2024 CVEs (page 211)
Page 211 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37901 | Critical | 9.9 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbit… |
CVE-2024-37900 | Medium | 6.4 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename… |
CVE-2024-37898 | Medium | 4.3 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit right on a page in X… |
CVE-2024-7340 | High | 8.8 | 2024-07-31 | The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak a… |
CVE-2024-3083 | High | 8.3 | 2024-07-31 | A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luri… |
CVE-2024-3082 | Medium | 4.2 | 2024-07-31 | A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the passwo… |
CVE-2024-37135 | Low | 3.3 | 2024-07-31 | DM5500 5.16.0.0, contains an information disclosure vulnerability. A local attacker with high privileges could potentially exploit this vulnerability, leading… |
CVE-2024-31203 | Low | 3.3 | 2024-07-31 | A “CWE-121: Stack-based Buffer Overflow” in the wd210std.dll dynamic library packaged with the ThermoscanIP installer allows a local attacker to possibly trigg… |
CVE-2024-31202 | High | 7.8 | 2024-07-31 | A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege… |
CVE-2024-31201 | Medium | 6.5 | 2024-07-31 | A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could be abused in scenarios where incorrect pe… |
CVE-2024-31200 | Medium | 4.2 | 2024-07-31 | A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to r… |
CVE-2024-31199 | High | 8.8 | 2024-07-31 | A “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently inject arbitrary Javascr… |
CVE-2024-6208 | Medium | 6.4 | 2024-07-31 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, an… |
CVE-2024-39379 | Medium | 5.5 | 2024-07-31 | Acrobat for Edge versions 126.0.2592.81 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An a… |
CVE-2024-7321 | Medium | 4.3 | 2024-07-31 | A vulnerability classified as problematic was found in itsourcecode Online Blood Bank Management System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2024-7320 | High | 7.3 | 2024-07-31 | A vulnerability classified as critical has been found in itsourcecode Online Blood Bank Management System 1.0. This affects an unknown part of the file /admin/… |
CVE-2024-7311 | High | 7.3 | 2024-07-31 | A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been rated as critical. This issue affects some unknown processing of the fi… |
CVE-2024-7135 | Medium | 6.5 | 2024-07-31 | The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_file' function in all versions up… |
CVE-2024-6725 | Medium | 4.9 | 2024-07-31 | The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Sit… |
CVE-2024-7310 | Low | 3.5 | 2024-07-31 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the f… |
CVE-2024-7309 | Low | 3.5 | 2024-07-31 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as problematic. This affects an unknown part of the file entry… |
CVE-2024-7308 | Medium | 6.3 | 2024-07-31 | A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this issue is some unknown func… |
CVE-2024-7307 | Medium | 6.3 | 2024-07-31 | A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this vulnerability is an u… |
CVE-2024-37142 | High | 7.3 | 2024-07-31 | Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnera… |
CVE-2024-37129 | Medium | 6.7 | 2024-07-31 | Dell Inventory Collector, versions prior to 12.3.0.6 contains a Path Traversal vulnerability. A local authenticated malicious user could potentially exploit th… |
CVE-2024-37127 | High | 7.8 | 2024-07-31 | Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnera… |
CVE-2024-32857 | High | 7.3 | 2024-07-31 | Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulner… |
CVE-2024-2508 | Medium | 5.3 | 2024-07-31 | The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_menu_item_icon functio… |
CVE-2024-7306 | Medium | 6.3 | 2024-07-31 | A vulnerability, which was classified as critical, was found in SourceCodester Establishment Billing Management System 1.0. Affected is an unknown function of… |
CVE-2024-7303 | Low | 3.5 | 2024-07-31 | A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2024-7264 | Medium | 6.5 | 2024-07-31 | libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the par… |
CVE-2024-7300 | Low | 3.5 | 2024-07-31 | A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/showcases of the comp… |
CVE-2024-7299 | Low | 3.5 | 2024-07-31 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1. It has been rated as problematic. This issue affects some unknown processing of th… |
CVE-2024-6980 | Critical | 9.8 | 2024-07-31 | A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. Thi… |
CVE-2024-7290 | Medium | 6.3 | 2024-07-31 | A vulnerability classified as critical has been found in SourceCodester Establishment Billing Management System 1.0. This affects an unknown part of the file /… |
CVE-2024-7289 | Medium | 6.3 | 2024-07-31 | A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown… |
CVE-2024-7205 | | 2024-07-31 | When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via shari… | |
CVE-2024-6770 | High | 7.2 | 2024-07-31 | The Lifetime free Drag & Drop Contact Form Builder for WordPress VForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to… |
CVE-2024-6695 | Critical | 9.8 | 2024-07-31 | it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is d… |
CVE-2024-6412 | Medium | 6.5 | 2024-07-31 | The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted a… |
CVE-2024-6408 | Medium | 5.4 | 2024-07-31 | The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and a… |
CVE-2024-6272 | Medium | 6.1 | 2024-07-31 | The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2024-6165 | Medium | 4.8 | 2024-07-31 | The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-42381 | High | 8.3 | 2024-07-31 | os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via… |
CVE-2024-7288 | Medium | 6.3 | 2024-07-31 | A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an… |
CVE-2024-7287 | Medium | 6.3 | 2024-07-31 | A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been classified as critical. Affected is an unknown function of… |
CVE-2024-7286 | High | 7.3 | 2024-07-31 | A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. This issue affects some unknown processing… |
CVE-2024-7285 | Low | 3.5 | 2024-07-31 | A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as problematic. This vulnerability affects unknown… |
CVE-2024-39950 | High | 8.6 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device in… |
CVE-2024-39949 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device t… |
CVE-2024-39948 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device t… |
CVE-2024-39947 | Medium | 6.5 | 2024-07-31 | A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data pack… |
CVE-2024-39946 | Medium | 6.0 | 2024-07-31 | A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data pack… |
CVE-2024-39945 | Medium | 4.9 | 2024-07-31 | A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attacker can send a carefully crafted data pa… |
CVE-2024-39944 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to… |
CVE-2024-7284 | Low | 3.5 | 2024-07-31 | A vulnerability, which was classified as problematic, was found in SourceCodester Lot Reservation Management System 1.0. This affects an unknown part of the fi… |
CVE-2024-7283 | Medium | 6.3 | 2024-07-31 | A vulnerability, which was classified as critical, has been found in SourceCodester Lot Reservation Management System 1.0. Affected by this issue is some unkno… |
CVE-2024-7282 | Medium | 6.3 | 2024-07-31 | A vulnerability classified as critical was found in SourceCodester Lot Reservation Management System 1.0. Affected by this vulnerability is an unknown function… |
CVE-2024-7281 | Medium | 6.3 | 2024-07-31 | A vulnerability classified as critical has been found in SourceCodester Lot Reservation Management System 1.0. Affected is an unknown function of the file /adm… |
CVE-2024-7280 | Medium | 6.3 | 2024-07-31 | A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2024-7279 | High | 7.3 | 2024-07-31 | A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2024-7278 | Medium | 4.7 | 2024-07-31 | A vulnerability was found in itsourcecode Alton Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/team… |
CVE-2024-6255 | High | 8.2 | 2024-07-31 | A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including criti… |
CVE-2024-7277 | Medium | 4.7 | 2024-07-31 | A vulnerability was found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-7276 | Medium | 4.7 | 2024-07-30 | A vulnerability has been found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-7275 | Medium | 4.7 | 2024-07-30 | A vulnerability, which was classified as critical, was found in itsourcecode Alton Management System 1.0. Affected is an unknown function of the file /admin/ca… |
CVE-2024-7274 | Medium | 4.7 | 2024-07-30 | A vulnerability, which was classified as critical, has been found in itsourcecode Alton Management System 1.0. This issue affects some unknown processing of th… |
CVE-2024-37281 | Medium | 6.5 | 2024-07-30 | An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted request… |
CVE-2024-7273 | Medium | 6.3 | 2024-07-30 | A vulnerability classified as critical was found in itsourcecode Alton Management System 1.0. This vulnerability affects unknown code of the file search.php. T… |
CVE-2024-5901 | Medium | 6.4 | 2024-07-30 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up to, and including… |
CVE-2024-38983 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impact… |
CVE-2024-41945 | Low | 3.1 | 2024-07-30 | fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silen… |
CVE-2024-41611 | Critical | 9.8 | 2024-07-30 | In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet servic… |
CVE-2024-41610 | Critical | 9.8 | 2024-07-30 | D-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotely to the Telnet serv… |
CVE-2024-39012 | Critical | 9.8 | 2024-07-30 | ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackers to execute arbitra… |
CVE-2024-39011 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via… |
CVE-2024-39010 | Critical | 9.8 | 2024-07-30 | chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allows attackers to ex… |
CVE-2024-38986 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge me… |
CVE-2024-38984 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the __proto__ property. |
CVE-2024-36572 | Critical | 9.8 | 2024-07-30 | Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and… |
CVE-2024-5250 | Low | 3.5 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0 overly verbose errors can be found in SAML integrations |
CVE-2024-5249 | Medium | 5.4 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. |
CVE-2024-41443 | Medium | 5.5 | 2024-07-30 | A stack overflow in the function cp_dynamic() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file. |
CVE-2024-41440 | Medium | 6.2 | 2024-07-30 | A heap buffer overflow in the function png_quantize() of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file. |
CVE-2024-41439 | Medium | 5.5 | 2024-07-30 | A heap buffer overflow in the function cp_block() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG… |
CVE-2024-41438 | Medium | 6.2 | 2024-07-30 | A heap buffer overflow in the function cp_stored() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG… |
CVE-2024-41437 | Medium | 5.5 | 2024-07-30 | A heap buffer overflow in the function cp_unfilter() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted P… |
CVE-2024-3930 | Medium | 6.3 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. |
CVE-2024-41943 | Medium | 4.6 | 2024-07-30 | I, Librarian is an open-source version of a PDF managing SaaS. PDF notes are displayed on the Item Summary page without any form of validation or sanitation. A… |
CVE-2024-41305 | Medium | 4.7 | 2024-07-30 | A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection… |
CVE-2024-41304 | Medium | 5.4 | 2024-07-30 | An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file. |
CVE-2024-7297 | High | 8.8 | 2024-07-30 | Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privilege… |
CVE-2024-7209 | Medium | 6.5 | 2024-07-30 | A vulnerability exists in the use of shared SPF records in multi-tenant hosting providers, allowing attackers to use network authorization to be abused to spoo… |
CVE-2024-7208 | Medium | 6.5 | 2024-07-30 | A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass security measures provided… |
CVE-2024-5486 | Medium | 5.8 | 2024-07-30 | A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext fo… |
CVE-2024-41944 | Medium | 6.5 | 2024-07-30 | Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This… |
CVE-2024-41916 | Medium | 6.8 | 2024-07-30 | A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext fo… |
CVE-2024-41915 | High | 7.2 | 2024-07-30 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2024-41804 | Medium | 6.5 | 2024-07-30 | Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet… |
CVE-2024-41803 | Medium | 4.9 | 2024-07-30 | Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. T… |