2024 CVEs (page 235)
Page 235 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6564 | Medium | 6.7 | 2024-07-08 | Buffer overflow in "rcar_dev_init" due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IM… |
CVE-2024-6563 | High | 7.5 | 2024-07-08 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulne… |
CVE-2024-39699 | Medium | 5.0 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed… |
CVE-2024-39695 | Medium | 5.3 | 2024-07-08 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in E… |
CVE-2024-39203 | Medium | 6.1 | 2024-07-08 | A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2024-39202 | High | 8.8 | 2024-07-08 | D-Link DIR-823X firmware - 240126 was discovered to contain a remote command execution (RCE) vulnerability via the dhcpd_startip parameter at /goform/set_lan_s… |
CVE-2024-31504 | High | 7.5 | 2024-07-08 | Buffer Overflow vulnerability in SILA Embedded Solutions GmbH freemodbus v.2018-09-12 allows a remtoe attacker to cause a denial of service via the LINUXTCP se… |
CVE-2024-23562 | Medium | 5.3 | 2024-07-08 | A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information. A remote unauthenticated attacker could exploit this vul… |
CVE-2024-21778 | High | 7.2 | 2024-07-08 | A heap-based buffer overflow vulnerability exists in the configuration file mib_init_value_array functionality of Realtek rtl819x Jungle SDK v3.4.11. A special… |
CVE-2024-39677 | Medium | 5.9 | 2024-07-08 | NHibernate is an object-relational mapper for the .NET framework. A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLStrin… |
CVE-2024-39308 | Medium | 5.4 | 2024-07-08 | RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML ti… |
CVE-2024-25639 | Medium | 5.9 | 2024-07-08 | Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user input… |
CVE-2024-4341 | Medium | 6.5 | 2024-07-08 | Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users. Thi… |
CVE-2024-39743 | Medium | 5.9 | 2024-07-08 | IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation… |
CVE-2024-39742 | High | 8.1 | 2024-07-08 | IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vu… |
CVE-2024-6163 | Medium | 5.3 | 2024-07-08 | Certain http endpoints of Checkmk in Checkmk < 2.3.0p10 < 2.2.0p31, < 2.1.0p46, <= 2.0.0p39 allows remote attacker to bypass authentication and access data |
CVE-2024-37999 | High | 7.8 | 2024-07-08 | A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). The affected application executes as a trusted account with high privile… |
CVE-2024-27903 | Critical | 9.8 | 2024-07-08 | OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can… |
CVE-2024-27459 | High | 7.8 | 2024-07-08 | The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with… |
CVE-2024-24974 | High | 7.5 | 2024-07-08 | The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with t… |
CVE-2024-37389 | Medium | 4.6 | 2024-07-08 | Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-… |
CVE-2024-34603 | Medium | 4.0 | 2024-07-08 | Improper access control in Samsung Message prior to SMR Jul-2024 Release 1 allows local attackers to access location data. |
CVE-2024-34602 | Low | 3.3 | 2024-07-08 | Use of implicit intent for sensitive communication in Samsung Messages prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. Use… |
CVE-2024-37528 | Medium | 4.8 | 2024-07-08 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, a… |
CVE-2024-31897 | Medium | 4.3 | 2024-07-08 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, a… |
CVE-2024-38330 | High | 7.0 | 2024-07-08 | IBM System Management for i 7.2, 7.3, and 7.4 could allow a local user to gain elevated privileges due to an unqualified library program call. A malicious act… |
CVE-2024-39723 | Medium | 4.6 | 2024-07-08 | IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. A user with physical access to the system could use the U… |
CVE-2024-5711 | Medium | 6.1 | 2024-07-08 | A stored Cross-Site Scripting (XSS) vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloads into the chat in… |
CVE-2024-6539 | Low | 3.5 | 2024-07-07 | A vulnerability classified as problematic has been found in heyewei SpringBootCMS up to 2024-05-28. Affected is an unknown function of the file /guestbook of t… |
CVE-2024-3651 | High | 7.5 | 2024-07-07 | A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the func… |
CVE-2024-6229 | Medium | 5.4 | 2024-07-07 | A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature of stangirard/quivr, affecting the latest version. Users can upload… |
CVE-2024-40614 | Critical | 9.8 | 2024-07-07 | EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort… |
CVE-2024-40605 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40604 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries. |
CVE-2024-40603 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request. |
CVE-2024-40602 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40601 | Medium | 6.5 | 2024-07-07 | An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules. |
CVE-2024-40600 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40599 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40598 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (The log_deleted att… |
CVE-2024-40597 | High | 7.5 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose suppressed information for log events. (The log_deleted attribut… |
CVE-2024-40596 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log even… |
CVE-2024-6095 | Medium | 5.8 | 2024-07-06 | A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion… |
CVE-2024-37554 | Medium | 6.5 | 2024-07-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-eleme… |
CVE-2024-37553 | Medium | 6.5 | 2024-07-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Axelerant Testimonials Widget allows Stored XSS.Th… |
CVE-2024-37547 | Medium | 6.5 | 2024-07-06 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Livemesh Livemesh Addons for Elementor.This issue affects Livem… |
CVE-2024-37546 | Medium | 6.5 | 2024-07-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in biplob018 Image Hover Effects - Caption Hover with… |
CVE-2024-37542 | Medium | 5.4 | 2024-07-06 | Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a th… |
CVE-2024-37541 | Medium | 6.5 | 2024-07-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StaxWP Elementor Addons, Widgets and Enhancements – Stax… |
CVE-2024-37539 | Medium | 6.5 | 2024-07-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affe… |
CVE-2024-39486 | High | 7.8 | 2024-07-06 | In the Linux kernel, the following vulnerability has been resolved: drm/drm_file: Fix pid refcounting race <maarten.lankhorst@linux.intel.com>, Maxime Ripard… |
CVE-2024-37260 | High | 7.2 | 2024-07-06 | Server-Side Request Forgery (SSRF) vulnerability in Theme-Ruby Foxiz.This issue affects Foxiz: from n/a through 2.3.5. |
CVE-2024-37234 | Low | 3.5 | 2024-07-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4. |
CVE-2024-37208 | Medium | 4.9 | 2024-07-06 | Server-Side Request Forgery (SSRF) vulnerability in Robert Macchi WP Scraper.This issue affects WP Scraper: from n/a through 5.7. |
CVE-2024-5616 | Medium | 4.3 | 2024-07-06 | A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into de… |
CVE-2024-40594 | Low | 2.3 | 2024-07-06 | The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps. |
CVE-2024-39182 | High | 7.5 | 2024-07-05 | An information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via an arbitrary command… |
CVE-2024-33862 | High | 7.5 | 2024-07-05 | A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers to exhaust memory res… |
CVE-2024-5753 | High | 7.5 | 2024-07-05 | vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`. This vulnerability allows unauthenticate… |
CVE-2024-39696 | High | 8.8 | 2024-07-05 | Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party ac… |
CVE-2024-39691 | Medium | 4.3 | 2024-07-05 | matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice… |
CVE-2024-39689 | High | 7.5 | 2024-07-05 | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi… |
CVE-2024-39023 | High | 8.8 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/info_deal.php?mudi=add&nohrefStr=close |
CVE-2024-39022 | High | 8.8 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/infoSys_deal.php?mudi=deal |
CVE-2024-39021 | Medium | 5.4 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApiData_deal.php?mudi=del |
CVE-2024-39020 | Medium | 6.3 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/vpsApiData_deal.php?mudi=rev&nohrefStr=close |
CVE-2024-39019 | Medium | 5.4 | 2024-07-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/idcProData_deal.php?mudi=del |
CVE-2024-34361 | High | 8.5 | 2024-07-05 | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3… |
CVE-2024-39687 | High | 7.2 | 2024-07-05 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an obje… |
CVE-2024-39321 | High | 7.5 | 2024-07-05 | Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists vi… |
CVE-2024-39174 | Medium | 6.1 | 2024-07-05 | A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2024-37903 | High | 8.2 | 2024-07-05 | Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities… |
CVE-2024-39178 | Medium | 5.4 | 2024-07-05 | MyPower vc8100 V100R001C00B030 was discovered to contain an arbitrary file read vulnerability via the component /tcpdump/tcpdump.php?menu_uuid. |
CVE-2024-39150 | Medium | 5.9 | 2024-07-05 | vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet. |
CVE-2024-37767 | High | 7.5 | 2024-07-05 | Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request. |
CVE-2024-27717 | Medium | 6.5 | 2024-07-05 | Cross Site Request Forgery vulnerability in Eskooly Free Online School Management Software v.3.0 and before allows a remote attacker to escalate privileges via… |
CVE-2024-27716 | Medium | 5.4 | 2024-07-05 | Cross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the message sending and user… |
CVE-2024-27715 | High | 8.2 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the Passwo… |
CVE-2024-27713 | High | 8.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Response Header Settin… |
CVE-2024-27712 | Critical | 9.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the User Account Mangemnt compo… |
CVE-2024-27711 | High | 8.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the Sin-up process function in… |
CVE-2024-27710 | Critical | 9.8 | 2024-07-05 | An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the authentication mechanism. |
CVE-2024-27709 | Critical | 9.8 | 2024-07-05 | SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the searchby parameter of the allstudents.php c… |
CVE-2024-39210 | High | 7.5 | 2024-07-05 | Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php. This vulnerability… |
CVE-2024-37769 | High | 8.8 | 2024-07-05 | Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request. |
CVE-2024-37768 | Critical | 9.1 | 2024-07-05 | 14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id. |
CVE-2024-29319 | Critical | 9.8 | 2024-07-05 | Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file. The server can make unintended HTTP and… |
CVE-2024-29318 | Medium | 5.4 | 2024-07-05 | Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting (XSS) via upload of a SVG file with embedded javascript code. |
CVE-2024-23998 | Critical | 9.6 | 2024-07-05 | goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue. |
CVE-2024-23997 | Critical | 9.6 | 2024-07-05 | Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts. |
CVE-2024-6526 | Low | 3.5 | 2024-07-05 | A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This af… |
CVE-2024-6505 | Medium | 6.8 | 2024-07-05 | A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes… |
CVE-2024-39864 | Critical | 9.8 | 2024-07-05 | The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port… |
CVE-2024-39028 | Critical | 9.8 | 2024-07-05 | An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php. |
CVE-2024-39027 | High | 7.5 | 2024-07-05 | SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer… |
CVE-2024-38346 | Critical | 9.8 | 2024-07-05 | The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack… |
CVE-2024-23588 | Medium | 5.3 | 2024-07-05 | HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vulnerability. |
CVE-2024-6525 | Low | 2.7 | 2024-07-05 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20230922. It has been rated as problematic. Affected by this issue is some u… |
CVE-2024-6524 | Medium | 5.5 | 2024-07-05 | A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file exten… |
CVE-2024-6523 | Low | 3.5 | 2024-07-05 | A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-a… |