2024 CVEs (page 217)
Page 217 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41689 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An a… |
CVE-2024-41688 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ data… |
CVE-2024-41687 | High | 7.5 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text. A remote attacker could exploit this vulnerabili… |
CVE-2024-41686 | Low | 3.3 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could exploit this by cre… |
CVE-2024-41685 | High | 7.5 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web managemen… |
CVE-2024-41684 | Medium | 5.3 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management… |
CVE-2024-35296 | High | 8.2 | 2024-07-26 | Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: f… |
CVE-2024-35161 | High | 7.5 | 2024-07-26 | Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poi… |
CVE-2024-25090 | Medium | 5.4 | 2024-07-26 | Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Rol… |
CVE-2024-6490 | Medium | 6.5 | 2024-07-26 | During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests… |
CVE-2024-40897 | Medium | 6.7 | 2024-07-26 | Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file w… |
CVE-2024-7120 | Medium | 6.3 | 2024-07-26 | A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file… |
CVE-2024-7119 | Medium | 6.3 | 2024-07-26 | A vulnerability, which was classified as critical, has been found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected by this issue i… |
CVE-2024-7118 | Medium | 6.3 | 2024-07-26 | A vulnerability classified as critical was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected by this vulnerability is an unkn… |
CVE-2024-7117 | Medium | 6.3 | 2024-07-26 | A vulnerability classified as critical has been found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected is an unknown function of t… |
CVE-2024-7116 | Medium | 6.3 | 2024-07-26 | A vulnerability was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. It has been rated as critical. This issue affects some unknown p… |
CVE-2024-7115 | Medium | 6.3 | 2024-07-26 | A vulnerability was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. It has been declared as critical. This vulnerability affects unk… |
CVE-2024-7114 | Medium | 6.3 | 2024-07-26 | A vulnerability was found in Tianchoy Blog up to 1.8.8. It has been classified as critical. This affects an unknown part of the file /so.php. The manipulation… |
CVE-2024-4447 | Critical | 9.9 | 2024-07-26 | In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dw… |
CVE-2024-41473 | Critical | 9.8 | 2024-07-25 | Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac |
CVE-2024-41468 | Critical | 9.8 | 2024-07-25 | Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand |
CVE-2024-3938 | Medium | 5.4 | 2024-07-25 | The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrate… |
CVE-2024-38103 | Medium | 5.9 | 2024-07-25 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-24623 | High | 8.8 | 2024-07-25 | Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can exploit this vulnerabil… |
CVE-2024-24622 | High | 8.8 | 2024-07-25 | Softaculous Webuzo contains a command injection in the password reset functionality. A remote, authenticated attacker can exploit this vulnerability to gain co… |
CVE-2024-24621 | Critical | 9.8 | 2024-07-25 | Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulne… |
CVE-2024-7106 | Medium | 4.3 | 2024-07-25 | A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/media_fo… |
CVE-2024-7105 | Medium | 6.3 | 2024-07-25 | A vulnerability classified as critical has been found in ForIP Tecnologia Administração PABX 1.x. Affected is an unknown function of the file /detalheIdUra of… |
CVE-2024-41809 | High | 7.2 | 2024-07-25 | OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulner… |
CVE-2024-6558 | Medium | 6.3 | 2024-07-25 | HMS Industrial Networks Anybus-CompactCom 30 products are vulnerable to a XSS attack caused by the lack of input sanitation checks. As a consequence, it is po… |
CVE-2024-41808 | High | 8.8 | 2024-07-25 | The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versi… |
CVE-2024-40324 | Medium | 5.4 | 2024-07-25 | A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fields, leading to HTTP… |
CVE-2024-38289 | Critical | 9.8 | 2024-07-25 | A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to… |
CVE-2024-38288 | High | 7.2 | 2024-07-25 | A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attackers with administ… |
CVE-2024-38287 | Critical | 9.8 | 2024-07-25 | The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the applic… |
CVE-2024-29069 | Medium | 4.8 | 2024-07-25 | In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-s… |
CVE-2024-29068 | Medium | 5.8 | 2024-07-25 | In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so ca… |
CVE-2024-40318 | High | 7.2 | 2024-07-25 | An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2024-1724 | Medium | 6.3 | 2024-07-25 | In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu… |
CVE-2024-40873 | Medium | 4.5 | 2024-07-25 | There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.07. Attackers with syst… |
CVE-2024-28772 | Medium | 6.8 | 2024-07-25 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 is vulnerable to stored cross-site scripting. This vulnerability al… |
CVE-2024-7007 | Critical | 9.8 | 2024-07-25 | Positron Broadcast Signal Processor TRA7005 v1.20 is vulnerable to an authentication bypass exploit that could allow an attacker to have unauthorized access to… |
CVE-2024-41801 | Medium | 4.7 | 2024-07-25 | OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of packaged installati… |
CVE-2024-41800 | Medium | 4.8 | 2024-07-25 | Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit… |
CVE-2024-40872 | High | 8.4 | 2024-07-25 | There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access… |
CVE-2024-36542 | High | 8.8 | 2024-07-25 | Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-7101 | High | 7.3 | 2024-07-25 | A vulnerability, which was classified as critical, has been found in ForIP Tecnologia Administração PABX 1.x. This issue affects some unknown processing of the… |
CVE-2024-41806 | Medium | 5.3 | 2024-07-25 | The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor da… |
CVE-2024-36111 | Medium | 6.3 | 2024-07-25 | KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default… |
CVE-2024-39674 | Medium | 6.2 | 2024-07-25 | Plaintext vulnerability in the Gallery search module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-39673 | Medium | 6.8 | 2024-07-25 | Vulnerability of serialisation/deserialisation mismatch in the iAware module. Impact: Successful exploitation of this vulnerability may affect service confiden… |
CVE-2024-39672 | High | 8.4 | 2024-07-25 | Memory request logic vulnerability in the memory module. Impact: Successful exploitation of this vulnerability will affect integrity and availability. |
CVE-2024-39671 | Critical | 9.3 | 2024-07-25 | Access control vulnerability in the security verification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-39670 | Medium | 6.2 | 2024-07-25 | Privilege escalation vulnerability in the account synchronisation module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-6589 | High | 8.8 | 2024-07-25 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'rende… |
CVE-2024-37084 | Critical | 9.8 | 2024-07-25 | In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arb… |
CVE-2024-41707 | Medium | 4.8 | 2024-07-25 | An issue was discovered in Archer Platform 6 before 2024.06. Authenticated users can achieve HTML content injection. A remote authenticated malicious Archer us… |
CVE-2024-41706 | High | 7.3 | 2024-07-25 | A stored XSS issue was discovered in Archer Platform 6 before version 2024.06. A remote authenticated malicious Archer user could potentially exploit this to s… |
CVE-2024-41705 | High | 7.1 | 2024-07-25 | A stored XSS issue was discovered in Archer Platform 6.8 before 2024.06. A remote authenticated malicious Archer user could potentially exploit this to store m… |
CVE-2024-6972 | Medium | 6.5 | 2024-07-25 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text. |
CVE-2024-4811 | Low | 2.2 | 2024-07-25 | In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts. |
CVE-2024-7057 | Medium | 4.3 | 2024-07-25 | An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and star… |
CVE-2024-7047 | High | 7.7 | 2024-07-25 | A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowi… |
CVE-2024-7091 | Medium | 4.1 | 2024-07-24 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 p… |
CVE-2024-7060 | Low | 2.6 | 2024-07-24 | An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17… |
CVE-2024-5067 | Medium | 4.4 | 2024-07-24 | An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 pri… |
CVE-2024-0231 | Low | 2.7 | 2024-07-24 | A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft… |
CVE-2024-7081 | Medium | 6.3 | 2024-07-24 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-41466 | High | 7.5 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/NatStaticSetting. |
CVE-2024-41465 | High | 7.5 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/setcfm. |
CVE-2024-41464 | High | 7.5 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/RouteStatic |
CVE-2024-41463 | High | 7.5 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter at ip/goform/addressNat. |
CVE-2024-41462 | High | 7.5 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/DhcpListClient. |
CVE-2024-41461 | Critical | 9.8 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at ip/goform/DhcpListClient. |
CVE-2024-41460 | Critical | 9.8 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter at ip/goform/RouteStatic. |
CVE-2024-41459 | Critical | 9.8 | 2024-07-24 | Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the PPPOEPassword parameter at ip/goform/QuickIndex. |
CVE-2024-41136 | Medium | 6.8 | 2024-07-24 | An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation… |
CVE-2024-7080 | Medium | 5.3 | 2024-07-24 | A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown… |
CVE-2024-41551 | Critical | 9.8 | 2024-07-24 | CampCodes Supplier Management System v1.0 is vulnerable to SQL injection via Supply_Management_System/admin/view_order_items.php?id= . |
CVE-2024-41550 | High | 7.2 | 2024-07-24 | CampCodes Supplier Management System v1.0 is vulnerable to SQL injection via Supply_Management_System/admin/view_invoice_items.php?id= . |
CVE-2024-41135 | High | 7.2 | 2024-07-24 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary… |
CVE-2024-41134 | High | 7.2 | 2024-07-24 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary… |
CVE-2024-41133 | High | 7.2 | 2024-07-24 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary… |
CVE-2024-36535 | Critical | 9.8 | 2024-07-24 | Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-36534 | High | 8.4 | 2024-07-24 | Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-36533 | Critical | 9.8 | 2024-07-24 | Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-33519 | High | 7.2 | 2024-07-24 | A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduc… |
CVE-2024-40495 | High | 8.0 | 2024-07-24 | A vulnerability was discovered in Linksys Router E2500 with firmware 2.0.00, allows authenticated attackers to execute arbitrary code via the hnd_parentalctrl_… |
CVE-2024-40137 | Medium | 5.5 | 2024-07-24 | Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Mo… |
CVE-2024-36538 | High | 8.8 | 2024-07-24 | Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-36537 | High | 7.2 | 2024-07-24 | Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-36536 | Critical | 9.8 | 2024-07-24 | Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-41672 | High | 7.5 | 2024-07-24 | DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_e… |
CVE-2024-41667 | High | 8.8 | 2024-07-24 | OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulne… |
CVE-2024-41666 | Medium | 4.7 | 2024-07-24 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running po… |
CVE-2024-37533 | Low | 2.4 | 2024-07-24 | IBM InfoSphere Information Server 11.7 could disclose sensitive user information to another user with physical access to the machine. IBM X-Force ID: 294727. |
CVE-2024-21684 | Medium | 4.3 | 2024-07-24 | There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitbucket DC from 8.0.0 to 8.9.12 and 8.19.0… |
CVE-2024-41662 | High | 8.6 | 2024-07-24 | VNote is a note-taking platform. A Cross-Site Scripting (XSS) vulnerability has been identified in the Markdown rendering functionality of versions 3.18.1 and… |
CVE-2024-41110 | Critical | 9.9 | 2024-07-24 | Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine… |
CVE-2024-36540 | Critical | 9.8 | 2024-07-24 | Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |