2024 CVEs (page 217)
Page 217 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39304 | High | 8.8 | 2024-07-26 | ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an imp… |
CVE-2024-38872 | High | 8.3 | 2024-07-26 | Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module. |
CVE-2024-38871 | High | 8.3 | 2024-07-26 | Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module. |
CVE-2024-41813 | High | 7.5 | 2024-07-26 | txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and prior to version 1… |
CVE-2024-41812 | High | 7.5 | 2024-07-26 | txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Server-Side Request Fo… |
CVE-2024-41375 | Medium | 6.1 | 2024-07-26 | ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php |
CVE-2024-41374 | Medium | 6.1 | 2024-07-26 | ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php |
CVE-2024-41373 | Medium | 6.3 | 2024-07-26 | ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php. |
CVE-2024-41354 | High | 7.1 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php |
CVE-2024-41353 | High | 7.1 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php |
CVE-2024-27358 | Low | 3.3 | 2024-07-26 | An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security through 23.x for macOS. Local users can blo… |
CVE-2024-27357 | Medium | 5.8 | 2024-07-26 | An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and WithSecure MDR thr… |
CVE-2024-26520 | Critical | 9.8 | 2024-07-26 | An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authenticat… |
CVE-2024-24257 | High | 7.5 | 2024-07-26 | An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information via a crafted script… |
CVE-2024-7050 | | 2024-07-26 | Improper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular scenarios.This issue a… | |
CVE-2024-41357 | High | 7.1 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php. |
CVE-2024-41356 | Medium | 4.7 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php. |
CVE-2024-41355 | Medium | 6.5 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php. |
CVE-2024-41805 | Medium | 6.1 | 2024-07-26 | Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected cross-site scripting… |
CVE-2024-41670 | High | 7.5 | 2024-07-26 | In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer… |
CVE-2024-7128 | Medium | 5.3 | 2024-07-26 | A flaw was found in the OpenShift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the… |
CVE-2024-6922 | | 2024-07-26 | Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the… | |
CVE-2024-40689 | Medium | 6.0 | 2024-07-26 | IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the att… |
CVE-2024-41692 | | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An… | |
CVE-2024-7062 | High | 8.8 | 2024-07-26 | Nimble Commander suffers from a privilege escalation vulnerability due to the server (info.filesmanager.Files.PrivilegedIOHelperV2) performing improper/insuffi… |
CVE-2024-41691 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem associated w… |
CVE-2024-41690 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext within the router's fi… |
CVE-2024-41689 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An a… |
CVE-2024-41688 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ data… |
CVE-2024-41687 | High | 7.5 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text. A remote attacker could exploit this vulnerabili… |
CVE-2024-41686 | Low | 3.3 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could exploit this by cre… |
CVE-2024-41685 | High | 7.5 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web managemen… |
CVE-2024-41684 | Medium | 5.3 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management… |
CVE-2024-35296 | High | 8.2 | 2024-07-26 | Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: f… |
CVE-2024-35161 | High | 7.5 | 2024-07-26 | Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poi… |
CVE-2024-25090 | Medium | 5.4 | 2024-07-26 | Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Rol… |
CVE-2024-6490 | Medium | 6.5 | 2024-07-26 | During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests… |
CVE-2024-40897 | Medium | 6.7 | 2024-07-26 | Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file w… |
CVE-2024-7120 | Medium | 6.3 | 2024-07-26 | A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file… |
CVE-2024-7119 | Medium | 6.3 | 2024-07-26 | A vulnerability, which was classified as critical, has been found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected by this issue i… |
CVE-2024-7118 | Medium | 6.3 | 2024-07-26 | A vulnerability classified as critical was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected by this vulnerability is an unkn… |
CVE-2024-7117 | Medium | 6.3 | 2024-07-26 | A vulnerability classified as critical has been found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected is an unknown function of t… |
CVE-2024-7116 | Medium | 6.3 | 2024-07-26 | A vulnerability was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. It has been rated as critical. This issue affects some unknown p… |
CVE-2024-7115 | Medium | 6.3 | 2024-07-26 | A vulnerability was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. It has been declared as critical. This vulnerability affects unk… |
CVE-2024-7114 | Medium | 6.3 | 2024-07-26 | A vulnerability was found in Tianchoy Blog up to 1.8.8. It has been classified as critical. This affects an unknown part of the file /so.php. The manipulation… |
CVE-2024-4447 | Critical | 9.9 | 2024-07-26 | In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dw… |
CVE-2024-41473 | Critical | 9.8 | 2024-07-25 | Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac |
CVE-2024-41468 | Critical | 9.8 | 2024-07-25 | Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand |
CVE-2024-3938 | Medium | 5.4 | 2024-07-25 | The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrate… |
CVE-2024-38103 | Medium | 5.9 | 2024-07-25 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-24623 | High | 8.8 | 2024-07-25 | Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can exploit this vulnerabil… |
CVE-2024-24622 | High | 8.8 | 2024-07-25 | Softaculous Webuzo contains a command injection in the password reset functionality. A remote, authenticated attacker can exploit this vulnerability to gain co… |
CVE-2024-24621 | Critical | 9.8 | 2024-07-25 | Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulne… |
CVE-2024-7106 | Medium | 4.3 | 2024-07-25 | A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/media_fo… |
CVE-2024-7105 | Medium | 6.3 | 2024-07-25 | A vulnerability classified as critical has been found in ForIP Tecnologia Administração PABX 1.x. Affected is an unknown function of the file /detalheIdUra of… |
CVE-2024-41809 | High | 7.2 | 2024-07-25 | OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulner… |
CVE-2024-6558 | Medium | 6.3 | 2024-07-25 | HMS Industrial Networks Anybus-CompactCom 30 products are vulnerable to a XSS attack caused by the lack of input sanitation checks. As a consequence, it is po… |
CVE-2024-41808 | High | 8.8 | 2024-07-25 | The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versi… |
CVE-2024-40324 | Medium | 5.4 | 2024-07-25 | A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fields, leading to HTTP… |
CVE-2024-38289 | Critical | 9.8 | 2024-07-25 | A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to… |
CVE-2024-38288 | High | 7.2 | 2024-07-25 | A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attackers with administ… |
CVE-2024-38287 | Critical | 9.8 | 2024-07-25 | The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the applic… |
CVE-2024-29069 | Medium | 4.8 | 2024-07-25 | In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-s… |
CVE-2024-29068 | Medium | 5.8 | 2024-07-25 | In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so ca… |
CVE-2024-40318 | High | 7.2 | 2024-07-25 | An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2024-1724 | Medium | 6.3 | 2024-07-25 | In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu… |
CVE-2024-40873 | Medium | 4.5 | 2024-07-25 | There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.07. Attackers with syst… |
CVE-2024-28772 | Medium | 6.8 | 2024-07-25 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 is vulnerable to stored cross-site scripting. This vulnerability al… |
CVE-2024-7007 | Critical | 9.8 | 2024-07-25 | Positron Broadcast Signal Processor TRA7005 v1.20 is vulnerable to an authentication bypass exploit that could allow an attacker to have unauthorized access to… |
CVE-2024-41801 | Medium | 4.7 | 2024-07-25 | OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of packaged installati… |
CVE-2024-41800 | Medium | 4.8 | 2024-07-25 | Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit… |
CVE-2024-40872 | High | 8.4 | 2024-07-25 | There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access… |
CVE-2024-36542 | High | 8.8 | 2024-07-25 | Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-7101 | High | 7.3 | 2024-07-25 | A vulnerability, which was classified as critical, has been found in ForIP Tecnologia Administração PABX 1.x. This issue affects some unknown processing of the… |
CVE-2024-41806 | Medium | 5.3 | 2024-07-25 | The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor da… |
CVE-2024-36111 | Medium | 6.3 | 2024-07-25 | KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default… |
CVE-2024-39674 | Medium | 6.2 | 2024-07-25 | Plaintext vulnerability in the Gallery search module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-39673 | Medium | 6.8 | 2024-07-25 | Vulnerability of serialisation/deserialisation mismatch in the iAware module. Impact: Successful exploitation of this vulnerability may affect service confiden… |
CVE-2024-39672 | High | 8.4 | 2024-07-25 | Memory request logic vulnerability in the memory module. Impact: Successful exploitation of this vulnerability will affect integrity and availability. |
CVE-2024-39671 | Critical | 9.3 | 2024-07-25 | Access control vulnerability in the security verification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-39670 | Medium | 6.2 | 2024-07-25 | Privilege escalation vulnerability in the account synchronisation module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-6589 | High | 8.8 | 2024-07-25 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'rende… |
CVE-2024-37084 | Critical | 9.8 | 2024-07-25 | In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arb… |
CVE-2024-41707 | Medium | 4.8 | 2024-07-25 | An issue was discovered in Archer Platform 6 before 2024.06. Authenticated users can achieve HTML content injection. A remote authenticated malicious Archer us… |
CVE-2024-41706 | High | 7.3 | 2024-07-25 | A stored XSS issue was discovered in Archer Platform 6 before version 2024.06. A remote authenticated malicious Archer user could potentially exploit this to s… |
CVE-2024-41705 | High | 7.1 | 2024-07-25 | A stored XSS issue was discovered in Archer Platform 6.8 before 2024.06. A remote authenticated malicious Archer user could potentially exploit this to store m… |
CVE-2024-6972 | Medium | 6.5 | 2024-07-25 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text. |
CVE-2024-4811 | Low | 2.2 | 2024-07-25 | In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts. |
CVE-2024-7057 | Medium | 4.3 | 2024-07-25 | An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and star… |
CVE-2024-7047 | High | 7.7 | 2024-07-25 | A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowi… |
CVE-2024-7091 | Medium | 4.1 | 2024-07-24 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 p… |
CVE-2024-7060 | Low | 2.6 | 2024-07-24 | An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17… |
CVE-2024-5067 | Medium | 4.4 | 2024-07-24 | An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 pri… |
CVE-2024-0231 | Low | 2.7 | 2024-07-24 | A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft… |
CVE-2024-7081 | Medium | 6.3 | 2024-07-24 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-41466 | High | 7.5 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/NatStaticSetting. |
CVE-2024-41465 | High | 7.5 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/setcfm. |
CVE-2024-41464 | High | 7.5 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/RouteStatic |
CVE-2024-41463 | High | 7.5 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter at ip/goform/addressNat. |
CVE-2024-41462 | High | 7.5 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/DhcpListClient. |