | High | 7.2 | 2024-08-06 | The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded_files' function in… |
CVE-2024-6315 | High | 8.8 | 2024-08-06 | The Blox Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handleUploadFile' function in al… |
CVE-2024-7495 | Medium | 6.3 | 2024-08-06 | A vulnerability, which was classified as critical, was found in itsourcecode Laravel Accounting System 1.0. This affects an unknown part of the file app/Http/C… |
CVE-2024-7547 | High | 7.8 | 2024-08-06 | oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affect… |
CVE-2024-7546 | High | 7.8 | 2024-08-06 | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected… |
CVE-2024-7545 | High | 7.8 | 2024-08-06 | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected… |
CVE-2024-7544 | High | 7.8 | 2024-08-06 | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected… |
CVE-2024-7543 | High | 7.8 | 2024-08-06 | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected… |
CVE-2024-7542 | Low | 3.3 | 2024-08-06 | oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information… |
CVE-2024-7541 | Low | 3.3 | 2024-08-06 | oFono AT CMT Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information o… |
CVE-2024-7540 | Low | 3.3 | 2024-08-06 | oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information… |
CVE-2024-7539 | High | 7.8 | 2024-08-06 | oFono CUSD Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installati… |
CVE-2024-7538 | High | 7.8 | 2024-08-06 | oFono CUSD AT Command Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected… |
CVE-2024-7537 | Medium | 5.5 | 2024-08-06 | oFono QMI SMS Handling Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on… |
CVE-2024-7494 | Medium | 6.3 | 2024-08-05 | A vulnerability, which was classified as critical, has been found in SourceCodester Clinics Patient Management System 1.0. Affected by this issue is some unkno… |
CVE-2024-42352 | High | 8.6 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. `nuxt/icon` provides an API to allow client side icon… |
CVE-2024-41811 | Low | 3.9 | 2024-08-05 | ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site… |
CVE-2024-34344 | High | 8.8 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `path` param… |
CVE-2024-34343 | Medium | 6.3 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. The `navigateTo` function attempts to blockthe `javasc… |
CVE-2024-23657 | High | 8.8 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the `getTex… |
CVE-2024-6915 | Critical | 9.3 | 2024-08-05 | JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could p… |
CVE-2024-42350 | Low | 3.0 | 2024-08-05 | Biscuit is an authorization token with decentralized verification, offline attenuation and strong security policy enforcement based on a logic language. Third-… |
CVE-2024-41960 | Low | 3.8 | 2024-08-05 | mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload into the Relay Hosts c… |
CVE-2024-41959 | High | 7.6 | 2024-08-05 | mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. Thi… |
CVE-2024-41958 | Medium | 6.6 | 2024-08-05 | mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechani… |
CVE-2024-41820 | Medium | 6.0 | 2024-08-05 | Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resources. If a malici… |
CVE-2024-41816 | Medium | 5.4 | 2024-08-05 | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortc… |
CVE-2024-6361 | Medium | 5.4 | 2024-08-05 | Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane. The vulnerability affects all version prior to version 23.4. The vulne… |
CVE-2024-42010 | High | 7.5 | 2024-08-05 | mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messag… |
CVE-2024-42009 | Critical | 9.3 | 2024-08-05 | A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a cra… |
CVE-2024-42008 | Critical | 9.3 | 2024-08-05 | A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and… |
CVE-2024-41381 | Medium | 6.1 | 2024-08-05 | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php. |
CVE-2024-41380 | Medium | 6.1 | 2024-08-05 | microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php. |
CVE-2024-41376 | High | 8.8 | 2024-08-05 | dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php. |
CVE-2024-41200 | Medium | 5.5 | 2024-08-05 | A segmentation fault in KMPlayer v4.2.2.65 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file. |
CVE-2024-40498 | Critical | 9.8 | 2024-08-05 | SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the register.php |
CVE-2024-40531 | High | 8.8 | 2024-08-05 | A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. This flaw allows authenticated users to modify any user attribute, includin… |
CVE-2024-40530 | High | 7.5 | 2024-08-05 | A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-Fo… |
CVE-2024-21980 | High | 7.9 | 2024-08-05 | Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in… |
CVE-2024-21978 | Medium | 6.0 | 2024-08-05 | Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakage or data corruptio… |
CVE-2024-33034 | High | 8.4 | 2024-08-05 | Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at t… |
CVE-2024-33028 | High | 8.4 | 2024-08-05 | Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released. |
CVE-2024-33027 | High | 8.4 | 2024-08-05 | Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table. |
CVE-2024-33026 | High | 7.5 | 2024-08-05 | Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp. |
CVE-2024-33025 | High | 7.5 | 2024-08-05 | Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. |
CVE-2024-33024 | High | 7.5 | 2024-08-05 | Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length. |
CVE-2024-33023 | High | 8.4 | 2024-08-05 | Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events. |
CVE-2024-33022 | High | 8.4 | 2024-08-05 | Memory corruption while allocating memory in HGSL driver. |
CVE-2024-33021 | High | 8.4 | 2024-08-05 | Memory corruption while processing IOCTL call to set metainfo. |
CVE-2024-33020 | High | 7.5 | 2024-08-05 | Transient DOS while processing TID-to-link mapping IE elements. |
CVE-2024-33019 | High | 7.5 | 2024-08-05 | Transient DOS while parsing the received TID-to-link mapping action frame. |
CVE-2024-33018 | High | 7.5 | 2024-08-05 | Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame. |
CVE-2024-33015 | High | 7.5 | 2024-08-05 | Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report. |
CVE-2024-33014 | High | 7.5 | 2024-08-05 | Transient DOS while parsing ESP IE from beacon/probe response frame. |
CVE-2024-33013 | High | 7.5 | 2024-08-05 | Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length. |
CVE-2024-33012 | High | 7.5 | 2024-08-05 | Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon. |
CVE-2024-33011 | High | 7.5 | 2024-08-05 | Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero. |
CVE-2024-33010 | High | 7.5 | 2024-08-05 | Transient DOS while parsing fragments of MBSSID IE from beacon frame. |
CVE-2024-23384 | High | 8.4 | 2024-08-05 | Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker. |
CVE-2024-23383 | High | 8.4 | 2024-08-05 | Memory corruption when kernel driver attempts to trigger hardware fences. |
CVE-2024-23382 | High | 8.4 | 2024-08-05 | Memory corruption while processing graphics kernel driver request to create DMA fence. |
CVE-2024-23381 | High | 8.4 | 2024-08-05 | Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU. |
CVE-2024-23357 | Medium | 6.2 | 2024-08-05 | Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus. |
CVE-2024-23356 | High | 7.8 | 2024-08-05 | Memory corruption during session sign renewal request calls in HLOS. |
CVE-2024-23355 | High | 7.8 | 2024-08-05 | Memory corruption when keymaster operation imports a shared key. |
CVE-2024-23353 | High | 7.5 | 2024-08-05 | Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI. |
CVE-2024-23352 | High | 7.5 | 2024-08-05 | Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA. |
CVE-2024-23350 | Medium | 6.5 | 2024-08-05 | Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is… |
CVE-2024-21481 | High | 8.4 | 2024-08-05 | Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager. |