2024 CVEs (page 233)
Page 233 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21335 | High | 8.8 | 2024-07-09 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability |
CVE-2024-21333 | High | 8.8 | 2024-07-09 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability |
CVE-2024-21332 | High | 8.8 | 2024-07-09 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability |
CVE-2024-21331 | High | 8.8 | 2024-07-09 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability |
CVE-2024-21317 | High | 8.8 | 2024-07-09 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability |
CVE-2024-21308 | High | 8.8 | 2024-07-09 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability |
CVE-2024-21303 | High | 8.8 | 2024-07-09 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability |
CVE-2024-20701 | High | 8.8 | 2024-07-09 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability |
CVE-2024-33509 | Medium | 4.8 | 2024-07-09 | An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a… |
CVE-2024-27785 | Medium | 5.4 | 2024-07-09 | An improper neutralization of formula elements in a CSV File [CWE-1236] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenticated attacker to… |
CVE-2024-27784 | High | 8.8 | 2024-07-09 | Multiple Exposure of sensitive information to an unauthorized actor weaknesses [CWE-200] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an authenticated… |
CVE-2024-27783 | High | 7.6 | 2024-07-09 | Multiple cross-site request forgery (CSRF) weaknesses [CWE-352] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remote attacker to perf… |
CVE-2024-27782 | High | 8.1 | 2024-07-09 | Multiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tok… |
CVE-2024-26015 | Low | 3.4 | 2024-07-09 | An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17… |
CVE-2024-23663 | High | 8.8 | 2024-07-09 | An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to… |
CVE-2024-21759 | Medium | 4.3 | 2024-07-09 | An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 allows attacker to view unauthorize… |
CVE-2024-6615 | High | 8.8 | 2024-07-09 | Memory safety bugs present in Firefox 127 and Thunderbird 127. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2024-6614 | Medium | 4.3 | 2024-07-09 | The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128… |
CVE-2024-6613 | Medium | 5.5 | 2024-07-09 | The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128… |
CVE-2024-6612 | Medium | 5.3 | 2024-07-09 | CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CS… |
CVE-2024-6611 | Critical | 9.8 | 2024-07-09 | A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128. |
CVE-2024-6610 | Medium | 4.3 | 2024-07-09 | Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen m… |
CVE-2024-6609 | High | 8.8 | 2024-07-09 | When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird… |
CVE-2024-6608 | Medium | 4.3 | 2024-07-09 | It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox window. This vulner… |
CVE-2024-6607 | High | 8.8 | 2024-07-09 | It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `<select>` element ove… |
CVE-2024-6606 | High | 8.2 | 2024-07-09 | Clipboard code failed to check the index on an array access. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 128 and Thunder… |
CVE-2024-6605 | High | 8.8 | 2024-07-09 | Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects Firefox < 128. |
CVE-2024-6604 | High | 7.5 | 2024-07-09 | Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume t… |
CVE-2024-6603 | High | 7.4 | 2024-07-09 | In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerabilit… |
CVE-2024-6602 | Critical | 9.8 | 2024-07-09 | A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird <… |
CVE-2024-6601 | Medium | 4.7 | 2024-07-09 | A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR <… |
CVE-2024-6600 | Medium | 6.3 | 2024-07-09 | Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private s… |
CVE-2024-39697 | High | 8.6 | 2024-07-09 | phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic… |
CVE-2024-38363 | High | 8.5 | 2024-07-09 | Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated r… |
CVE-2024-6598 | Medium | 6.5 | 2024-07-09 | A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with jo… |
CVE-2024-6527 | | 2024-07-09 | SQL Injection vulnerability in parameter "w" in file "druk.php" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and o… | |
CVE-2024-2177 | Medium | 6.8 | 2024-07-09 | A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1… |
CVE-2024-37952 | High | 8.8 | 2024-07-09 | Improper Privilege Management vulnerability in themeenergy BookYourTravel allows Privilege Escalation.This issue affects BookYourTravel: from n/a through 8.18… |
CVE-2024-37934 | Medium | 5.4 | 2024-07-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: fro… |
CVE-2024-37520 | Medium | 6.5 | 2024-07-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme ShopBuilder – Elementor Wo… |
CVE-2024-37513 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.This issue affects WPC… |
CVE-2024-22271 | High | 8.2 | 2024-07-09 | In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose… |
CVE-2024-6391 | Medium | 6.4 | 2024-07-09 | The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bw_button shortcode in all versions up to, and including, 4.10.3 due… |
CVE-2024-3596 | Critical | 9.0 | 2024-07-09 | RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access… |
CVE-2024-39888 | High | 7.5 | 2024-07-09 | A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded defa… |
CVE-2024-39876 | Medium | 4.0 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected applications do not properly handle log rotation. This… |
CVE-2024-39875 | Medium | 4.3 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows authenticated, low privilege use… |
CVE-2024-39874 | High | 7.5 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force… |
CVE-2024-39873 | High | 7.5 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force… |
CVE-2024-39872 | Critical | 9.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temp… |
CVE-2024-39871 | Medium | 6.3 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected applications do not properly separate the rights to edi… |
CVE-2024-39870 | Medium | 6.3 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected applications can be configured to allow users to ma… |
CVE-2024-39869 | Medium | 6.5 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected products allow to upload certificates. An authenticated… |
CVE-2024-39868 | High | 7.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication whe… |
CVE-2024-39867 | High | 7.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication whe… |
CVE-2024-39866 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup… |
CVE-2024-39865 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup… |
CVE-2024-39675 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4.3.10), RUGGEDCOM RMC30NC (All versions < V4.3.10), RUGGEDCOM RP110 (All versions < V4… |
CVE-2024-39571 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to… |
CVE-2024-39570 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to… |
CVE-2024-39569 | Medium | 6.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-39568 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-39567 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-38867 | Medium | 5.9 | 2024-07-09 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.64), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All… |
CVE-2024-38278 | Medium | 6.6 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGGEDCOM RS416NCv2 V5… |
CVE-2024-37997 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0.014), Teamcenter V… |
CVE-2024-37996 | Low | 3.3 | 2024-07-09 | A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0.014), Teamcenter V… |
CVE-2024-37501 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginsWare Advanced Classifieds & Directory Pro allows Path Tr… |
CVE-2024-37499 | Medium | 6.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vci… |
CVE-2024-37497 | High | 7.7 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetThemeCore jet-theme-core.This issue affects JetTh… |
CVE-2024-37484 | High | 8.8 | 2024-07-09 | Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n… |
CVE-2024-37464 | Medium | 4.9 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPZOOM Beaver Builder Addons by WPZOOM allows Path Traversal.Th… |
CVE-2024-33654 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an alloc… |
CVE-2024-33653 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an alloc… |
CVE-2024-32056 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains an out of bounds write past the end of an allo… |
CVE-2024-30321 | Medium | 5.9 | 2024-07-09 | A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5)… |
CVE-2024-5946 | Medium | 6.4 | 2024-07-09 | The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tab’ shortcode in all versions up to, and… |
CVE-2024-5634 | | 2024-07-09 | Longse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern. Once the pattern is k… | |
CVE-2024-5633 | | 2024-07-09 | Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the same local network to… | |
CVE-2024-5632 | | 2024-07-09 | Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network with a default password. A user is neit… | |
CVE-2024-5631 | | 2024-07-09 | Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote contro… | |
CVE-2024-4862 | Medium | 6.4 | 2024-07-09 | The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and i… |
CVE-2024-37462 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows Path T… |
CVE-2024-37455 | High | 8.8 | 2024-07-09 | Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons fo… |
CVE-2024-37454 | Medium | 6.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AWSM Innovations AWSM Team allows Path Traversal.This issue aff… |
CVE-2024-37442 | Low | 3.8 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays all… |
CVE-2024-37437 | Medium | 5.5 | 2024-07-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor.This issue… |
CVE-2024-37430 | Medium | 5.3 | 2024-07-09 | Authentication Bypass by Spoofing vulnerability in patreon Patreon WordPress patreon-connect.This issue affects Patreon WordPress: from n/a through <= 1.9.0. |
CVE-2024-37424 | Critical | 9.9 | 2024-07-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspa… |
CVE-2024-37420 | Critical | 9.9 | 2024-07-09 | Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web Shell to a Web Server.This issue affect… |
CVE-2024-37419 | High | 7.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Codeless Cowidgets – Elementor Addons allows Path Traversal.Thi… |
CVE-2024-37418 | Critical | 9.9 | 2024-07-09 | Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4… |
CVE-2024-37410 | Medium | 4.9 | 2024-07-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in IdeaBox Creations PowerPack Lite for B… |
CVE-2024-39487 | High | 7.1 | 2024-07-09 | In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function bond_opti… |
CVE-2024-37268 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kaptinlin Striking allows Path Traversal.This issue affects Str… |
CVE-2024-37266 | Medium | 4.9 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tuto… |
CVE-2024-37253 | Low | 2.7 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code… |
CVE-2024-37224 | High | 7.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in smartypants SP Project & Document Manager.This issue affects SP… |
CVE-2024-37090 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Masterstudy Elementor Widgets, StylemixThe… |
CVE-2024-35777 | Low | 3.5 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Automattic WooCommerce allows Content Spoof… |