2024 CVEs (page 222)
Page 222 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6906 | Medium | 6.3 | 2024-07-19 | A vulnerability was found in SourceCodester Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the file add… |
CVE-2024-6905 | Medium | 6.3 | 2024-07-19 | A vulnerability has been found in SourceCodester Record Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file v… |
CVE-2024-6904 | Medium | 6.3 | 2024-07-19 | A vulnerability, which was classified as critical, was found in SourceCodester Record Management System 1.0. This affects an unknown part of the file sort2_use… |
CVE-2024-41172 | High | 7.5 | 2024-07-19 | In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from b… |
CVE-2024-39457 | Medium | 5.4 | 2024-07-19 | Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview. If this vulnerability is exploited, an arbitrary script may be execu… |
CVE-2024-32007 | High | 7.5 | 2024-07-19 | An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service a… |
CVE-2024-29736 | Critical | 9.1 | 2024-07-19 | A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on RE… |
CVE-2024-6903 | Medium | 6.3 | 2024-07-19 | A vulnerability, which was classified as critical, has been found in SourceCodester Record Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2024-6902 | Medium | 6.3 | 2024-07-19 | A vulnerability classified as critical was found in SourceCodester Record Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-6799 | Medium | 4.3 | 2024-07-19 | The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'act… |
CVE-2024-6338 | High | 8.8 | 2024-07-19 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including… |
CVE-2024-40724 | High | 7.8 | 2024-07-19 | Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted f… |
CVE-2024-6901 | Medium | 6.3 | 2024-07-19 | A vulnerability classified as critical has been found in SourceCodester Record Management System 1.0. Affected is an unknown function of the file entry.php. Th… |
CVE-2024-6900 | Medium | 6.3 | 2024-07-19 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2024-6205 | Critical | 9.8 | 2024-07-19 | The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerc… |
CVE-2024-5604 | Medium | 5.9 | 2024-07-19 | The Bug Library WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-6899 | Medium | 6.3 | 2024-07-19 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2024-21583 | Medium | 4.1 | 2024-07-19 | Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/com… |
CVE-2024-21527 | High | 8.2 | 2024-07-19 | Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chr… |
CVE-2024-6898 | High | 7.3 | 2024-07-19 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file index.ph… |
CVE-2024-38156 | Medium | 6.1 | 2024-07-19 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-35199 | High | 8.2 | 2024-07-19 | TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are… |
CVE-2024-35198 | Critical | 9.8 | 2024-07-19 | TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by… |
CVE-2024-30130 | Low | 3.7 | 2024-07-19 | HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sens… |
CVE-2024-41111 | High | 7.2 | 2024-07-18 | Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Slive… |
CVE-2024-40642 | High | 8.1 | 2024-07-18 | The netty incubator codec.bhttp is a java language binary http parser. In affected versions the `BinaryHttpParser` class does not properly validate input value… |
CVE-2024-5997 | Medium | 4.3 | 2024-07-18 | The Duplica – Duplicate Posts, Pages, Custom Posts or Users plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2024-6455 | Medium | 5.3 | 2024-07-18 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capabi… |
CVE-2024-39173 | Critical | 9.8 | 2024-07-18 | calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculator.js. This vulnerab… |
CVE-2024-39090 | Medium | 6.1 | 2024-07-18 | The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery (CSRF) to lead to Stored Cross-Site S… |
CVE-2024-30126 | Medium | 4.7 | 2024-07-18 | HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target web… |
CVE-2024-5321 | Medium | 6.1 | 2024-07-18 | A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated… |
CVE-2024-38806 | Low | 3.9 | 2024-07-18 | Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40… |
CVE-2024-5625 | Medium | 6.5 | 2024-07-18 | Improper Restriction of XML External Entity Reference vulnerability in PruvaSoft Informatics Apinizer Management Console allows Data Serialization External Ent… |
CVE-2024-30125 | Medium | 6.2 | 2024-07-18 | HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die. |
CVE-2024-0857 | Critical | 9.8 | 2024-07-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Universal Software Inc. FlexWater Corporate Water Managem… |
CVE-2024-5620 | Medium | 6.5 | 2024-07-18 | Authentication Bypass Using an Alternate Path or Channel vulnerability in PruvaSoft Informatics Apinizer Management Console allows Authentication Bypass. This… |
CVE-2024-5619 | Critical | 9.6 | 2024-07-18 | Authorization Bypass Through User-Controlled Key vulnerability in PruvaSoft Informatics Apinizer Management Console allows Exploiting Incorrectly Configured Ac… |
CVE-2024-5618 | Critical | 9.9 | 2024-07-18 | Incorrect Permission Assignment for Critical Resource vulnerability in PruvaSoft Informatics Apinizer Management Console allows Accessing Functionality Not Pro… |
CVE-2024-40648 | Medium | 5.4 | 2024-07-18 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before… |
CVE-2024-40647 | Medium | 5.3 | 2024-07-18 | sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite… |
CVE-2024-40644 | Medium | 6.8 | 2024-07-18 | gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. `gix-path` can be tricked into running another `git.exe` placed in an untrusted locat… |
CVE-2024-40629 | Critical | 10.0 | 2024-07-18 | JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes… |
CVE-2024-40628 | Critical | 10.0 | 2024-07-18 | JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes… |
CVE-2024-39911 | Critical | 10.0 | 2024-07-18 | 1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addresse… |
CVE-2024-39907 | Critical | 9.8 | 2024-07-18 | 1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to a… |
CVE-2024-38302 | Medium | 6.8 | 2024-07-18 | Dell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). A low privileged attacker wit… |
CVE-2024-30473 | Medium | 4.9 | 2024-07-18 | Dell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management. A remote high privileged attacker could potentially exploit… |
CVE-2024-34013 | High | 7.8 | 2024-07-18 | Local privilege escalation due to OS command injection vulnerability. The following products are affected: Acronis True Image (macOS) before build 41396, Acron… |
CVE-2024-31143 | High | 7.5 | 2024-07-18 | An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors. Unlike for MSI-X, the setting up of th… |
CVE-2024-29178 | High | 8.8 | 2024-07-18 | On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must succe… |
CVE-2024-6504 | Medium | 4.3 | 2024-07-18 | Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can… |
CVE-2024-40898 | High | 7.5 | 2024-07-18 | SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malic… |
CVE-2024-40725 | Medium | 5.3 | 2024-07-18 | A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddTyp… |
CVE-2024-5555 | Medium | 6.4 | 2024-07-18 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-5554 | Medium | 6.4 | 2024-07-18 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-3242 | High | 8.8 | 2024-07-18 | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent func… |
CVE-2024-40764 | High | 7.5 | 2024-07-18 | Heap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated remote attacker to cause Denial of Service (DoS). |
CVE-2024-29014 | High | 8.8 | 2024-07-18 | Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary code execution when… |
CVE-2024-41011 | High | 7.8 | 2024-07-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: don't allow mapping the MMIO HDP page with large pages We don't get the right… |
CVE-2024-6164 | Critical | 9.8 | 2024-07-18 | The Filter & Grids WordPress plugin before 2.8.33 is vulnerable to Local File Inclusion via the post_layout parameter. This makes it possible for an unauthenti… |
CVE-2024-6705 | Medium | 5.5 | 2024-07-18 | The RegLevel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.1 due to insufficie… |
CVE-2024-6599 | Medium | 4.3 | 2024-07-18 | The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajax_save_settings fun… |
CVE-2024-6175 | Medium | 5.4 | 2024-07-18 | The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… |
CVE-2024-5964 | Medium | 6.4 | 2024-07-18 | The Zenon Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up… |
CVE-2024-5726 | High | 8.8 | 2024-07-18 | The Timeline Event History plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1 via deserialization of untruste… |
CVE-2024-41184 | Critical | 9.8 | 2024-07-18 | In the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can occur. NOTE: this CVE Record might not be worthwhile… |
CVE-2024-39682 | Medium | 6.4 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.7.15.4 due to insu… |
CVE-2024-39681 | Medium | 5.4 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1… |
CVE-2024-39680 | Medium | 5.4 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1… |
CVE-2024-39679 | Medium | 4.3 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1… |
CVE-2024-39678 | Medium | 4.3 | 2024-07-18 | Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to… |
CVE-2024-40492 | High | 7.1 | 2024-07-17 | Cross Site Scripting vulnerability in Heartbeat Chat v.15.2.1 allows a remote attacker to execute arbitrary code via the setname function. |
CVE-2024-40402 | Medium | 6.3 | 2024-07-17 | A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user i… |
CVE-2024-40119 | High | 8.8 | 2024-07-17 | Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the password cha… |
CVE-2024-39126 | Medium | 5.4 | 2024-07-17 | Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. |
CVE-2024-39125 | Medium | 5.4 | 2024-07-17 | Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header. |
CVE-2024-39124 | Medium | 5.4 | 2024-07-17 | In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS. |
CVE-2024-32981 | Medium | 5.4 | 2024-07-17 | Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS… |
CVE-2024-29885 | Medium | 4.3 | 2024-07-17 | silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by… |
CVE-2024-28796 | Medium | 6.4 | 2024-07-17 | IBM ClearQuest (CQ) 9.1 through 9.1.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2024-40641 | High | 7.4 | 2024-07-17 | Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code o… |
CVE-2024-40640 | Low | 2.9 | 2024-07-17 | vodozemac is an open source implementation of Olm and Megolm in pure Rust. Versions before 0.7.0 of vodozemac use a non-constant time base64 implementation fo… |
CVE-2024-40636 | Medium | 5.3 | 2024-07-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized… |
CVE-2024-40633 | Medium | 5.3 | 2024-07-17 | Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retriev… |
CVE-2024-38447 | High | 8.1 | 2024-07-17 | NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report (that belongs to an arbitrary user). |
CVE-2024-38870 | Low | 3.5 | 2024-07-17 | Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247… |
CVE-2024-38446 | Medium | 6.5 | 2024-07-17 | NATO NCI ANET 3.4.1 mishandles report ownership. A user can create a report and, despite the restrictions imposed by the UI, change the author of that report t… |
CVE-2024-20435 | High | 8.8 | 2024-07-17 | A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate pri… |
CVE-2024-20429 | Medium | 6.5 | 2024-07-17 | A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute arbitr… |
CVE-2024-20419 | Critical | 10.0 | 2024-07-17 | A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change th… |
CVE-2024-20416 | Medium | 6.5 | 2024-07-17 | A vulnerability in the upload module of Cisco RV340 and RV345 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary c… |
CVE-2024-20401 | Critical | 9.8 | 2024-07-17 | A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwri… |
CVE-2024-20400 | Medium | 4.7 | 2024-07-17 | A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect a user to a malici… |
CVE-2024-20396 | Medium | 5.3 | 2024-07-17 | A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive information. This vu… |
CVE-2024-20395 | Medium | 6.4 | 2024-07-17 | A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session i… |
CVE-2024-20323 | High | 7.5 | 2024-07-17 | A vulnerability in Cisco Intelligent Node (iNode) Software could allow an unauthenticated, remote attacker to hijack the TLS connection between Cisco iNode Man… |
CVE-2024-20296 | Medium | 4.7 | 2024-07-17 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload arbitrary… |
CVE-2024-6830 | Medium | 6.3 | 2024-07-17 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Inventory Management System 1.0. Affected is an unknown function of the f… |
CVE-2024-6834 | Critical | 9.0 | 2024-07-17 | A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows a… |