2024 CVEs (page 211)
Page 211 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41256 | Medium | 5.9 | 2024-07-31 | Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sendin… |
CVE-2024-41255 | High | 7.5 | 2024-07-31 | filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle atta… |
CVE-2024-41254 | Medium | 5.3 | 2024-07-31 | An issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obta… |
CVE-2024-41253 | High | 7.1 | 2024-07-31 | goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component. |
CVE-2024-40465 | High | 8.8 | 2024-07-31 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file |
CVE-2024-40464 | High | 8.8 | 2024-07-31 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file |
CVE-2024-7325 | High | 7.8 | 2024-07-31 | A vulnerability was found in IObit Driver Booster 11.0.0.0. It has been rated as critical. Affected by this issue is some unknown functionality in the library… |
CVE-2024-41955 | Medium | 5.2 | 2024-07-31 | Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability ex… |
CVE-2024-41954 | Medium | 5.3 | 2024-07-31 | FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings"… |
CVE-2024-41951 | Medium | 4.4 | 2024-07-31 | Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games. The issue is that the map of encoding/deco… |
CVE-2024-41660 | Critical | 9.8 | 2024-07-31 | slpd-lite is a unicast SLP UDP server. Any OpenBMC system that includes the slpd-lite package is impacted. Installing this package is the default when building… |
CVE-2024-41630 | High | 7.6 | 2024-07-31 | Stack-based buffer overflow vulnerability in Tenda AC18 V15.03.3.10_EN allows a remote attacker to execute arbitrary code via the ssid parameter at ip/goform/f… |
CVE-2024-41108 | High | 7.5 | 2024-07-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's… |
CVE-2024-40645 | High | 8.8 | 2024-07-31 | FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users to execute arbitrary… |
CVE-2024-7324 | High | 7.8 | 2024-07-31 | A vulnerability was found in IObit iTop Data Recovery Pro 4.4.0.687. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-23444 | Medium | 4.9 | 2024-07-31 | It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Req… |
CVE-2024-6978 | Medium | 5.6 | 2024-07-31 | Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users.This issue affects SDP Client: before 5.10.28. |
CVE-2024-6977 | Medium | 6.5 | 2024-07-31 | A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover… |
CVE-2024-6975 | High | 8.8 | 2024-07-31 | Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file. This issue affects SDP Client before 5.10.34. |
CVE-2024-6974 | High | 8.8 | 2024-07-31 | Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34. |
CVE-2024-6973 | High | 7.5 | 2024-07-31 | Remote Code Execution in Cato Windows SDP client via crafted URLs. This issue affects Windows SDP Client before 5.10.34. |
CVE-2024-41953 | Medium | 4.3 | 2024-07-31 | Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That informat… |
CVE-2024-41952 | Medium | 5.3 | 2024-07-31 | Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate atta… |
CVE-2024-41950 | High | 7.5 | 2024-07-31 | Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients tha… |
CVE-2024-41947 | Critical | 9.0 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rig… |
CVE-2024-39694 | Medium | 4.7 | 2024-07-31 | Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functi… |
CVE-2024-39318 | Medium | 5.4 | 2024-07-31 | The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface. The file upload widget is vulnerable to XSS payloads in… |
CVE-2024-37901 | Critical | 9.9 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbit… |
CVE-2024-37900 | Medium | 6.4 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename… |
CVE-2024-37898 | Medium | 4.3 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit right on a page in X… |
CVE-2024-7340 | High | 8.8 | 2024-07-31 | The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak a… |
CVE-2024-3083 | High | 8.3 | 2024-07-31 | A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luri… |
CVE-2024-3082 | Medium | 4.2 | 2024-07-31 | A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the passwo… |
CVE-2024-37135 | Low | 3.3 | 2024-07-31 | DM5500 5.16.0.0, contains an information disclosure vulnerability. A local attacker with high privileges could potentially exploit this vulnerability, leading… |
CVE-2024-31203 | Low | 3.3 | 2024-07-31 | A “CWE-121: Stack-based Buffer Overflow” in the wd210std.dll dynamic library packaged with the ThermoscanIP installer allows a local attacker to possibly trigg… |
CVE-2024-31202 | High | 7.8 | 2024-07-31 | A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege… |
CVE-2024-31201 | Medium | 6.5 | 2024-07-31 | A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could be abused in scenarios where incorrect pe… |
CVE-2024-31200 | Medium | 4.2 | 2024-07-31 | A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to r… |
CVE-2024-31199 | High | 8.8 | 2024-07-31 | A “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently inject arbitrary Javascr… |
CVE-2024-6208 | Medium | 6.4 | 2024-07-31 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, an… |
CVE-2024-39379 | Medium | 5.5 | 2024-07-31 | Acrobat for Edge versions 126.0.2592.81 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An a… |
CVE-2024-7321 | Medium | 4.3 | 2024-07-31 | A vulnerability classified as problematic was found in itsourcecode Online Blood Bank Management System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2024-7320 | High | 7.3 | 2024-07-31 | A vulnerability classified as critical has been found in itsourcecode Online Blood Bank Management System 1.0. This affects an unknown part of the file /admin/… |
CVE-2024-7311 | High | 7.3 | 2024-07-31 | A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been rated as critical. This issue affects some unknown processing of the fi… |
CVE-2024-7135 | Medium | 6.5 | 2024-07-31 | The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_file' function in all versions up… |
CVE-2024-6725 | Medium | 4.9 | 2024-07-31 | The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Sit… |
CVE-2024-7310 | Low | 3.5 | 2024-07-31 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the f… |
CVE-2024-7309 | Low | 3.5 | 2024-07-31 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as problematic. This affects an unknown part of the file entry… |
CVE-2024-7308 | Medium | 6.3 | 2024-07-31 | A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this issue is some unknown func… |
CVE-2024-7307 | Medium | 6.3 | 2024-07-31 | A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this vulnerability is an u… |
CVE-2024-37142 | High | 7.3 | 2024-07-31 | Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnera… |
CVE-2024-37129 | Medium | 6.7 | 2024-07-31 | Dell Inventory Collector, versions prior to 12.3.0.6 contains a Path Traversal vulnerability. A local authenticated malicious user could potentially exploit th… |
CVE-2024-37127 | High | 7.8 | 2024-07-31 | Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnera… |
CVE-2024-32857 | High | 7.3 | 2024-07-31 | Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulner… |
CVE-2024-2508 | Medium | 5.3 | 2024-07-31 | The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_menu_item_icon functio… |
CVE-2024-7306 | Medium | 6.3 | 2024-07-31 | A vulnerability, which was classified as critical, was found in SourceCodester Establishment Billing Management System 1.0. Affected is an unknown function of… |
CVE-2024-7303 | Low | 3.5 | 2024-07-31 | A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2024-7264 | Medium | 6.5 | 2024-07-31 | libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the par… |
CVE-2024-7300 | Low | 3.5 | 2024-07-31 | A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/showcases of the comp… |
CVE-2024-7299 | Low | 3.5 | 2024-07-31 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1. It has been rated as problematic. This issue affects some unknown processing of th… |
CVE-2024-6980 | Critical | 9.8 | 2024-07-31 | A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. Thi… |
CVE-2024-7290 | Medium | 6.3 | 2024-07-31 | A vulnerability classified as critical has been found in SourceCodester Establishment Billing Management System 1.0. This affects an unknown part of the file /… |
CVE-2024-7289 | Medium | 6.3 | 2024-07-31 | A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown… |
CVE-2024-7205 | | 2024-07-31 | When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via shari… | |
CVE-2024-6770 | High | 7.2 | 2024-07-31 | The Lifetime free Drag & Drop Contact Form Builder for WordPress VForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to… |
CVE-2024-6695 | Critical | 9.8 | 2024-07-31 | it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is d… |
CVE-2024-6412 | Medium | 6.5 | 2024-07-31 | The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted a… |
CVE-2024-6408 | Medium | 5.4 | 2024-07-31 | The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and a… |
CVE-2024-6272 | Medium | 6.1 | 2024-07-31 | The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2024-6165 | Medium | 4.8 | 2024-07-31 | The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-42381 | High | 8.3 | 2024-07-31 | os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via… |
CVE-2024-7288 | Medium | 6.3 | 2024-07-31 | A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an… |
CVE-2024-7287 | Medium | 6.3 | 2024-07-31 | A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been classified as critical. Affected is an unknown function of… |
CVE-2024-7286 | High | 7.3 | 2024-07-31 | A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. This issue affects some unknown processing… |
CVE-2024-7285 | Low | 3.5 | 2024-07-31 | A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as problematic. This vulnerability affects unknown… |
CVE-2024-39950 | High | 8.6 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device in… |
CVE-2024-39949 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device t… |
CVE-2024-39948 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device t… |
CVE-2024-39947 | Medium | 6.5 | 2024-07-31 | A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data pack… |
CVE-2024-39946 | Medium | 6.0 | 2024-07-31 | A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data pack… |
CVE-2024-39945 | Medium | 4.9 | 2024-07-31 | A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attacker can send a carefully crafted data pa… |
CVE-2024-39944 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to… |
CVE-2024-7284 | Low | 3.5 | 2024-07-31 | A vulnerability, which was classified as problematic, was found in SourceCodester Lot Reservation Management System 1.0. This affects an unknown part of the fi… |
CVE-2024-7283 | Medium | 6.3 | 2024-07-31 | A vulnerability, which was classified as critical, has been found in SourceCodester Lot Reservation Management System 1.0. Affected by this issue is some unkno… |
CVE-2024-7282 | Medium | 6.3 | 2024-07-31 | A vulnerability classified as critical was found in SourceCodester Lot Reservation Management System 1.0. Affected by this vulnerability is an unknown function… |
CVE-2024-7281 | Medium | 6.3 | 2024-07-31 | A vulnerability classified as critical has been found in SourceCodester Lot Reservation Management System 1.0. Affected is an unknown function of the file /adm… |
CVE-2024-7280 | Medium | 6.3 | 2024-07-31 | A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2024-7279 | High | 7.3 | 2024-07-31 | A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2024-7278 | Medium | 4.7 | 2024-07-31 | A vulnerability was found in itsourcecode Alton Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/team… |
CVE-2024-6255 | High | 8.2 | 2024-07-31 | A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including criti… |
CVE-2024-7277 | Medium | 4.7 | 2024-07-31 | A vulnerability was found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-7276 | Medium | 4.7 | 2024-07-30 | A vulnerability has been found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-7275 | Medium | 4.7 | 2024-07-30 | A vulnerability, which was classified as critical, was found in itsourcecode Alton Management System 1.0. Affected is an unknown function of the file /admin/ca… |
CVE-2024-7274 | Medium | 4.7 | 2024-07-30 | A vulnerability, which was classified as critical, has been found in itsourcecode Alton Management System 1.0. This issue affects some unknown processing of th… |
CVE-2024-37281 | Medium | 6.5 | 2024-07-30 | An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted request… |
CVE-2024-7273 | Medium | 6.3 | 2024-07-30 | A vulnerability classified as critical was found in itsourcecode Alton Management System 1.0. This vulnerability affects unknown code of the file search.php. T… |
CVE-2024-5901 | Medium | 6.4 | 2024-07-30 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up to, and including… |
CVE-2024-38983 | Critical | 9.8 | 2024-07-30 | Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impact… |
CVE-2024-41945 | Low | 3.1 | 2024-07-30 | fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silen… |
CVE-2024-41611 | Critical | 9.8 | 2024-07-30 | In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet servic… |