2024 CVEs (page 229)
Page 229 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6407 | Critical | 9.8 | 2024-07-11 | CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to the device. |
CVE-2024-6528 | Medium | 5.4 | 2024-07-11 | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability leading to a… |
CVE-2024-5681 | High | 7.8 | 2024-07-11 | CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kernel execution when a… |
CVE-2024-5680 | High | 7.1 | 2024-07-11 | CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts… |
CVE-2024-5679 | High | 7.1 | 2024-07-11 | CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor with local user access… |
CVE-2024-2602 | High | 7.3 | 2024-07-11 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote code execution when an… |
CVE-2024-38433 | Medium | 6.7 | 2024-07-11 | Nuvoton - CWE-305: Authentication Bypass by Primary Weakness An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton… |
CVE-2024-6666 | High | 8.8 | 2024-07-11 | The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ and 'status' parameter in all versions up to, and including, 1.13.0 due to i… |
CVE-2024-6624 | Critical | 9.8 | 2024-07-11 | The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on c… |
CVE-2024-6385 | Critical | 9.6 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-6256 | Medium | 6.4 | 2024-07-11 | The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-… |
CVE-2024-5470 | Low | 3.8 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_… |
CVE-2024-5257 | Medium | 4.9 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with `ad… |
CVE-2024-2880 | Low | 2.7 | 2024-07-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-6138 | Medium | 4.8 | 2024-07-11 | The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-6026 | Medium | 5.4 | 2024-07-11 | The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated users with access t… |
CVE-2024-6025 | Medium | 5.4 | 2024-07-11 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and high… |
CVE-2024-5444 | Medium | 5.4 | 2024-07-11 | The Bible Text WordPress plugin through 0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2024-4655 | Medium | 5.4 | 2024-07-11 | The Ultimate Blocks WordPress plugin before 3.1.9 does not validate and escape some of its block options before outputting them back in a page/post where the… |
CVE-2024-1845 | High | 8.8 | 2024-07-11 | The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged… |
CVE-2024-22280 | High | 8.5 | 2024-07-11 | VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter speci… |
CVE-2024-6554 | Medium | 5.3 | 2024-07-11 | The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includin… |
CVE-2024-6397 | Critical | 9.8 | 2024-07-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44… |
CVE-2024-0619 | Medium | 5.3 | 2024-07-11 | The Payflex Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the payment_callback()… |
CVE-2024-6676 | Medium | 6.3 | 2024-07-11 | A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-6210 | Medium | 5.3 | 2024-07-11 | The Duplicator plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 1.5.9. This makes it possible for unauthenticat… |
CVE-2024-23485 | Medium | 4.6 | 2024-07-11 | Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation (CWE-1304) in the Controller 6000 and 7000 can lead to sec… |
CVE-2024-23317 | Medium | 6.3 | 2024-07-11 | External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arb… |
CVE-2024-23194 | Low | 3.3 | 2024-07-11 | Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Cent… |
CVE-2024-22387 | Medium | 6.8 | 2024-07-11 | External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify de… |
CVE-2024-40618 | Critical | 9.6 | 2024-07-11 | Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension. |
CVE-2024-6653 | High | 7.3 | 2024-07-11 | A vulnerability was found in code-projects Simple Task List 1.0. It has been declared as critical. This vulnerability affects unknown code of the file loginFor… |
CVE-2024-6447 | High | 7.2 | 2024-07-11 | The FULL – Cliente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the license plan parameter in all versions up to, and including, 3.1.1… |
CVE-2024-6652 | Medium | 6.3 | 2024-07-10 | A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file manage_member… |
CVE-2024-6650 | Low | 2.4 | 2024-07-10 | A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this issue is the func… |
CVE-2024-6037 | Critical | 9.1 | 2024-07-10 | A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root… |
CVE-2024-6036 | Critical | 9.1 | 2024-07-10 | A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?… |
CVE-2024-39565 | High | 8.8 | 2024-07-10 | An Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in J-Web shipped with Juniper Networks Junos OS allows an unauthe… |
CVE-2024-39562 | High | 7.5 | 2024-07-10 | A Missing Release of Resource after Effective Lifetime vulnerability the xinetd process, responsible for spawning SSH daemon (sshd) instances, of Juniper Netwo… |
CVE-2024-39561 | Medium | 5.8 | 2024-07-10 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on SRX4600 and SRX5000 Series … |
CVE-2024-39560 | Medium | 6.5 | 2024-07-10 | An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a lo… |
CVE-2024-39559 | Medium | 5.9 | 2024-07-10 | An Improper Check for Unusual or Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS Evolved may allow a network-based unaut… |
CVE-2024-39558 | Medium | 6.5 | 2024-07-10 | An Unchecked Return Value vulnerability in the Routing Protocol Daemon (rpd) on Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows a logica… |
CVE-2024-39557 | Medium | 6.5 | 2024-07-10 | An Uncontrolled Resource Consumption vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS Evolved allows an unauthenti… |
CVE-2024-39556 | Medium | 6.4 | 2024-07-10 | A Stack-Based Buffer Overflow vulnerability in Juniper Networks Junos OS and Juniper Networks Junos OS Evolved may allow a local, low-privileged attacker with… |
CVE-2024-39555 | High | 7.5 | 2024-07-10 | An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an a… |
CVE-2024-39554 | Medium | 5.9 | 2024-07-10 | A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the Routing Protocol Daemon (rpd) of Juniper Ne… |
CVE-2024-39518 | High | 7.5 | 2024-07-10 | A Heap-based Buffer Overflow vulnerability in the telemetry sensor process (sensord) of Juniper Networks Junos OS on MX240, MX480, MX960 platforms using MPC10E… |
CVE-2024-39517 | Medium | 6.5 | 2024-07-10 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Layer 2 Address Learning Daemon (l2ald) on Juniper Networks Junos OS and Junos OS… |
CVE-2024-39514 | Medium | 6.5 | 2024-07-10 | An Improper Check or Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos and Junos OS Evolved allow… |
CVE-2024-39513 | Medium | 5.5 | 2024-07-10 | An Improper Input Validation vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows a local, low-privileged attacker t… |
CVE-2024-39512 | Medium | 6.6 | 2024-07-10 | An Improper Physical Access Control vulnerability in the console port control of Juniper Networks Junos OS Evolved allows an attacker with physical access to t… |
CVE-2024-39511 | Medium | 5.5 | 2024-07-10 | An Improper Input Validation vulnerability in the 802.1X Authentication (dot1x) Daemon of Juniper Networks Junos OS allows a local, low-privileged attacker wit… |
CVE-2024-6286 | High | 7.8 | 2024-07-10 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows |
CVE-2024-6236 | High | 7.5 | 2024-07-10 | Denial of Service in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX |
CVE-2024-6151 | High | 7.8 | 2024-07-10 | Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktop… |
CVE-2024-6150 | Medium | 4.3 | 2024-07-10 | A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning |
CVE-2024-6149 | Medium | 6.1 | 2024-07-10 | Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5 |
CVE-2024-6148 | High | 8.8 | 2024-07-10 | Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5 |
CVE-2024-39693 | High | 7.5 | 2024-07-10 | Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availab… |
CVE-2024-38354 | High | 8.1 | 2024-07-10 | CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an imp… |
CVE-2024-38353 | Medium | 5.3 | 2024-07-10 | CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing a… |
CVE-2024-37310 | Critical | 9.0 | 2024-07-10 | EVerest is an EV charging software stack. An integer overflow in the "v2g_incoming_v2gtp" function in the v2g_server.cpp implementation can allow a remote atta… |
CVE-2024-37149 | High | 7.2 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-37148 | High | 8.1 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-25077 | Critical | 9.8 | 2024-07-10 | An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The Nonce used for on-the-fly decryption of flash images is stored… |
CVE-2024-25076 | Medium | 6.8 | 2024-07-10 | An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The bootrom function responsible for validating the Flash Product… |
CVE-2024-6649 | Medium | 4.3 | 2024-07-10 | A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerabilit… |
CVE-2024-6235 | High | 8.8 | 2024-07-10 | Sensitive information disclosure in NetScaler Console |
CVE-2024-5913 | Medium | 6.1 | 2024-07-10 | An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system t… |
CVE-2024-5912 | | 2024-07-10 | An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities… | |
CVE-2024-5911 | Medium | 4.9 | 2024-07-10 | An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interfa… |
CVE-2024-5910 | Critical | 9.8 | 2024-07-10 | Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network acc… |
CVE-2024-5492 | Medium | 6.1 | 2024-07-10 | Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites in NetScaler ADC and NetScaler Gateway |
CVE-2024-5491 | High | 7.5 | 2024-07-10 | Denial of Service in NetScaler ADC and NetScaler Gateway in NetScaler |
CVE-2024-37147 | Medium | 4.3 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-32469 | High | 7.1 | 2024-07-10 | Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL… |
CVE-2024-27095 | Medium | 5.4 | 2024-07-10 | Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being up… |
CVE-2024-27090 | Medium | 5.3 | 2024-07-10 | Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participati… |
CVE-2024-6647 | Medium | 4.7 | 2024-07-10 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/set… |
CVE-2024-6646 | Medium | 5.3 | 2024-07-10 | A vulnerability was found in Netgear WN604 up to 20240710. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /… |
CVE-2024-37770 | Critical | 9.1 | 2024-07-10 | 14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. This vulnerability allows attackers to exec… |
CVE-2024-37504 | Medium | 5.3 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FileBird Document Library.This issue affects FileBird Document Library… |
CVE-2024-37498 | Medium | 5.3 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Conta… |
CVE-2024-37270 | Medium | 5.3 | 2024-07-10 | Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1… |
CVE-2024-37205 | Medium | 5.3 | 2024-07-10 | Insertion of Sensitive Information into Log File vulnerability in SERVIT Software Solutions.This issue affects affiliate-toolkit: from n/a through 3.4.4. |
CVE-2024-37115 | High | 7.5 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic Newspack Blocks.This issue affects Newspack Blocks: from n/a through 3.0… |
CVE-2024-37113 | Critical | 9.8 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/… |
CVE-2024-37110 | High | 7.5 | 2024-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/… |
CVE-2024-32759 | | 2024-07-10 | Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials. | |
CVE-2024-6645 | Medium | 6.3 | 2024-07-10 | A vulnerability was found in WuKongOpenSource Wukong_nocode up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-6644 | Medium | 6.3 | 2024-07-10 | A vulnerability was found in zmops ArgusDBM up to 0.1.0. It has been classified as critical. Affected is the function getDefaultClassLoader of the file Calcula… |
CVE-2024-5217 | Critical | 9.8 | 2024-07-10 | ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnera… |
CVE-2024-5178 | Medium | 4.9 | 2024-07-10 | ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerab… |
CVE-2024-4879 | Critical | 9.8 | 2024-07-10 | ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could e… |
CVE-2024-3325 | High | 7.2 | 2024-07-10 | Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0. |
CVE-2024-40417 | Medium | 6.5 | 2024-07-10 | A vulnerability was found in Tenda AX1806 1.0.0.1. Affected by this issue is the function formSetRebootTimer of the file /goform/SetIpMacBind. The manipulation… |
CVE-2024-40412 | Medium | 6.8 | 2024-07-10 | Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function. |
CVE-2024-20456 | Medium | 6.7 | 2024-07-10 | A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Cisco Secure Boot… |
CVE-2024-40336 | Medium | 6.1 | 2024-07-10 | idccms v1.35 is vulnerable to Cross Site Scripting (XSS) within the 'Image Advertising Management.' |