2024 CVEs (page 237)
Page 237 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4482 | Medium | 6.4 | 2024-07-03 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-38453 | High | 7.5 | 2024-07-03 | The Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key. NOTE: the current version is 11 as of mid-2024. |
CVE-2024-37082 | Critical | 9.1 | 2024-07-03 | When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypa… |
CVE-2024-2376 | High | 8.8 | 2024-07-03 | The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted a… |
CVE-2024-2375 | Medium | 5.4 | 2024-07-03 | The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contrib… |
CVE-2024-2235 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those t… |
CVE-2024-2234 | Medium | 5.4 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such as Contributor to pe… |
CVE-2024-2233 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions v… |
CVE-2024-2231 | Medium | 6.5 | 2024-07-03 | The allows any authenticated user to join a private group due to a missing authorization check on a function |
CVE-2024-2040 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack |
CVE-2024-4543 | Medium | 4.3 | 2024-07-03 | The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is due to missing or… |
CVE-2024-39920 | Medium | 4.3 | 2024-07-03 | The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client syste… |
CVE-2024-32673 | Medium | 5.5 | 2024-07-03 | Improper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue. This issue affect… |
CVE-2024-4708 | Critical | 9.8 | 2024-07-02 | mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device. |
CVE-2024-6453 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in itsourcecode Farm Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2024-24791 | High | 7.5 | 2024-07-02 | The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or hi… |
CVE-2024-39326 | Medium | 4.4 | 2024-07-02 | SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint `/admin/projects/{projectname}/skills/{skillname}/video` (and proba… |
CVE-2024-39325 | Medium | 5.3 | 2024-07-02 | aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-contr… |
CVE-2024-39324 | Low | 3.8 | 2024-07-02 | aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, imp… |
CVE-2024-39322 | Medium | 5.5 | 2024-07-02 | aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024… |
CVE-2024-6452 | Medium | 6.3 | 2024-07-02 | A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file Adm… |
CVE-2024-39315 | Medium | 5.7 | 2024-07-02 | Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentionally included seriali… |
CVE-2024-38537 | Unrated | | 2024-07-02 | Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features of Fides, used the… |
CVE-2024-6382 | Medium | 6.4 | 2024-07-02 | Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application be… |
CVE-2024-6381 | Medium | 4.0 | 2024-07-02 | The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative o… |
CVE-2024-39894 | High | 7.5 | 2024-07-02 | OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming… |
CVE-2024-39891 | Medium | 5.3 | 2024-07-02 | In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-numb… |
CVE-2024-39206 | High | 7.5 | 2024-07-02 | An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due to enginesettings… |
CVE-2024-5866 | Medium | 5.0 | 2024-07-02 | Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing listing of arbitrary d… |
CVE-2024-5865 | High | 7.7 | 2024-07-02 | Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing arbitrary files readin… |
CVE-2024-4467 | High | 7.8 | 2024-07-02 | A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices… |
CVE-2024-3826 | | 2024-07-02 | In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On (SSO) functionality. | |
CVE-2024-39323 | High | 7.1 | 2024-07-02 | aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, a… |
CVE-2024-39316 | Medium | 6.5 | 2024-07-02 | Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability e… |
CVE-2024-26314 | High | 7.8 | 2024-07-02 | Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and execute arbitrary code. |
CVE-2024-25088 | High | 7.8 | 2024-07-02 | Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execute arbitrary code. |
CVE-2024-25087 | Medium | 5.5 | 2024-07-02 | Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.7.0 allows local attackers to cause a Windows blue screen error. |
CVE-2024-25086 | High | 7.8 | 2024-07-02 | Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execute arbitrary code. |
CVE-2024-22106 | High | 7.8 | 2024-07-02 | Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges, execute arbitrary code, or cause a Denial of Serv… |
CVE-2024-22105 | Medium | 5.5 | 2024-07-02 | Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error. |
CVE-2024-4897 | High | 8.4 | 2024-07-02 | parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python… |
CVE-2024-32932 | Medium | 6.8 | 2024-07-02 | Under certain circumstances the web interface users credentials may be recovered by an authenticated user. |
CVE-2024-22104 | Medium | 5.5 | 2024-07-02 | Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS). |
CVE-2024-22103 | Medium | 5.5 | 2024-07-02 | Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error and Denial of Service (DoS). |
CVE-2024-22102 | Medium | 5.5 | 2024-07-02 | Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error. |
CVE-2024-39143 | Medium | 5.4 | 2024-07-02 | A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious property content with HTML… |
CVE-2024-38519 | High | 7.8 | 2024-07-02 | `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downl… |
CVE-2024-36404 | Critical | 9.8 | 2024-07-02 | GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possibl… |
CVE-2024-34122 | High | 7.8 | 2024-07-02 | Acrobat for Edge versions 126.0.2592.68 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a re… |
CVE-2024-32757 | Medium | 6.8 | 2024-07-02 | Under certain circumstances unnecessary user details are provided within system logs |
CVE-2024-32756 | Medium | 6.8 | 2024-07-02 | Under certain circumstances the Linux users credentials may be recovered by an authenticated user. |
CVE-2024-32755 | Critical | 9.1 | 2024-07-02 | Under certain circumstances the web interface will accept characters unrelated to the expected input. |
CVE-2024-39119 | Medium | 5.4 | 2024-07-02 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-6441 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in ORIPA up to 1.72. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file src/mai… |
CVE-2024-6440 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0. It has been classified as critical. Affected is an unknown function o… |
CVE-2024-6439 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0 and classified as critical. This issue affects some unknown processing… |
CVE-2024-6438 | Medium | 6.3 | 2024-07-02 | A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The… |
CVE-2024-6264 | Medium | 6.4 | 2024-07-02 | The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions up to, and including… |
CVE-2024-6099 | Medium | 5.3 | 2024-07-02 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6… |
CVE-2024-6088 | Medium | 5.3 | 2024-07-02 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register'… |
CVE-2024-4268 | Medium | 6.4 | 2024-07-02 | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to… |
CVE-2024-6012 | Medium | 4.3 | 2024-07-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page… |
CVE-2024-6011 | Medium | 4.4 | 2024-07-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, a… |
CVE-2024-34601 | Medium | 5.9 | 2024-07-02 | Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launch unexported activi… |
CVE-2024-34600 | Medium | 4.4 | 2024-07-02 | Improper verification of intent by broadcast receiver vulnerability in Samsung Flow prior to version 4.9.13.0 allows local attackers to copy image files to ext… |
CVE-2024-34599 | Medium | 4.0 | 2024-07-02 | Improper input validation in Tips prior to version 6.2.9.4 in Android 14 allows local attacker to send broadcast with Tips' privilege. |
CVE-2024-34597 | Medium | 4.4 | 2024-07-02 | Improper input validation in Samsung Health prior to version 6.27.0.113 allows local attackers to write arbitrary document files to the sandbox of Samsung Heal… |
CVE-2024-34596 | Medium | 5.9 | 2024-07-02 | Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner. |
CVE-2024-34595 | High | 7.8 | 2024-07-02 | Improper access control in clickAdapterItem of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. |
CVE-2024-34594 | Medium | 5.5 | 2024-07-02 | Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address. |
CVE-2024-34593 | High | 7.5 | 2024-07-02 | Improper input validation in parsing and distributing RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary cod… |
CVE-2024-34592 | Medium | 5.3 | 2024-07-02 | Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of servi… |
CVE-2024-34591 | Medium | 5.3 | 2024-07-02 | Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger tempora… |
CVE-2024-34590 | Medium | 5.3 | 2024-07-02 | Improper input validation혻in parsing an item type from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger tempora… |
CVE-2024-34589 | Medium | 5.3 | 2024-07-02 | Improper input validation in parsing RTCP RR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service… |
CVE-2024-34588 | Medium | 5.3 | 2024-07-02 | Improper input validation혻in parsing RTCP SR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service… |
CVE-2024-34587 | High | 7.5 | 2024-07-02 | Improper input validation in parsing application information from RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute a… |
CVE-2024-34586 | Medium | 5.9 | 2024-07-02 | Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy. |
CVE-2024-34585 | High | 7.8 | 2024-07-02 | Improper access control in launchApp of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. |
CVE-2024-34583 | Medium | 4.0 | 2024-07-02 | Improper access control in system property prior to SMR Jul-2024 Release 1 allows local attackers to get device identifier. |
CVE-2024-20901 | Medium | 5.9 | 2024-07-02 | Improper input validation in copying data to buffer cache in libsaped prior to SMR Jul-2024 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2024-20900 | Medium | 4.0 | 2024-07-02 | Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication. |
CVE-2024-20899 | Medium | 4.0 | 2024-07-02 | Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive infor… |
CVE-2024-20898 | Medium | 4.0 | 2024-07-02 | Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive in… |
CVE-2024-20897 | Medium | 4.0 | 2024-07-02 | Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive infor… |
CVE-2024-20896 | Medium | 5.5 | 2024-07-02 | Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-20895 | High | 7.7 | 2024-07-02 | Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP features. |
CVE-2024-20894 | Medium | 4.3 | 2024-07-02 | Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authentication under certain c… |
CVE-2024-20893 | Medium | 6.1 | 2024-07-02 | Improper input validation in libmediaextractorservice.so prior to SMR Jul-2024 Release 1 allows local attackers to trigger memory corruption. |
CVE-2024-20892 | Medium | 6.5 | 2024-07-02 | Improper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local attackers to execute privileged behaviors. User interaction i… |
CVE-2024-20891 | High | 7.8 | 2024-07-02 | Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. |
CVE-2024-20890 | Medium | 5.3 | 2024-07-02 | Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior. |
CVE-2024-20889 | Medium | 5.9 | 2024-07-02 | Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices. |
CVE-2024-20888 | High | 7.8 | 2024-07-02 | Improper access control in OneUIHome prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. User interaction is required for t… |
CVE-2024-5260 | Medium | 6.4 | 2024-07-02 | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress i… |
CVE-2024-4836 | High | 7.5 | 2024-07-02 | Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration fil… |
CVE-2024-37185 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-37077 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write. |
CVE-2024-37030 | High | 8.2 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through use after free. |
CVE-2024-36278 | Low | 3.3 | 2024-07-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion. |