2024 CVEs (page 223)
Page 223 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6833 | Medium | 5.9 | 2024-07-17 | A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operatio… |
CVE-2024-29120 | Medium | 5.9 | 2024-07-17 | In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credentia… |
CVE-2024-28993 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-28992 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-28074 | Critical | 9.6 | 2024-07-17 | It was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager. While some controls were implemented the resear… |
CVE-2024-23475 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23474 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to an Arbitrary File Deletion and Information Disclosure vulnerability. |
CVE-2024-23472 | Critical | 9.6 | 2024-07-17 | SolarWinds Access Rights Manager (ARM) is susceptible to Directory Traversal vulnerability. This vulnerability allows an authenticated user to arbitrary read… |
CVE-2024-23471 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authentic… |
CVE-2024-23470 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to a pre-authentication remote code execution vulnerability. If exploited, this vulnerability… |
CVE-2024-23469 | Critical | 9.6 | 2024-07-17 | SolarWinds Access Rights Manager (ARM) is susceptible to a Remote Code Execution vulnerability. If exploited, this vulnerability allows an unauthenticated user… |
CVE-2024-23468 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23467 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23466 | Critical | 9.6 | 2024-07-17 | SolarWinds Access Rights Manager (ARM) is susceptible to a Directory Traversal Remote Code Execution vulnerability. If exploited, this vulnerability allows an… |
CVE-2024-23465 | High | 8.3 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user t… |
CVE-2024-5471 | High | 8.8 | 2024-07-17 | Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys. |
CVE-2024-27311 | Medium | 5.5 | 2024-07-17 | Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the… |
CVE-2024-31411 | High | 8.8 | 2024-07-17 | Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remot… |
CVE-2024-40617 | Medium | 6.5 | 2024-07-17 | Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). If a remote authenticated attacker with User Class privilege sends a… |
CVE-2024-36491 | Critical | 9.8 | 2024-07-17 | FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allow an administrative user to execute an arbitrary OS command, obtain a… |
CVE-2024-36475 | High | 8.8 | 2024-07-17 | FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user who knows how to us… |
CVE-2024-31979 | Medium | 4.3 | 2024-07-17 | Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users… |
CVE-2024-31070 | Critical | 9.1 | 2024-07-17 | Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. al… |
CVE-2024-30471 | Low | 3.7 | 2024-07-17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request… |
CVE-2024-29737 | Medium | 4.7 | 2024-07-17 | In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert comma… |
CVE-2024-6220 | Critical | 9.8 | 2024-07-17 | The 简数采集器 (Keydatas) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the keydatas_downloadImages function i… |
CVE-2024-5703 | Medium | 4.3 | 2024-07-17 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthori… |
CVE-2024-5582 | Medium | 6.4 | 2024-07-17 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Blo… |
CVE-2024-39877 | High | 8.8 | 2024-07-17 | Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could exec… |
CVE-2024-39863 | Medium | 5.4 | 2024-07-17 | Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users ar… |
CVE-2024-6669 | Medium | 5.5 | 2024-07-17 | The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including… |
CVE-2024-6660 | High | 8.8 | 2024-07-17 | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data tha… |
CVE-2024-6467 | High | 8.8 | 2024-07-17 | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Read to Arbitrary File… |
CVE-2024-6033 | Medium | 4.3 | 2024-07-17 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capab… |
CVE-2024-5255 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_dual_color shortcode in all versio… |
CVE-2024-5254 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_banner shortcode in all versi… |
CVE-2024-5253 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ult_team shortcode in all versions up to, a… |
CVE-2024-5252 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shortcode in all versio… |
CVE-2024-5251 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_pricing shortcode in all versions… |
CVE-2024-41010 | High | 7.8 | 2024-07-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix too early release of tcx_entry Pedro Pinto and later independently also Hyunwoo… |
CVE-2024-41009 | High | 7.8 | 2024-07-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemente… |
CVE-2024-6808 | High | 7.3 | 2024-07-17 | A vulnerability was found in itsourcecode Simple Task List 1.0. It has been classified as critical. This affects the function insertUserRecord of the file sign… |
CVE-2024-6807 | Low | 2.4 | 2024-07-17 | A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0 and classified as problematic. Affected by this issue is some unkno… |
CVE-2024-6803 | Medium | 5.5 | 2024-07-17 | A vulnerability has been found in itsourcecode Document Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown function… |
CVE-2024-6535 | Medium | 5.3 | 2024-07-17 | A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-pro… |
CVE-2024-6802 | Medium | 6.3 | 2024-07-17 | A vulnerability, which was classified as critical, was found in SourceCodester Computer Laboratory Management System 1.0. Affected is an unknown function of th… |
CVE-2024-6801 | Medium | 6.3 | 2024-07-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Student Management System 1.0. This issue affects some unknown proce… |
CVE-2024-6595 | Low | 3.0 | 2024-07-17 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-5500 | Medium | 6.5 | 2024-07-16 | Inappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass navigation restrictions via a crafted HTML pag… |
CVE-2024-40637 | Medium | 4.2 | 2024-07-16 | dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user install… |
CVE-2024-3176 | High | 8.8 | 2024-07-16 | Out of bounds write in SwiftShader in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTM… |
CVE-2024-3175 | Medium | 6.3 | 2024-07-16 | Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalation via a crafted Chro… |
CVE-2024-3174 | High | 8.8 | 2024-07-16 | Inappropriate implementation in V8 in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit object corruption via a crafted HT… |
CVE-2024-3173 | High | 8.8 | 2024-07-16 | Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege escalation via a malici… |
CVE-2024-3172 | High | 8.8 | 2024-07-16 | Insufficient data validation in DevTools in Google Chrome prior to 121.0.6167.85 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2024-3171 | High | 8.8 | 2024-07-16 | Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who convinced a user to engage in specific UI gestures to pot… |
CVE-2024-3170 | High | 8.8 | 2024-07-16 | Use after free in WebRTC in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2024-3169 | High | 8.8 | 2024-07-16 | Use after free in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2024-3168 | High | 8.8 | 2024-07-16 | Use after free in DevTools in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2024-2884 | Medium | 6.5 | 2024-07-16 | Out of bounds read in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HT… |
CVE-2024-21188 | Medium | 6.1 | 2024-07-16 | Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot). Supporte… |
CVE-2024-21185 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38, 8.4.1 and 9.0.0. Easily explo… |
CVE-2024-21184 | High | 7.2 | 2024-07-16 | Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily exploitab… |
CVE-2024-21183 | High | 7.5 | 2024-07-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21182 | High | 7.5 | 2024-07-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21181 | Critical | 9.8 | 2024-07-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21180 | Medium | 4.1 | 2024-07-16 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Supported versions that are affected a… |
CVE-2024-21179 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior… |
CVE-2024-21178 | Medium | 6.1 | 2024-07-16 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59, 8.60 a… |
CVE-2024-21177 | Medium | 6.5 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0… |
CVE-2024-21176 | Medium | 5.3 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.4.0 and prior. Diffi… |
CVE-2024-21175 | High | 7.5 | 2024-07-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21174 | Low | 3.1 | 2024-07-16 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.23, 21.3-21.14 and 23.4. Difficult to expl… |
CVE-2024-21173 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior… |
CVE-2024-21171 | Medium | 6.5 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0… |
CVE-2024-21170 | Medium | 6.3 | 2024-07-16 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 8.4.0 and prior. Easily… |
CVE-2024-21169 | Medium | 6.5 | 2024-07-16 | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Partners). Supported versions that are affected are 12.2.3-12.2.13. Easil… |
CVE-2024-21168 | Medium | 6.5 | 2024-07-16 | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are… |
CVE-2024-21167 | High | 8.1 | 2024-07-16 | Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Party Search UI). Supported versions that are affected are 12.2.3… |
CVE-2024-21166 | Medium | 5.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior… |
CVE-2024-21165 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 8.0.37 and prior. Easi… |
CVE-2024-21164 | Low | 2.5 | 2024-07-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Diffic… |
CVE-2024-21163 | Medium | 5.5 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0… |
CVE-2024-21162 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0… |
CVE-2024-21161 | Medium | 5.5 | 2024-07-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Easily… |
CVE-2024-21160 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior… |
CVE-2024-21159 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior… |
CVE-2024-21158 | Medium | 6.4 | 2024-07-16 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59, 8.60 a… |
CVE-2024-21157 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.4.0 and prior… |
CVE-2024-21155 | Medium | 4.7 | 2024-07-16 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: User Interface). The supported version that is affected is 8.8. E… |
CVE-2024-21154 | Medium | 4.3 | 2024-07-16 | Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources). The supported version that is affec… |
CVE-2024-21153 | High | 8.1 | 2024-07-16 | Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Specs). The supported… |
CVE-2024-21152 | High | 8.1 | 2024-07-16 | Vulnerability in the Oracle Process Manufacturing Financials product of Oracle E-Business Suite (component: Allocation Rules). Supported versions that are aff… |
CVE-2024-21151 | Low | 3.3 | 2024-07-16 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Easily exploitable vulne… |
CVE-2024-21150 | Medium | 6.1 | 2024-07-16 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2024-21149 | High | 8.1 | 2024-07-16 | Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Work Definition Issues). Supported versions that are af… |
CVE-2024-21148 | Medium | 4.8 | 2024-07-16 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 1… |
CVE-2024-21147 | High | 7.4 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-21146 | High | 8.1 | 2024-07-16 | Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: GL Accounts). Supported versions that are affected are 12.2.3-12.2… |
CVE-2024-21145 | Medium | 4.8 | 2024-07-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions t… |