2024 CVEs (page 223)
Page 223 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-40402 | Medium | 6.3 | 2024-07-17 | A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user i… |
CVE-2024-40119 | High | 8.8 | 2024-07-17 | Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the password cha… |
CVE-2024-39126 | Medium | 5.4 | 2024-07-17 | Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. |
CVE-2024-39125 | Medium | 5.4 | 2024-07-17 | Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header. |
CVE-2024-39124 | Medium | 5.4 | 2024-07-17 | In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS. |
CVE-2024-32981 | Medium | 5.4 | 2024-07-17 | Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS… |
CVE-2024-29885 | Medium | 4.3 | 2024-07-17 | silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by… |
CVE-2024-28796 | Medium | 6.4 | 2024-07-17 | IBM ClearQuest (CQ) 9.1 through 9.1.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2024-40641 | High | 7.4 | 2024-07-17 | Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code o… |
CVE-2024-40640 | Low | 2.9 | 2024-07-17 | vodozemac is an open source implementation of Olm and Megolm in pure Rust. Versions before 0.7.0 of vodozemac use a non-constant time base64 implementation fo… |
CVE-2024-40636 | Medium | 5.3 | 2024-07-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized… |
CVE-2024-40633 | Medium | 5.3 | 2024-07-17 | Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retriev… |
CVE-2024-38447 | High | 8.1 | 2024-07-17 | NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report (that belongs to an arbitrary user). |
CVE-2024-38870 | Low | 3.5 | 2024-07-17 | Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247… |
CVE-2024-38446 | Medium | 6.5 | 2024-07-17 | NATO NCI ANET 3.4.1 mishandles report ownership. A user can create a report and, despite the restrictions imposed by the UI, change the author of that report t… |
CVE-2024-20435 | High | 8.8 | 2024-07-17 | A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate pri… |
CVE-2024-20429 | Medium | 6.5 | 2024-07-17 | A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacker to execute arbitr… |
CVE-2024-20419 | Critical | 10.0 | 2024-07-17 | A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change th… |
CVE-2024-20416 | Medium | 6.5 | 2024-07-17 | A vulnerability in the upload module of Cisco RV340 and RV345 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary c… |
CVE-2024-20401 | Critical | 9.8 | 2024-07-17 | A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwri… |
CVE-2024-20400 | Medium | 4.7 | 2024-07-17 | A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect a user to a malici… |
CVE-2024-20396 | Medium | 5.3 | 2024-07-17 | A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive information. This vu… |
CVE-2024-20395 | Medium | 6.4 | 2024-07-17 | A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session i… |
CVE-2024-20323 | High | 7.5 | 2024-07-17 | A vulnerability in Cisco Intelligent Node (iNode) Software could allow an unauthenticated, remote attacker to hijack the TLS connection between Cisco iNode Man… |
CVE-2024-20296 | Medium | 4.7 | 2024-07-17 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload arbitrary… |
CVE-2024-6830 | Medium | 6.3 | 2024-07-17 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Inventory Management System 1.0. Affected is an unknown function of the f… |
CVE-2024-6834 | Critical | 9.0 | 2024-07-17 | A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows a… |
CVE-2024-6833 | Medium | 5.9 | 2024-07-17 | A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operatio… |
CVE-2024-29120 | Medium | 5.9 | 2024-07-17 | In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credentia… |
CVE-2024-28993 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-28992 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-28074 | Critical | 9.6 | 2024-07-17 | It was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager. While some controls were implemented the resear… |
CVE-2024-23475 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23474 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to an Arbitrary File Deletion and Information Disclosure vulnerability. |
CVE-2024-23472 | Critical | 9.6 | 2024-07-17 | SolarWinds Access Rights Manager (ARM) is susceptible to Directory Traversal vulnerability. This vulnerability allows an authenticated user to arbitrary read… |
CVE-2024-23471 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authentic… |
CVE-2024-23470 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to a pre-authentication remote code execution vulnerability. If exploited, this vulnerability… |
CVE-2024-23469 | Critical | 9.6 | 2024-07-17 | SolarWinds Access Rights Manager (ARM) is susceptible to a Remote Code Execution vulnerability. If exploited, this vulnerability allows an unauthenticated user… |
CVE-2024-23468 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23467 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23466 | Critical | 9.6 | 2024-07-17 | SolarWinds Access Rights Manager (ARM) is susceptible to a Directory Traversal Remote Code Execution vulnerability. If exploited, this vulnerability allows an… |
CVE-2024-23465 | High | 8.3 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user t… |
CVE-2024-5471 | High | 8.8 | 2024-07-17 | Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys. |
CVE-2024-27311 | Medium | 5.5 | 2024-07-17 | Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the… |
CVE-2024-31411 | High | 8.8 | 2024-07-17 | Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remot… |
CVE-2024-40617 | Medium | 6.5 | 2024-07-17 | Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). If a remote authenticated attacker with User Class privilege sends a… |
CVE-2024-36491 | Critical | 9.8 | 2024-07-17 | FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allow an administrative user to execute an arbitrary OS command, obtain a… |
CVE-2024-36475 | High | 8.8 | 2024-07-17 | FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user who knows how to us… |
CVE-2024-31979 | Medium | 4.3 | 2024-07-17 | Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users… |
CVE-2024-31070 | Critical | 9.1 | 2024-07-17 | Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. al… |
CVE-2024-30471 | Low | 3.7 | 2024-07-17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request… |
CVE-2024-29737 | Medium | 4.7 | 2024-07-17 | In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert comma… |
CVE-2024-6220 | Critical | 9.8 | 2024-07-17 | The 简数采集器 (Keydatas) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the keydatas_downloadImages function i… |
CVE-2024-5703 | Medium | 4.3 | 2024-07-17 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthori… |
CVE-2024-5582 | Medium | 6.4 | 2024-07-17 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Blo… |
CVE-2024-39877 | High | 8.8 | 2024-07-17 | Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could exec… |
CVE-2024-39863 | Medium | 5.4 | 2024-07-17 | Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users ar… |
CVE-2024-6669 | Medium | 5.5 | 2024-07-17 | The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including… |
CVE-2024-6660 | High | 8.8 | 2024-07-17 | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data tha… |
CVE-2024-6467 | High | 8.8 | 2024-07-17 | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Read to Arbitrary File… |
CVE-2024-6033 | Medium | 4.3 | 2024-07-17 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capab… |
CVE-2024-5255 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_dual_color shortcode in all versio… |
CVE-2024-5254 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_banner shortcode in all versi… |
CVE-2024-5253 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ult_team shortcode in all versions up to, a… |
CVE-2024-5252 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shortcode in all versio… |
CVE-2024-5251 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_pricing shortcode in all versions… |
CVE-2024-41010 | High | 7.8 | 2024-07-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix too early release of tcx_entry Pedro Pinto and later independently also Hyunwoo… |
CVE-2024-41009 | High | 7.8 | 2024-07-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemente… |
CVE-2024-6808 | High | 7.3 | 2024-07-17 | A vulnerability was found in itsourcecode Simple Task List 1.0. It has been classified as critical. This affects the function insertUserRecord of the file sign… |
CVE-2024-6807 | Low | 2.4 | 2024-07-17 | A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0 and classified as problematic. Affected by this issue is some unkno… |
CVE-2024-6803 | Medium | 5.5 | 2024-07-17 | A vulnerability has been found in itsourcecode Document Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown function… |
CVE-2024-6535 | Medium | 5.3 | 2024-07-17 | A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-pro… |
CVE-2024-6802 | Medium | 6.3 | 2024-07-17 | A vulnerability, which was classified as critical, was found in SourceCodester Computer Laboratory Management System 1.0. Affected is an unknown function of th… |
CVE-2024-6801 | Medium | 6.3 | 2024-07-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Student Management System 1.0. This issue affects some unknown proce… |
CVE-2024-6595 | Low | 3.0 | 2024-07-17 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-5500 | Medium | 6.5 | 2024-07-16 | Inappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass navigation restrictions via a crafted HTML pag… |
CVE-2024-40637 | Medium | 4.2 | 2024-07-16 | dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user install… |
CVE-2024-3176 | High | 8.8 | 2024-07-16 | Out of bounds write in SwiftShader in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTM… |
CVE-2024-3175 | Medium | 6.3 | 2024-07-16 | Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalation via a crafted Chro… |
CVE-2024-3174 | High | 8.8 | 2024-07-16 | Inappropriate implementation in V8 in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit object corruption via a crafted HT… |
CVE-2024-3173 | High | 8.8 | 2024-07-16 | Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege escalation via a malici… |
CVE-2024-3172 | High | 8.8 | 2024-07-16 | Insufficient data validation in DevTools in Google Chrome prior to 121.0.6167.85 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2024-3171 | High | 8.8 | 2024-07-16 | Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who convinced a user to engage in specific UI gestures to pot… |
CVE-2024-3170 | High | 8.8 | 2024-07-16 | Use after free in WebRTC in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2024-3169 | High | 8.8 | 2024-07-16 | Use after free in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2024-3168 | High | 8.8 | 2024-07-16 | Use after free in DevTools in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2024-2884 | Medium | 6.5 | 2024-07-16 | Out of bounds read in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HT… |
CVE-2024-21188 | Medium | 6.1 | 2024-07-16 | Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot). Supporte… |
CVE-2024-21185 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38, 8.4.1 and 9.0.0. Easily explo… |
CVE-2024-21184 | High | 7.2 | 2024-07-16 | Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily exploitab… |
CVE-2024-21183 | High | 7.5 | 2024-07-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21182 | High | 7.5 | 2024-07-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21181 | Critical | 9.8 | 2024-07-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21180 | Medium | 4.1 | 2024-07-16 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Supported versions that are affected a… |
CVE-2024-21179 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior… |
CVE-2024-21178 | Medium | 6.1 | 2024-07-16 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59, 8.60 a… |
CVE-2024-21177 | Medium | 6.5 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0… |
CVE-2024-21176 | Medium | 5.3 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.4.0 and prior. Diffi… |
CVE-2024-21175 | High | 7.5 | 2024-07-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21174 | Low | 3.1 | 2024-07-16 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.23, 21.3-21.14 and 23.4. Difficult to expl… |