2024 CVEs (page 235)
Page 235 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5711 | Medium | 6.1 | 2024-07-08 | A stored Cross-Site Scripting (XSS) vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloads into the chat in… |
CVE-2024-6539 | Low | 3.5 | 2024-07-07 | A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the file /guestbook of t… |
CVE-2024-3651 | High | 7.5 | 2024-07-07 | A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the func… |
CVE-2024-6229 | Medium | 5.4 | 2024-07-07 | A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature of stangirard/quivr, affecting the latest version. Users can upload… |
CVE-2024-40614 | Critical | 9.8 | 2024-07-07 | EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort… |
CVE-2024-40605 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40604 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries. |
CVE-2024-40603 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request. |
CVE-2024-40602 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40601 | Medium | 6.5 | 2024-07-07 | An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules. |
CVE-2024-40600 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40599 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40598 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (The log_deleted att… |
CVE-2024-40597 | High | 7.5 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose suppressed information for log events. (The log_deleted attribut… |
CVE-2024-40596 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log even… |
CVE-2024-6095 | Medium | 5.8 | 2024-07-06 | A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion… |
CVE-2024-37554 | Medium | 6.5 | 2024-07-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-eleme… |
CVE-2024-37553 | Medium | 6.5 | 2024-07-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Axelerant Testimonials Widget allows Stored XSS.Th… |
CVE-2024-37547 | Medium | 6.5 | 2024-07-06 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Livemesh Livemesh Addons for Elementor.This issue affects Livem… |
CVE-2024-37546 | Medium | 6.5 | 2024-07-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in biplob018 Image Hover Effects - Caption Hover with… |
CVE-2024-37542 | Medium | 5.4 | 2024-07-06 | Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a th… |
CVE-2024-37541 | Medium | 6.5 | 2024-07-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StaxWP Elementor Addons, Widgets and Enhancements – Stax… |
CVE-2024-37539 | Medium | 6.5 | 2024-07-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affe… |
CVE-2024-39486 | High | 7.8 | 2024-07-06 | In the Linux kernel, the following vulnerability has been resolved: drm/drm_file: Fix pid refcounting race <maarten.lankhorst@linux.intel.com>, Maxime Ripard… |
CVE-2024-37260 | High | 7.2 | 2024-07-06 | Server-Side Request Forgery (SSRF) vulnerability in Theme-Ruby Foxiz.This issue affects Foxiz: from n/a through 2.3.5. |
CVE-2024-37234 | Low | 3.5 | 2024-07-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4. |
CVE-2024-37208 | Medium | 4.9 | 2024-07-06 | Server-Side Request Forgery (SSRF) vulnerability in Robert Macchi WP Scraper.This issue affects WP Scraper: from n/a through 5.7. |
CVE-2024-5616 | Medium | 4.3 | 2024-07-06 | A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into de… |
CVE-2024-40594 | Low | 2.3 | 2024-07-06 | The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps. |
CVE-2024-39182 | High | 7.5 | 2024-07-05 | An information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via an arbitrary command… |
CVE-2024-33862 | High | 7.5 | 2024-07-05 | A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers to exhaust memory res… |
CVE-2024-5753 | High | 7.5 | 2024-07-05 | vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`. This vulnerability allows unauthenticate… |
CVE-2024-39696 | High | 8.8 | 2024-07-05 | Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party ac… |
CVE-2024-39691 | Medium | 4.3 | 2024-07-05 | matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice… |
CVE-2024-39689 | High | 7.5 | 2024-07-05 | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi… |
CVE-2024-39023 | High | 8.8 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/info_deal.php?mudi=add&nohrefStr=close |
CVE-2024-39022 | High | 8.8 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/infoSys_deal.php?mudi=deal |
CVE-2024-39021 | Medium | 5.4 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApiData_deal.php?mudi=del |
CVE-2024-39020 | Medium | 6.3 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/vpsApiData_deal.php?mudi=rev&nohrefStr=close |
CVE-2024-39019 | Medium | 5.4 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/idcProData_deal.php?mudi=del |
CVE-2024-34361 | High | 8.5 | 2024-07-05 | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3… |
CVE-2024-39687 | High | 7.2 | 2024-07-05 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an obje… |
CVE-2024-39321 | High | 7.5 | 2024-07-05 | Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists vi… |
CVE-2024-39174 | Medium | 6.1 | 2024-07-05 | A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2024-37903 | High | 8.2 | 2024-07-05 | Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities… |
CVE-2024-39178 | Medium | 5.4 | 2024-07-05 | MyPower vc8100 V100R001C00B030 was discovered to contain an arbitrary file read vulnerability via the component /tcpdump/tcpdump.php?menu_uuid. |
CVE-2024-39150 | Medium | 5.9 | 2024-07-05 | vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet. |
CVE-2024-37767 | High | 7.5 | 2024-07-05 | Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request. |
CVE-2024-27717 | Medium | 6.5 | 2024-07-05 | Cross Site Request Forgery vulnerability in Eskooly Free Online School Management Software v.3.0 and before allows a remote attacker to escalate privileges via… |
CVE-2024-27716 | Medium | 5.4 | 2024-07-05 | Cross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the message sending and user… |
CVE-2024-27715 | High | 8.2 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the Passwo… |
CVE-2024-27713 | High | 8.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Response Header Settin… |
CVE-2024-27712 | Critical | 9.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the User Account Mangemnt compo… |
CVE-2024-27711 | High | 8.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the Sin-up process function in… |
CVE-2024-27710 | Critical | 9.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the authentication mechanism. |
CVE-2024-27709 | Critical | 9.8 | 2024-07-05 | SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the searchby parameter of the allstudents.php c… |
CVE-2024-39210 | High | 7.5 | 2024-07-05 | Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php. This vulnerability… |
CVE-2024-37769 | High | 8.8 | 2024-07-05 | Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request. |
CVE-2024-37768 | Critical | 9.1 | 2024-07-05 | 14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id. |
CVE-2024-29319 | Critical | 9.8 | 2024-07-05 | Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file. The server can make unintended HTTP and… |
CVE-2024-29318 | Medium | 5.4 | 2024-07-05 | Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting (XSS) via upload of a SVG file with embedded javascript code. |
CVE-2024-23998 | Critical | 9.6 | 2024-07-05 | goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue. |
CVE-2024-23997 | Critical | 9.6 | 2024-07-05 | Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts. |
CVE-2024-6526 | Low | 3.5 | 2024-07-05 | A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This af… |
CVE-2024-6505 | Medium | 6.8 | 2024-07-05 | A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes… |
CVE-2024-39864 | Critical | 9.8 | 2024-07-05 | The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port… |
CVE-2024-39028 | Critical | 9.8 | 2024-07-05 | An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php. |
CVE-2024-39027 | High | 7.5 | 2024-07-05 | SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer… |
CVE-2024-38346 | Critical | 9.8 | 2024-07-05 | The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack… |
CVE-2024-23588 | Medium | 5.3 | 2024-07-05 | HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vulnerability. |
CVE-2024-6525 | Low | 2.7 | 2024-07-05 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20230922. It has been rated as problematic. Affected by this issue is some u… |
CVE-2024-6524 | Medium | 5.5 | 2024-07-05 | A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file exten… |
CVE-2024-6523 | Low | 3.5 | 2024-07-05 | A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-a… |
CVE-2024-6298 | Critical | 10.0 | 2024-07-05 | Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arb… |
CVE-2024-6209 | Critical | 10.0 | 2024-07-05 | Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access file… |
CVE-2024-39485 | Medium | 5.5 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Properly re-initialise notifier entry in unregister The notifier_entry… |
CVE-2024-39484 | Medium | 5.5 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: Don't strip remove function when driver is builtin Using __exit for the rem… |
CVE-2024-39483 | High | 7.1 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked When requesting an NMI w… |
CVE-2024-39482 | High | 7.8 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btree_iter btree_iter is used in two ways: eit… |
CVE-2024-39481 | High | 7.8 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: media: mc: Fix graph walk in media_pipeline_start The graph walk tries to follow all link… |
CVE-2024-39480 | High | 8.4 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Currently, when the user attempts symbol com… |
CVE-2024-39479 | High | 7.8 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/hwmon: Get rid of devm When both hwmon and hwmon drvdata (on which hwmon depends… |
CVE-2024-39478 | High | 7.8 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA text data uses variable length buffer all… |
CVE-2024-39477 | High | 7.8 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not call vma_add_reservation upon ENOMEM sysbot reported a splat [1] on __… |
CVE-2024-39476 | Medium | 5.5 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING Xiao r… |
CVE-2024-39475 | Medium | 5.5 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Handle err return when savagefb_check_var failed The commit 04e5eac8f3ab("… |
CVE-2024-39474 | Medium | 5.5 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL commit a421ef30… |
CVE-2024-39473 | Medium | 5.5 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension… |
CVE-2024-39472 | High | 7.3 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the legacy h_size fixup Commit a70f9fe52daa (… |
CVE-2024-36041 | High | 7.8 | 2024-07-05 | KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all… |
CVE-2024-34481 | Medium | 6.1 | 2024-07-05 | drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page. |
CVE-2024-32498 | Medium | 6.5 | 2024-07-05 | An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 exte… |
CVE-2024-39943 | Critical | 9.9 | 2024-07-04 | rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload pe… |
CVE-2024-39937 | High | 8.6 | 2024-07-04 | supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files. |
CVE-2024-39936 | High | 8.6 | 2024-07-04 | An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make… |
CVE-2024-39935 | High | 8.8 | 2024-07-04 | jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificate management privil… |
CVE-2024-6511 | Low | 3.5 | 2024-07-04 | A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the compone… |
CVE-2024-39934 | High | 7.8 | 2024-07-04 | Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because the "shared holotre… |
CVE-2024-37474 | Medium | 6.5 | 2024-07-04 | Cross Site Scripting (XSS) vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1. |
CVE-2024-37472 | High | 7.1 | 2024-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: fro… |