2024 CVEs (page 210)
Page 210 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7255 | High | 8.8 | 2024-08-01 | Out of bounds read in WebTransport in Google Chrome prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a c… |
CVE-2024-6990 | High | 8.8 | 2024-08-01 | Uninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2024-7359 | Low | 3.5 | 2024-08-01 | A vulnerability was found in SourceCodester Tracking Monitoring Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown… |
CVE-2024-7211 | Medium | 4.7 | 2024-08-01 | The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to cont… |
CVE-2024-41962 | Medium | 4.6 | 2024-08-01 | Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set when noscraper is se… |
CVE-2024-23600 | Low | 2.7 | 2024-08-01 | Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficient brute forcing appr… |
CVE-2024-6873 | High | 8.1 | 2024-08-01 | It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request t… |
CVE-2024-6242 | | 2024-08-01 | A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. I… | |
CVE-2024-6040 | High | 8.8 | 2024-08-01 | In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifica… |
CVE-2024-41265 | High | 7.5 | 2024-08-01 | A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function. |
CVE-2024-41264 | High | 7.5 | 2024-08-01 | An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method. |
CVE-2024-41260 | High | 7.5 | 2024-08-01 | A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive inform… |
CVE-2024-41961 | Critical | 9.6 | 2024-08-01 | Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search fu… |
CVE-2024-41946 | Medium | 5.3 | 2024-08-01 | REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser AP… |
CVE-2024-41926 | Low | 2.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malici… |
CVE-2024-41162 | Medium | 4.1 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when sha… |
CVE-2024-41144 | Medium | 5.5 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled, w… |
CVE-2024-41123 | Medium | 5.3 | 2024-08-01 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as white… |
CVE-2024-39839 | Medium | 4.3 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channel… |
CVE-2024-39837 | Low | 3.8 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, whe… |
CVE-2024-39832 | Medium | 6.8 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly safeguard an error handling which allows a malicious remote… |
CVE-2024-39777 | High | 8.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels… |
CVE-2024-39274 | High | 8.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync messa… |
CVE-2024-36492 | High | 7.4 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in share… |
CVE-2024-29977 | Low | 2.7 | 2024-08-01 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remot… |
CVE-2024-7358 | High | 7.8 | 2024-08-01 | A vulnerability was found in Point B Ltd Getscreen Agent 2.19.6 on Windows. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-6923 | Medium | 5.5 | 2024-08-01 | There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email mess… |
CVE-2024-7357 | Medium | 6.3 | 2024-08-01 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-600 up to 2.18. It has been rated as critical. This issue affects the function soapcgi_… |
CVE-2024-2455 | Medium | 6.4 | 2024-08-01 | The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget wrapper l… |
CVE-2024-6346 | Medium | 6.4 | 2024-08-01 | The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL parameter of the Date Co… |
CVE-2024-38490 | Medium | 5.8 | 2024-08-01 | Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. A privileged local attacker could execute arbitrary code poten… |
CVE-2024-38489 | Low | 3.1 | 2024-08-01 | Dell iDRAC Service Module version 5.3.0.0 and prior contains Out of bound write Vulnerability. A privileged local attacker could execute arbitrary code potenti… |
CVE-2024-38481 | Medium | 4.8 | 2024-08-01 | Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Read Vulnerability. A privileged local attacker could execute arbitrary code potent… |
CVE-2024-28972 | Medium | 5.9 | 2024-08-01 | Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially e… |
CVE-2024-25948 | Medium | 4.8 | 2024-08-01 | Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. A privileged local attacker could execute arbitrary code poten… |
CVE-2024-7302 | Medium | 6.4 | 2024-08-01 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads in all versions up… |
CVE-2024-5678 | Medium | 4.7 | 2024-08-01 | Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature. |
CVE-2024-5331 | Medium | 4.3 | 2024-08-01 | The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it possible for authen… |
CVE-2024-5330 | Medium | 6.4 | 2024-08-01 | The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the breakdance_css_file_paths_cache parameter in all versions up to, and i… |
CVE-2024-25947 | Medium | 4.8 | 2024-08-01 | Dell iDRAC Service Module version 5.3.0.0 and prior, contain an Out of bound Read Vulnerability. A privileged local attacker could execute arbitrary code poten… |
CVE-2024-6529 | High | 7.1 | 2024-08-01 | The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle… |
CVE-2024-6496 | Medium | 6.5 | 2024-08-01 | The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in users perform such a… |
CVE-2024-4090 | Medium | 4.8 | 2024-08-01 | The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does not sanitise and esca… |
CVE-2024-3983 | High | 8.1 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in ad… |
CVE-2024-2872 | Medium | 4.8 | 2024-08-01 | The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-2843 | Medium | 6.5 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin us… |
CVE-2024-1747 | Medium | 6.5 | 2024-08-01 | The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users… |
CVE-2024-7343 | Low | 3.5 | 2024-08-01 | A vulnerability was found in Baidu UEditor 1.4.2. It has been declared as problematic. This vulnerability affects unknown code of the file /ueditor142/php/cont… |
CVE-2024-7342 | Low | 3.5 | 2024-08-01 | A vulnerability was found in Baidu UEditor 1.4.3.3. It has been classified as problematic. This affects an unknown part of the file /ueditor/php/controller.php… |
CVE-2024-2090 | Medium | 6.4 | 2024-08-01 | The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via the remote_content… |
CVE-2024-7339 | Medium | 5.3 | 2024-08-01 | A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problemat… |
CVE-2024-7338 | High | 8.8 | 2024-08-01 | A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function setParentalRules of the file… |
CVE-2024-6698 | High | 8.8 | 2024-08-01 | The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly v… |
CVE-2024-7337 | High | 8.8 | 2024-08-01 | A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function loginauth o… |
CVE-2024-7336 | High | 8.8 | 2024-08-01 | A vulnerability classified as critical was found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected by this vulnerability is the function loginauth of the file… |
CVE-2024-7335 | High | 8.8 | 2024-08-01 | A vulnerability classified as critical has been found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected is the function getSaveConfig of the file /cgi-bin/cste… |
CVE-2024-7334 | High | 8.8 | 2024-08-01 | A vulnerability was found in TOTOLINK EX1200L 9.3.5u.6146_B20201023. It has been rated as critical. This issue affects the function UploadCustomModule of the f… |
CVE-2024-7333 | High | 8.8 | 2024-08-01 | A vulnerability was found in TOTOLINK N350RT 9.3.5u.6139_B20201216. It has been declared as critical. This vulnerability affects the function setParentalRules… |
CVE-2024-6687 | Medium | 5.3 | 2024-08-01 | The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-c… |
CVE-2024-40883 | High | 8.8 | 2024-08-01 | Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an admin… |
CVE-2024-39607 | Medium | 6.8 | 2024-08-01 | OS command injection vulnerability exists in ELECOM wireless LAN routers. A specially crafted request may be sent to the affected product by a logged-in user w… |
CVE-2024-34021 | Medium | 6.8 | 2024-08-01 | Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected p… |
CVE-2024-7332 | Critical | 9.8 | 2024-08-01 | A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-b… |
CVE-2024-7331 | High | 8.8 | 2024-08-01 | A vulnerability was found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as critical. Affected by this issue is the function UploadCustomModule of th… |
CVE-2024-7330 | Medium | 6.3 | 2024-08-01 | A vulnerability has been found in YouDianCMS 7 and classified as critical. Affected by this vulnerability is the function curl_exec of the file /App/Core/Exten… |
CVE-2024-7329 | Medium | 6.3 | 2024-07-31 | A vulnerability, which was classified as critical, was found in YouDianCMS 7. Affected is an unknown function of the file /Public/ckeditor/plugins/multiimage/d… |
CVE-2024-7328 | Medium | 5.3 | 2024-07-31 | A vulnerability, which was classified as problematic, has been found in YouDianCMS 7. This issue affects some unknown processing of the file /t.php?action=phpi… |
CVE-2024-38182 | Critical | 9.0 | 2024-07-31 | Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network. |
CVE-2024-7327 | Medium | 6.3 | 2024-07-31 | A vulnerability classified as critical was found in Xinhu RockOA 2.6.2. This vulnerability affects the function dataAction of the file /webmain/task/openapi/op… |
CVE-2024-41262 | High | 7.4 | 2024-07-31 | mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing attackers to intercept communicat… |
CVE-2024-7326 | High | 7.8 | 2024-07-31 | A vulnerability classified as critical has been found in IObit DualSafe Password Manager 1.4.0.3. This affects an unknown part in the library RTL120.BPL of the… |
CVE-2024-4187 | Medium | 5.4 | 2024-07-31 | Stored XSS vulnerability has been discovered in OpenText™ Filr product, affecting versions 24.1.1 and 24.2. The vulnerability could cause users to not be warne… |
CVE-2024-41258 | Medium | 5.3 | 2024-07-31 | An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain s… |
CVE-2024-41256 | Medium | 5.9 | 2024-07-31 | Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sendin… |
CVE-2024-41255 | High | 7.5 | 2024-07-31 | filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle atta… |
CVE-2024-41254 | Medium | 5.3 | 2024-07-31 | An issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obta… |
CVE-2024-41253 | High | 7.1 | 2024-07-31 | goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component. |
CVE-2024-40465 | High | 8.8 | 2024-07-31 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file |
CVE-2024-40464 | High | 8.8 | 2024-07-31 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file |
CVE-2024-7325 | High | 7.8 | 2024-07-31 | A vulnerability was found in IObit Driver Booster 11.0.0.0. It has been rated as critical. Affected by this issue is some unknown functionality in the library… |
CVE-2024-41955 | Medium | 5.2 | 2024-07-31 | Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability ex… |
CVE-2024-41954 | Medium | 5.3 | 2024-07-31 | FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings"… |
CVE-2024-41951 | Medium | 4.4 | 2024-07-31 | Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games. The issue is that the map of encoding/deco… |
CVE-2024-41660 | Critical | 9.8 | 2024-07-31 | slpd-lite is a unicast SLP UDP server. Any OpenBMC system that includes the slpd-lite package is impacted. Installing this package is the default when building… |
CVE-2024-41630 | High | 7.6 | 2024-07-31 | Stack-based buffer overflow vulnerability in Tenda AC18 V15.03.3.10_EN allows a remote attacker to execute arbitrary code via the ssid parameter at ip/goform/f… |
CVE-2024-41108 | High | 7.5 | 2024-07-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's… |
CVE-2024-40645 | High | 8.8 | 2024-07-31 | FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users to execute arbitrary… |
CVE-2024-7324 | High | 7.8 | 2024-07-31 | A vulnerability was found in IObit iTop Data Recovery Pro 4.4.0.687. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-23444 | Medium | 4.9 | 2024-07-31 | It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Req… |
CVE-2024-6978 | Medium | 5.6 | 2024-07-31 | Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users.This issue affects SDP Client: before 5.10.28. |
CVE-2024-6977 | Medium | 6.5 | 2024-07-31 | A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover… |
CVE-2024-6975 | High | 8.8 | 2024-07-31 | Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file. This issue affects SDP Client before 5.10.34. |
CVE-2024-6974 | High | 8.8 | 2024-07-31 | Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34. |
CVE-2024-6973 | High | 7.5 | 2024-07-31 | Remote Code Execution in Cato Windows SDP client via crafted URLs. This issue affects Windows SDP Client before 5.10.34. |
CVE-2024-41953 | Medium | 4.3 | 2024-07-31 | Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That informat… |
CVE-2024-41952 | Medium | 5.3 | 2024-07-31 | Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate atta… |
CVE-2024-41950 | High | 7.5 | 2024-07-31 | Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients tha… |
CVE-2024-41947 | Critical | 9.0 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rig… |
CVE-2024-39694 | Medium | 4.7 | 2024-07-31 | Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functi… |
CVE-2024-39318 | Medium | 5.4 | 2024-07-31 | The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface. The file upload widget is vulnerable to XSS payloads in… |