2024 CVEs (page 218)
Page 218 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-36539 | Critical | 9.8 | 2024-07-24 | Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-7079 | Medium | 6.5 | 2024-07-24 | A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remo… |
CVE-2024-7069 | Medium | 6.3 | 2024-07-24 | A vulnerability, which was classified as critical, has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. This issue affects some… |
CVE-2024-40575 | Medium | 5.5 | 2024-07-24 | An issue in Huawei Technologies opengauss (openGauss 5.0.0 build) v.7.3.0 allows a local attacker to cause a denial of service via the modification of table at… |
CVE-2024-40422 | Critical | 9.1 | 2024-07-24 | The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipul… |
CVE-2024-36541 | High | 8.8 | 2024-07-24 | Insecure permissions in logging-operator v4.6.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-31970 | High | 8.8 | 2024-07-24 | AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both over the LAN and the… |
CVE-2024-22444 | Medium | 6.1 | 2024-07-24 | A vulnerability within the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow a remote attacker to conduct a reflected cross-site sc… |
CVE-2024-7068 | Low | 3.5 | 2024-07-24 | A vulnerability classified as problematic has been found in SourceCodester Insurance Management System 1.0. This affects an unknown part of the file /Script/ad… |
CVE-2024-41914 | High | 8.1 | 2024-07-24 | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross… |
CVE-2024-39345 | High | 7.2 | 2024-07-24 | AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support account whose passw… |
CVE-2024-31977 | High | 8.8 | 2024-07-24 | Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters to the Ping or Trac… |
CVE-2024-31971 | Medium | 4.8 | 2024-07-24 | Multiple stored cross-site scripting (XSS) vulnerabilities on AdTran NetVanta 3120 18.01.01.00.E devices allow remote attackers to inject arbitrary JavaScript… |
CVE-2024-22443 | High | 7.2 | 2024-07-24 | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side… |
CVE-2024-7067 | Medium | 6.3 | 2024-07-24 | A vulnerability was found in kirilkirkov Ecommerce-Laravel-Bootstrap up to 1f1097a3448ce8ec53e034ea0f70b8e2a0e64a87. It has been rated as critical. Affected by… |
CVE-2024-6327 | Critical | 9.9 | 2024-07-24 | In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vul… |
CVE-2024-6096 | High | 8.8 | 2024-07-24 | In Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vul… |
CVE-2024-5818 | Medium | 6.4 | 2024-07-24 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazine Grid/Slider widg… |
CVE-2024-3896 | Medium | 6.4 | 2024-07-24 | The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the Gallery title field in all… |
CVE-2024-7066 | High | 7.3 | 2024-07-24 | A vulnerability was found in F-logic DataCube3 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /a… |
CVE-2024-6896 | Medium | 6.4 | 2024-07-24 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc… |
CVE-2024-7065 | Medium | 4.3 | 2024-07-24 | A vulnerability was found in Spina CMS up to 2.18.0. It has been classified as problematic. Affected is an unknown function of the file /admin/pages/. The mani… |
CVE-2024-6930 | Medium | 6.4 | 2024-07-24 | The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in… |
CVE-2024-6874 | Medium | 4.3 | 2024-07-24 | libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name… |
CVE-2024-6197 | High | 7.5 | 2024-07-24 | libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, wh… |
CVE-2024-3454 | Low | 3.5 | 2024-07-24 | An implementation issue in the Connectivity Standards Alliance Matter 1.2 protocol as used in the connectedhomeip SDK allows a third party to disclose informat… |
CVE-2024-3297 | Medium | 6.5 | 2024-07-24 | An issue in the Certificate Authenticated Session Establishment (CASE) protocol for establishing secure sessions between two devices, as implemented in the Mat… |
CVE-2024-39676 | High | 7.5 | 2024-07-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are r… |
CVE-2024-6629 | Medium | 6.4 | 2024-07-24 | The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versions up to, and incl… |
CVE-2024-6571 | Medium | 5.3 | 2024-07-24 | The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including… |
CVE-2024-6553 | Medium | 5.3 | 2024-07-24 | The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is d… |
CVE-2024-6836 | Medium | 4.3 | 2024-07-24 | The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPres… |
CVE-2024-6094 | Medium | 4.8 | 2024-07-24 | The WP ULike WordPress plugin before 4.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-40767 | Medium | 6.5 | 2024-07-24 | In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing… |
CVE-2024-5861 | Medium | 5.3 | 2024-07-24 | The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_squa… |
CVE-2024-3246 | Medium | 6.1 | 2024-07-24 | The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or i… |
CVE-2024-7027 | High | 7.3 | 2024-07-24 | The WooCommerce - PDF Vouchers plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.9.3. This is due to insufficient… |
CVE-2024-6756 | High | 8.8 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_poster_get_image_path'… |
CVE-2024-6755 | Medium | 6.5 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the ‘wpw_auto_post… |
CVE-2024-6754 | Medium | 5.4 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_twe… |
CVE-2024-6753 | High | 7.2 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mapTypes’ parameter in the 'wpw_auto_poster_map_wordpress_pos… |
CVE-2024-6752 | Medium | 6.4 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_name’ parameter in the 'wpw_auto_poster_map_wordpress_post… |
CVE-2024-6751 | Medium | 6.3 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or inc… |
CVE-2024-6750 | High | 7.3 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple… |
CVE-2024-41656 | High | 7.1 | 2024-07-23 | Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Inte… |
CVE-2024-38176 | High | 8.1 | 2024-07-23 | An improper restriction of excessive authentication attempts in GroupMe allows a unauthenticated attacker to elevate privileges over a network. |
CVE-2024-38164 | Critical | 9.6 | 2024-07-23 | An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on… |
CVE-2024-0981 | High | 7.1 | 2024-07-23 | Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompt… |
CVE-2024-41668 | High | 8.3 | 2024-07-23 | The cBioPortal for Cancer Genomics provides visualization, analysis, and download of large-scale cancer genomics data sets. When running a publicly exposed pro… |
CVE-2024-41665 | Medium | 5.5 | 2024-07-23 | Ampache, a web based audio/video streaming application and file manager, has a stored cross-site scripting (XSS) vulnerability in versions prior to 6.6.0. This… |
CVE-2024-41664 | Medium | 5.4 | 2024-07-23 | Canarytokens help track activity and actions on a network. Prior to `sha-8ea5315`, Canarytokens.org was vulnerable to a blind SSRF in the Webhook alert feature… |
CVE-2024-41178 | High | 7.5 | 2024-07-23 | Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebId… |
CVE-2024-6714 | High | 8.8 | 2024-07-23 | An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege. |
CVE-2024-41663 | Low | 3.5 | 2024-07-23 | Canarytokens help track activity and actions on a network. A Cross-Site Scripting vulnerability was identified in the "Cloned Website" Canarytoken, whereby th… |
CVE-2024-39702 | Medium | 5.9 | 2024-07-23 | In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) att… |
CVE-2024-6783 | Medium | 4.8 | 2024-07-23 | A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of so… |
CVE-2024-4076 | High | 7.5 | 2024-07-23 | Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue af… |
CVE-2024-41655 | High | 7.5 | 2024-07-23 | TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulner… |
CVE-2024-41319 | Critical | 9.8 | 2024-07-23 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd function. |
CVE-2024-40060 | High | 7.5 | 2024-07-23 | go-chart v2.1.1 was discovered to contain an infinite loop via the drawCanvas() function. |
CVE-2024-1975 | High | 7.5 | 2024-07-23 | If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a cli… |
CVE-2024-1737 | High | 7.5 | 2024-07-23 | Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance… |
CVE-2024-0760 | High | 7.5 | 2024-07-23 | A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recov… |
CVE-2024-5602 | High | 7.8 | 2024-07-23 | A stack-based buffer overflow vulnerability due to a missing bounds check in the NI I/O Trace Tool may result in arbitrary code execution. Successful exploita… |
CVE-2024-4081 | High | 7.8 | 2024-07-23 | A memory corruption issue due to an improper length check in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation… |
CVE-2024-4080 | High | 7.8 | 2024-07-23 | A memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution. Successful exp… |
CVE-2024-4079 | High | 7.8 | 2024-07-23 | An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation require… |
CVE-2024-41839 | Low | 3.5 | 2024-07-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. A… |
CVE-2024-41836 | Medium | 5.5 | 2024-07-23 | InDesign Desktop versions ID18.5.2, ID19.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-ser… |
CVE-2024-34128 | Medium | 5.4 | 2024-07-23 | Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2024-7014 | High | 8.1 | 2024-07-23 | EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older. |
CVE-2024-29070 | Critical | 9.1 | 2024-07-23 | On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the fro… |
CVE-2024-41012 | High | 7.8 | 2024-07-23 | In the Linux kernel, the following vulnerability has been resolved: filelock: Remove locks reliably when fcntl/close race is detected When fcntl_setlk() race… |
CVE-2024-6420 | High | 8.6 | 2024-07-23 | The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthen… |
CVE-2024-6231 | Medium | 5.9 | 2024-07-23 | The Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-4260 | Medium | 6.5 | 2024-07-23 | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could a… |
CVE-2024-6885 | High | 8.1 | 2024-07-23 | The MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path… |
CVE-2024-6828 | High | 7.2 | 2024-07-23 | The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Col… |
CVE-2024-1575 | Medium | 6.5 | 2024-07-23 | The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions could allow an authenticated user to es… |
CVE-2024-6717 | High | 7.7 | 2024-07-23 | HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation director… |
CVE-2024-24507 | Medium | 6.1 | 2024-07-22 | Cross Site Scripting vulnerability in Act-On 2023 allows a remote attacker to execute arbitrary code via the newUser parameter in the login.jsp component. |
CVE-2024-6913 | High | 8.8 | 2024-07-22 | Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlu… |
CVE-2024-6912 | Critical | 9.8 | 2024-07-22 | Use of hard-coded MSSQL credentials in PerkinElmer ProcessPlus on Windows allows an attacker to login remove on all prone installations.This issue affects Proc… |
CVE-2024-6911 | High | 7.5 | 2024-07-22 | Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affec… |
CVE-2024-6806 | Critical | 9.8 | 2024-07-22 | The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code ex… |
CVE-2024-6805 | High | 7.5 | 2024-07-22 | The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may result in informat… |
CVE-2024-6794 | Critical | 9.8 | 2024-07-22 | A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploi… |
CVE-2024-6793 | Critical | 9.8 | 2024-07-22 | A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation… |
CVE-2024-6791 | High | 7.8 | 2024-07-22 | A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation… |
CVE-2024-40502 | Critical | 9.8 | 2024-07-22 | SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute arbitrary code via the btn_login_b_Click… |
CVE-2024-6675 | High | 7.8 | 2024-07-22 | A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacke… |
CVE-2024-6638 | Medium | 5.5 | 2024-07-22 | An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation… |
CVE-2024-6122 | Medium | 5.5 | 2024-07-22 | An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via loc… |
CVE-2024-6121 | High | 7.8 | 2024-07-22 | An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI System… |
CVE-2024-39250 | Critical | 9.8 | 2024-07-22 | EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interface. |
CVE-2024-34329 | High | 8.4 | 2024-07-22 | Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execu… |
CVE-2024-41880 | Medium | 5.3 | 2024-07-22 | In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and private routes. |
CVE-2024-40075 | Medium | 4.3 | 2024-07-22 | Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability. |
CVE-2024-38944 | Critical | 9.8 | 2024-07-22 | An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 c… |
CVE-2024-37380 | Medium | 5.3 | 2024-07-22 | A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point. Affected Products: Uni… |