2024 CVEs (page 229)
Page 229 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23317 | Medium | 6.3 | 2024-07-11 | External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arb… |
CVE-2024-23194 | Low | 3.3 | 2024-07-11 | Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Cent… |
CVE-2024-22387 | Medium | 6.8 | 2024-07-11 | External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify de… |
CVE-2024-40618 | Critical | 9.6 | 2024-07-11 | Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension. |
CVE-2024-6653 | High | 7.3 | 2024-07-11 | A vulnerability was found in code-projects Simple Task List 1.0. It has been declared as critical. This vulnerability affects unknown code of the file loginFor… |
CVE-2024-6447 | High | 7.2 | 2024-07-11 | The FULL – Cliente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the license plan parameter in all versions up to, and including, 3.1.1… |
CVE-2024-6652 | Medium | 6.3 | 2024-07-10 | A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file manage_member… |
CVE-2024-6650 | Low | 2.4 | 2024-07-10 | A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this issue is the func… |
CVE-2024-6037 | Critical | 9.1 | 2024-07-10 | A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root… |
CVE-2024-6036 | Critical | 9.1 | 2024-07-10 | A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?… |
CVE-2024-39565 | High | 8.8 | 2024-07-10 | An Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in J-Web shipped with Juniper Networks Junos OS allows an unauthe… |
CVE-2024-39562 | High | 7.5 | 2024-07-10 | A Missing Release of Resource after Effective Lifetime vulnerability the xinetd process, responsible for spawning SSH daemon (sshd) instances, of Juniper Netwo… |
CVE-2024-39561 | Medium | 5.8 | 2024-07-10 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on SRX4600 and SRX5000 Series … |
CVE-2024-39560 | Medium | 6.5 | 2024-07-10 | An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a lo… |
CVE-2024-39559 | Medium | 5.9 | 2024-07-10 | An Improper Check for Unusual or Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS Evolved may allow a network-based unaut… |
CVE-2024-39558 | Medium | 6.5 | 2024-07-10 | An Unchecked Return Value vulnerability in the Routing Protocol Daemon (rpd) on Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows a logica… |
CVE-2024-39557 | Medium | 6.5 | 2024-07-10 | An Uncontrolled Resource Consumption vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS Evolved allows an unauthenti… |
CVE-2024-39556 | Medium | 6.4 | 2024-07-10 | A Stack-Based Buffer Overflow vulnerability in Juniper Networks Junos OS and Juniper Networks Junos OS Evolved may allow a local, low-privileged attacker with… |
CVE-2024-39555 | High | 7.5 | 2024-07-10 | An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an a… |
CVE-2024-39554 | Medium | 5.9 | 2024-07-10 | A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the Routing Protocol Daemon (rpd) of Juniper Ne… |
CVE-2024-39518 | High | 7.5 | 2024-07-10 | A Heap-based Buffer Overflow vulnerability in the telemetry sensor process (sensord) of Juniper Networks Junos OS on MX240, MX480, MX960 platforms using MPC10E… |
CVE-2024-39517 | Medium | 6.5 | 2024-07-10 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Layer 2 Address Learning Daemon (l2ald) on Juniper Networks Junos OS and Junos OS… |
CVE-2024-39514 | Medium | 6.5 | 2024-07-10 | An Improper Check or Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos and Junos OS Evolved allow… |
CVE-2024-39513 | Medium | 5.5 | 2024-07-10 | An Improper Input Validation vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows a local, low-privileged attacker t… |
CVE-2024-39512 | Medium | 6.6 | 2024-07-10 | An Improper Physical Access Control vulnerability in the console port control of Juniper Networks Junos OS Evolved allows an attacker with physical access to t… |
CVE-2024-39511 | Medium | 5.5 | 2024-07-10 | An Improper Input Validation vulnerability in the 802.1X Authentication (dot1x) Daemon of Juniper Networks Junos OS allows a local, low-privileged attacker wit… |
CVE-2024-6286 | High | 7.8 | 2024-07-10 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
CVE-2024-6236 | High | 7.5 | 2024-07-10 | Denial of Service in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX |
CVE-2024-6151 | High | 7.8 | 2024-07-10 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktop… |
CVE-2024-6150 | Medium | 4.3 | 2024-07-10 | A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning |
CVE-2024-6149 | Medium | 6.1 | 2024-07-10 | Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5 |
CVE-2024-6148 | High | 8.8 | 2024-07-10 | Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5 |
CVE-2024-39693 | High | 7.5 | 2024-07-10 | Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availab… |
CVE-2024-38354 | High | 8.1 | 2024-07-10 | CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an imp… |
CVE-2024-38353 | Medium | 5.3 | 2024-07-10 | CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing a… |
CVE-2024-37310 | Critical | 9.0 | 2024-07-10 | EVerest is an EV charging software stack. An integer overflow in the "v2g_incoming_v2gtp" function in the v2g_server.cpp implementation can allow a remote atta… |
CVE-2024-37149 | High | 7.2 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-37148 | High | 8.1 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-25077 | Critical | 9.8 | 2024-07-10 | An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The Nonce used for on-the-fly decryption of flash images is stored… |
CVE-2024-25076 | Medium | 6.8 | 2024-07-10 | An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The bootrom function responsible for validating the Flash Product… |
CVE-2024-6649 | Medium | 4.3 | 2024-07-10 | A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerabilit… |
CVE-2024-6235 | High | 8.8 | 2024-07-10 | Sensitive information disclosure in NetScaler Console |
CVE-2024-5913 | Medium | 6.1 | 2024-07-10 | An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system t… |
CVE-2024-5912 | | 2024-07-10 | An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities… | |
CVE-2024-5911 | Medium | 4.9 | 2024-07-10 | An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interfa… |
CVE-2024-5910 | Critical | 9.8 | 2024-07-10 | Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network acc… |
CVE-2024-5492 | Medium | 6.1 | 2024-07-10 | Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites in NetScaler ADC and NetScaler Gateway |
CVE-2024-5491 | High | 7.5 | 2024-07-10 | Denial of Service in NetScaler ADC and NetScaler Gateway in NetScaler |
CVE-2024-37147 | Medium | 4.3 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-32469 | High | 7.1 | 2024-07-10 | Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL… |
CVE-2024-27095 | Medium | 5.4 | 2024-07-10 | Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being up… |
CVE-2024-27090 | Medium | 5.3 | 2024-07-10 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2024-6647 | Medium | 4.7 | 2024-07-10 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/set… |
CVE-2024-6646 | Medium | 5.3 | 2024-07-10 | A vulnerability was found in Netgear WN604 up to 20240710. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /… |
CVE-2024-37770 | Critical | 9.1 | 2024-07-10 | 14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. This vulnerability allows attackers to exec… |
CVE-2024-37504 | Medium | 5.3 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FileBird Document Library.This issue affects FileBird Document Library… |
CVE-2024-37498 | Medium | 5.3 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Conta… |
CVE-2024-37270 | Medium | 5.3 | 2024-07-10 | Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1… |
CVE-2024-37205 | Medium | 5.3 | 2024-07-10 | Insertion of Sensitive Information into Log File vulnerability in SERVIT Software Solutions.This issue affects affiliate-toolkit: from n/a through 3.4.4. |
CVE-2024-37115 | High | 7.5 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic Newspack Blocks.This issue affects Newspack Blocks: from n/a through 3.0… |
CVE-2024-37113 | Critical | 9.8 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/… |
CVE-2024-37110 | High | 7.5 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/… |
CVE-2024-32759 | | 2024-07-10 | Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials. | |
CVE-2024-6645 | Medium | 6.3 | 2024-07-10 | A vulnerability was found in WuKongOpenSource Wukong_nocode up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-6644 | Medium | 6.3 | 2024-07-10 | A vulnerability was found in zmops ArgusDBM up to 0.1.0. It has been classified as critical. Affected is the function getDefaultClassLoader of the file Calcula… |
CVE-2024-5217 | Critical | 9.8 | 2024-07-10 | ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnera… |
CVE-2024-5178 | Medium | 4.9 | 2024-07-10 | ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerab… |
CVE-2024-4879 | Critical | 9.8 | 2024-07-10 | ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could e… |
CVE-2024-3325 | High | 7.2 | 2024-07-10 | Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0. |
CVE-2024-40417 | Medium | 6.5 | 2024-07-10 | A vulnerability was found in Tenda AX1806 1.0.0.1. Affected by this issue is the function formSetRebootTimer of the file /goform/SetIpMacBind. The manipulation… |
CVE-2024-40412 | Medium | 6.8 | 2024-07-10 | Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function. |
CVE-2024-20456 | Medium | 6.7 | 2024-07-10 | A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Cisco Secure Boot… |
CVE-2024-40336 | Medium | 6.1 | 2024-07-10 | idccms v1.35 is vulnerable to Cross Site Scripting (XSS) within the 'Image Advertising Management.' |
CVE-2024-40332 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecord |
CVE-2024-40331 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/dbBakMySQL_deal.php?mudi=backup |
CVE-2024-40334 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/serverFile_deal.php?mudi=upFileDel&dataID=3 |
CVE-2024-40333 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=del&dataID=2 |
CVE-2024-40329 | High | 8.8 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=backup |
CVE-2024-40328 | Medium | 6.3 | 2024-07-10 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline_deal.php?mudi=del&dataType=&dataID=6 |
CVE-2024-28828 | High | 8.8 | 2024-07-10 | Cross-Site request forgery in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) could lead to 1-click compromize of the site. |
CVE-2024-28827 | High | 8.8 | 2024-07-10 | Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) allows a local attacker… |
CVE-2024-3799 | | 2024-07-10 | Insecure handling of POST header parameter body included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to creat… | |
CVE-2024-3798 | | 2024-07-10 | Insecure handling of GET header parameter file included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create… | |
CVE-2024-6556 | Medium | 5.3 | 2024-07-10 | The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includi… |
CVE-2024-6422 | Critical | 9.8 | 2024-07-10 | An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data. |
CVE-2024-6421 | High | 7.5 | 2024-07-10 | An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service. |
CVE-2024-5664 | Medium | 6.4 | 2024-07-10 | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute… |
CVE-2024-39493 | Medium | 5.5 | 2024-07-10 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak Using completion_done to determine wheth… |
CVE-2024-39492 | High | 7.0 | 2024-07-10 | In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdown The return value of… |
CVE-2024-39491 | Medium | 5.5 | 2024-07-10 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance The cs_dsp instance is initialized in… |
CVE-2024-39490 | Medium | 6.2 | 2024-07-10 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix missing sk_buff release in seg6_input_core The seg6_input() function is res… |
CVE-2024-39489 | Medium | 5.5 | 2024-07-10 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix memleak in seg6_hmac_init_algo seg6_hmac_init_algo returns without cleaning… |
CVE-2024-39488 | Medium | 5.5 | 2024-07-10 | In the Linux kernel, the following vulnerability has been resolved: arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY When CONFIG_DEBUG_BUGVERBOSE=n, we… |
CVE-2024-39927 | High | 8.2 | 2024-07-10 | Out-of-bounds write vulnerability exists in Ricoh MFPs and printers. If a remote attacker sends a specially crafted request to the affected products, the produ… |
CVE-2024-39886 | Low | 3.7 | 2024-07-10 | TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in clear… |
CVE-2024-36453 | Medium | 6.1 | 2024-07-10 | Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If this vulnerability is… |
CVE-2024-36452 | Low | 3.1 | 2024-07-10 | Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerability is exploited, unintended operations… |
CVE-2024-36451 | High | 8.8 | 2024-07-10 | Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploite… |
CVE-2024-36450 | Medium | 5.4 | 2024-07-10 | Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitrary script may be exec… |
CVE-2024-6411 | High | 8.8 | 2024-07-10 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9… |