2024 CVEs (page 208)
Page 208 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21479 | High | 7.5 | 2024-08-05 | Transient DOS during music playback of ALAC content. |
CVE-2024-21467 | Medium | 6.5 | 2024-08-05 | Information disclosure while handling beacon probe frame during scan entry generation in client side. |
CVE-2024-21459 | Medium | 6.5 | 2024-08-05 | Information disclosure while handling beacon or probe response frame in STA. |
CVE-2024-7409 | High | 7.5 | 2024-08-05 | A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a c… |
CVE-2024-7397 | | 2024-08-05 | Improper filering of special characters result in a command ('command injection') vulnerability in Korenix JetPort 5601v3.This issue affects JetPort 5601v3: th… | |
CVE-2024-7396 | | 2024-08-05 | Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2. | |
CVE-2024-7395 | | 2024-08-05 | An authentication bypass vulnerability in Korenix JetPort 5601v3 allows an attacker to access functionality on the device without specifying a password.This is… | |
CVE-2024-7383 | High | 7.4 | 2024-08-05 | A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allo… |
CVE-2024-6472 | High | 7.8 | 2024-08-05 | Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the deve… |
CVE-2024-4607 | High | 7.8 | 2024-08-05 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2024-2937 | High | 7.8 | 2024-08-05 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2024-40096 | Low | 3.3 | 2024-08-05 | The com.cascadialabs.who (aka Who - Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log. |
CVE-2024-36448 | High | 7.3 | 2024-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Server-Side Request Forgery (SSRF) vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0… |
CVE-2024-38856 | Critical | 9.8 | 2024-08-05 | Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.1… |
CVE-2024-42447 | Critical | 9.8 | 2024-08-05 | Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache A… |
CVE-2024-6710 | Medium | 5.4 | 2024-08-05 | The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cr… |
CVE-2024-6498 | Medium | 4.8 | 2024-08-05 | The Chatbot for WordPress by Collect.chat ⚡️ WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-6270 | Medium | 4.8 | 2024-08-05 | The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-5081 | Medium | 6.1 | 2024-08-05 | The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow atta… |
CVE-2024-3636 | Medium | 5.4 | 2024-08-05 | The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2024-2232 | High | 8.1 | 2024-08-05 | The lacks CSRF checks allowing a user to invite any user to any group (including private groups) |
CVE-2024-6118 | Critical | 9.1 | 2024-08-05 | A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the othe… |
CVE-2024-6117 | High | 8.8 | 2024-08-05 | A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote aut… |
CVE-2024-41889 | Critical | 9.8 | 2024-08-05 | Multiple Pimax products accept WebSocket connections from unintended endpoints. If this vulnerability is exploited, arbitrary code may be executed by a remote… |
CVE-2024-41720 | High | 8.0 | 2024-08-05 | Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow a network-adjacent… |
CVE-2024-39838 | High | 8.8 | 2024-08-05 | ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15 uses hard-coded credentials, which may allow a network-adjacent attacker with an administrative privilege… |
CVE-2024-39713 | High | 8.6 | 2024-08-05 | A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. |
CVE-2024-7470 | Medium | 6.3 | 2024-08-05 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been rated as critical. This issue affects the function sslvpn_config… |
CVE-2024-7469 | Medium | 6.3 | 2024-08-05 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been declared as critical. This vulnerability affects the function ss… |
CVE-2024-7468 | Medium | 6.3 | 2024-08-05 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been classified as critical. This affects the function sslvpn_config_… |
CVE-2024-7467 | Medium | 6.3 | 2024-08-05 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 and classified as critical. Affected by this issue is the function sslvpn_con… |
CVE-2024-7466 | Low | 2.4 | 2024-08-05 | A vulnerability has been found in PMWeb 7.2.00 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web A… |
CVE-2024-7465 | High | 8.8 | 2024-08-05 | A vulnerability, which was classified as critical, was found in TOTOLINK CP450 4.1.0cu.747_B20191224. Affected is the function loginauth of the file /cgi-bin/c… |
CVE-2024-7464 | Medium | 6.3 | 2024-08-05 | A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Tel… |
CVE-2024-7463 | High | 8.8 | 2024-08-05 | A vulnerability classified as critical was found in TOTOLINK CP900 6.3c.566. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cs… |
CVE-2024-7462 | High | 8.8 | 2024-08-05 | A vulnerability classified as critical has been found in TOTOLINK N350RT 9.3.5u.6139_B20201216. This affects the function setWizardCfg of the file /cgi-bin/cst… |
CVE-2024-7461 | High | 7.3 | 2024-08-05 | A vulnerability was found in ForIP Tecnologia Administração PABX 1.x. It has been rated as critical. Affected by this issue is some unknown functionality of th… |
CVE-2024-7460 | Medium | 4.3 | 2024-08-04 | A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been declared as problematic. Affected by this vulnerability is an unknown funct… |
CVE-2024-7459 | Medium | 4.3 | 2024-08-04 | A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been classified as problematic. Affected is an unknown function of the file /edi… |
CVE-2024-7458 | Medium | 5.5 | 2024-08-04 | A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /ap… |
CVE-2024-35143 | Medium | 6.7 | 2024-08-04 | IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is… |
CVE-2024-7455 | Medium | 6.3 | 2024-08-04 | A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part of the file partedit… |
CVE-2024-7454 | Medium | 6.3 | 2024-08-04 | A vulnerability, which was classified as critical, has been found in SourceCodester Clinics Patient Management System 1.0. Affected by this issue is the functi… |
CVE-2024-7453 | Low | 2.4 | 2024-08-04 | A vulnerability was found in FastAdmin 1.5.0.20240328. It has been declared as problematic. This vulnerability affects unknown code of the file /[admins_url].p… |
CVE-2024-7452 | Medium | 6.3 | 2024-08-04 | A vulnerability was found in itsourcecode Placement Management System 1.0. It has been classified as critical. This affects an unknown part of the file view_co… |
CVE-2024-7451 | Medium | 6.3 | 2024-08-04 | A vulnerability was found in itsourcecode Placement Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of t… |
CVE-2024-7450 | Medium | 6.3 | 2024-08-04 | A vulnerability has been found in itsourcecode Placement Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-7449 | High | 7.3 | 2024-08-04 | A vulnerability, which was classified as critical, was found in itsourcecode Placement Management System 1.0. Affected is an unknown function of the file login… |
CVE-2024-6331 | High | 7.5 | 2024-08-04 | stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection. The integration… |
CVE-2024-7446 | Medium | 4.7 | 2024-08-03 | A vulnerability, which was classified as critical, was found in itsourcecode Ticket Reservation System 1.0. This affects an unknown part of the file list_ticke… |
CVE-2024-7445 | Medium | 4.7 | 2024-08-03 | A vulnerability, which was classified as critical, has been found in itsourcecode Ticket Reservation System 1.0. Affected by this issue is some unknown functio… |
CVE-2024-7444 | High | 7.3 | 2024-08-03 | A vulnerability classified as critical was found in itsourcecode Ticket Reservation System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-7443 | Medium | 6.3 | 2024-08-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Vivotek IB8367A VVTK-0100b. Affected is the function getenv of the fil… |
CVE-2024-7442 | Medium | 6.3 | 2024-08-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been rated as critical. This issue affects the function getenv o… |
CVE-2024-7441 | High | 8.8 | 2024-08-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been declared as critical. This vulnerability affects the functi… |
CVE-2024-7440 | Medium | 6.3 | 2024-08-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d. It has been classified as critical. This affects the function getenv of… |
CVE-2024-7439 | High | 8.8 | 2024-08-03 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d and classified as critical. Affected by this issue is the function read… |
CVE-2024-7438 | Medium | 4.3 | 2024-08-03 | A vulnerability has been found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2024-37286 | Medium | 5.7 | 2024-08-03 | APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document… |
CVE-2024-7437 | Medium | 5.4 | 2024-08-03 | A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile… |
CVE-2024-7436 | Medium | 6.3 | 2024-08-03 | A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07. This issue affects the function msp_info_htm of the file msp_info.ht… |
CVE-2024-38321 | Medium | 5.3 | 2024-08-03 | IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could b… |
CVE-2024-6872 | Medium | 4.3 | 2024-08-03 | The Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenberg Blocks! – Templat… |
CVE-2024-6709 | Medium | 4.3 | 2024-08-03 | The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sps_add_update_… |
CVE-2024-7356 | Medium | 6.4 | 2024-08-03 | The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘filename’ parameter in all versions up to, and including… |
CVE-2024-7257 | Critical | 9.8 | 2024-08-03 | The YayExtra – WooCommerce Extra Product Options plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle… |
CVE-2024-7031 | High | 7.5 | 2024-08-03 | The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSe… |
CVE-2024-7291 | High | 7.2 | 2024-08-03 | The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restrictio… |
CVE-2024-6477 | High | 7.5 | 2024-08-03 | The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to downloa… |
CVE-2024-6390 | Medium | 5.9 | 2024-08-03 | The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privil… |
CVE-2024-7319 | Medium | 5.0 | 2024-08-02 | An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command wi… |
CVE-2024-3056 | High | 7.7 | 2024-08-02 | A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least… |
CVE-2024-38891 | High | 7.5 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Sniffin… |
CVE-2024-38887 | Critical | 9.8 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to expand control ov… |
CVE-2024-42349 | Medium | 5.3 | 2024-08-02 | FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored d… |
CVE-2024-42348 | Critical | 9.3 | 2024-08-02 | FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.2 can leak AD username and password when registering a computer. This… |
CVE-2024-38889 | Critical | 9.8 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform SQL Injec… |
CVE-2024-38888 | Medium | 6.8 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform a Password… |
CVE-2024-28298 | High | 8.8 | 2024-08-02 | SQL injection vulnerability in BM SOFT BMPlanning 1.0.0.1 allows authenticated users to execute arbitrary SQL commands via the SEC_IDF, LIE_IDF, PLANF_IDF, CLI… |
CVE-2024-28297 | High | 7.5 | 2024-08-02 | SQL injection vulnerability in AzureSoft MyHorus 4.3.5 allows authenticated users to execute arbitrary SQL commands via unspecified vectors. |
CVE-2024-22169 | | 2024-08-02 | WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRO… | |
CVE-2024-38886 | Critical | 9.8 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Traffic… |
CVE-2024-38885 | High | 7.5 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform unauthori… |
CVE-2024-38884 | High | 7.8 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform an Authent… |
CVE-2024-38883 | Critical | 9.1 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Drop En… |
CVE-2024-38882 | Critical | 9.8 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform command l… |
CVE-2024-38881 | High | 7.5 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Rainbow… |
CVE-2024-33896 | High | 7.2 | 2024-08-02 | Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper parameter blacklisting. Th… |
CVE-2024-33895 | Medium | 6.6 | 2024-08-02 | Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters. This is fixed in… |
CVE-2024-33894 | High | 8.8 | 2024-08-02 | Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with e… |
CVE-2024-33893 | Medium | 6.1 | 2024-08-02 | Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to XSS when displaying the logs due to improper input saniti… |
CVE-2024-33892 | High | 7.5 | 2024-08-02 | Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking informatio… |
CVE-2024-7314 | Critical | 9.8 | 2024-08-02 | anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to b… |
CVE-2024-41519 | Medium | 5.4 | 2024-08-02 | Feripro <= v2.2.3 is vulnerable to Cross Site Scripting (XSS) via "/admin/programm/<program_id>/zuordnung/veranstaltungen/<event_id>" through the "school" inpu… |
CVE-2024-41518 | High | 7.5 | 2024-08-02 | An Incorrect Access Control vulnerability in "/admin/programm/<program_id>/export/statistics" in Feripro <= v2.2.3 allows remote attackers to export an XLSX fi… |
CVE-2024-41517 | Medium | 5.3 | 2024-08-02 | An Incorrect Access Control vulnerability in "/admin/benutzer/institution/rechteverwaltung/uebersicht" in Feripro <= v2.2.3 allows remote attackers to get a li… |
CVE-2024-41310 | High | 7.5 | 2024-08-02 | AndServer 2.1.12 is vulnerable to Directory Traversal. |
CVE-2024-7029 | High | 8.8 | 2024-08-02 | Commands can be injected over the network and executed without authentication. |
CVE-2024-41127 | High | 8.3 | 2024-08-02 | Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-com… |
CVE-2024-38890 | High | 8.4 | 2024-08-02 | An issue in Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 and possibly later versions allows a local attacker to perform an… |