2024 CVEs (page 238)
Page 238 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4679 | High | 7.8 | 2024-07-02 | Incorrect Default Permissions vulnerability in Hitachi JP1/Extensible SNMP Agent for Windows, Hitachi JP1/Extensible SNMP Agent on Windows, Hitachi Job Managem… |
CVE-2024-2819 | Medium | 5.1 | 2024-07-02 | Incorrect Default Permissions, Improper Preservation of Permissions vulnerability in Hitachi Ops Center Common Services allows File Manipulation.This issue aff… |
CVE-2024-39314 | Medium | 4.7 | 2024-07-01 | toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked t… |
CVE-2024-39313 | Medium | 6.5 | 2024-07-01 | toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be… |
CVE-2024-39310 | Medium | 5.4 | 2024-07-01 | The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2… |
CVE-2024-39309 | Critical | 9.8 | 2024-07-01 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 al… |
CVE-2024-37765 | High | 8.8 | 2024-07-01 | Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. |
CVE-2024-37764 | Medium | 5.4 | 2024-07-01 | MachForm up to version 19 is affected by an authenticated stored cross-site scripting. |
CVE-2024-37763 | Medium | 5.4 | 2024-07-01 | MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can view compiled forms re… |
CVE-2024-37762 | Critical | 9.9 | 2024-07-01 | MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution. |
CVE-2024-23737 | Medium | 5.4 | 2024-07-01 | Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipulate a user's S/MIME… |
CVE-2024-23736 | High | 8.8 | 2024-07-01 | Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to manipulate a user's S/MIME certificate of… |
CVE-2024-5322 | Critical | 9.1 | 2024-07-01 | The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. This vu… |
CVE-2024-39305 | Medium | 6.5 | 2024-07-01 | Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when r… |
CVE-2024-38368 | Critical | 9.3 | 2024-07-01 | trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pu… |
CVE-2024-38367 | High | 8.2 | 2024-07-01 | trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk ses… |
CVE-2024-38366 | Critical | 10.0 | 2024-07-01 | trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email addres… |
CVE-2024-32230 | High | 7.8 | 2024-07-01 | FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0 |
CVE-2024-32229 | High | 8.4 | 2024-07-01 | FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column. |
CVE-2024-32228 | Medium | 6.6 | 2024-07-01 | FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end. |
CVE-2024-28200 | Critical | 9.1 | 2024-07-01 | The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 20… |
CVE-2024-39249 | High | 7.5 | 2024-07-01 | Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. NOTE: this is dispute… |
CVE-2024-39573 | High | 7.5 | 2024-07-01 | Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handle… |
CVE-2024-39303 | Medium | 4.4 | 2024-07-01 | Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible… |
CVE-2024-39251 | Critical | 10.0 | 2024-07-01 | An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information, execu… |
CVE-2024-39236 | Critical | 9.8 | 2024-07-01 | Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a craf… |
CVE-2024-38513 | Critical | 10.0 | 2024-07-01 | Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions… |
CVE-2024-38477 | High | 7.5 | 2024-07-01 | null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recomm… |
CVE-2024-38476 | Critical | 9.8 | 2024-07-01 | Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend application… |
CVE-2024-38475 | Critical | 9.1 | 2024-07-01 | Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted t… |
CVE-2024-38474 | Critical | 9.8 | 2024-07-01 | Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configur… |
CVE-2024-38473 | High | 8.1 | 2024-07-01 | Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially… |
CVE-2024-38472 | High | 7.5 | 2024-07-01 | SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recomm… |
CVE-2024-37298 | High | 7.5 | 2024-07-01 | gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struc… |
CVE-2024-37146 | Medium | 6.1 | 2024-07-01 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerab… |
CVE-2024-37145 | Medium | 6.1 | 2024-07-01 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerab… |
CVE-2024-36423 | Medium | 6.1 | 2024-07-01 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerab… |
CVE-2024-36387 | Medium | 5.4 | 2024-07-01 | Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading pe… |
CVE-2024-39879 | Medium | 5.0 | 2024-07-01 | In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings |
CVE-2024-39878 | Medium | 4.1 | 2024-07-01 | In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection |
CVE-2024-36997 | High | 8.1 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary… |
CVE-2024-36996 | Medium | 5.3 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not… |
CVE-2024-36995 | Medium | 5.4 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that… |
CVE-2024-36994 | Medium | 5.4 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that… |
CVE-2024-36993 | Medium | 5.4 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that… |
CVE-2024-36992 | Medium | 5.4 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that… |
CVE-2024-36991 | High | 7.5 | 2024-07-01 | In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splu… |
CVE-2024-36990 | Medium | 6.5 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that… |
CVE-2024-36989 | High | 7.1 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold th… |
CVE-2024-36987 | Medium | 4.3 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who d… |
CVE-2024-36986 | Medium | 6.3 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user coul… |
CVE-2024-36985 | High | 8.8 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Cod… |
CVE-2024-36984 | High | 8.8 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use… |
CVE-2024-36983 | High | 8.0 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user coul… |
CVE-2024-36982 | High | 7.5 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger… |
CVE-2024-21586 | High | 7.5 | 2024-07-01 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series and NFX… |
CVE-2024-20399 | Medium | 6.0 | 2024-07-01 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands a… |
CVE-2024-36422 | Medium | 6.1 | 2024-07-01 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerab… |
CVE-2024-36421 | High | 7.5 | 2024-07-01 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-C… |
CVE-2024-36420 | High | 7.5 | 2024-07-01 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endp… |
CVE-2024-36401 | Critical | 9.8 | 2024-07-01 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC requ… |
CVE-2024-6376 | High | 7.0 | 2024-07-01 | MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connectio… |
CVE-2024-6375 | Medium | 5.4 | 2024-07-01 | A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degra… |
CVE-2024-34696 | Medium | 4.5 | 2024-07-01 | GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, Geo… |
CVE-2024-23380 | High | 8.4 | 2024-07-01 | Memory corruption while handling user packets during VBO bind operation. |
CVE-2024-23373 | High | 8.4 | 2024-07-01 | Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released. |
CVE-2024-23372 | High | 8.4 | 2024-07-01 | Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size. |
CVE-2024-23368 | High | 7.8 | 2024-07-01 | Memory corruption when allocating and accessing an entry in an SMEM partition. |
CVE-2024-21482 | Medium | 6.8 | 2024-07-01 | Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image. |
CVE-2024-21469 | High | 7.3 | 2024-07-01 | Memory corruption when an invoke call and a TEE call are bound for the same trusted application. |
CVE-2024-21466 | Medium | 6.5 | 2024-07-01 | Information disclosure while parsing sub-IE length during new IE generation. |
CVE-2024-21465 | High | 7.8 | 2024-07-01 | Memory corruption while processing key blob passed by the user. |
CVE-2024-21462 | High | 7.1 | 2024-07-01 | Transient DOS while loading the TA ELF file. |
CVE-2024-21461 | High | 8.4 | 2024-07-01 | Memory corruption while performing finish HMAC operation when context is freed by keymaster. |
CVE-2024-21460 | High | 7.1 | 2024-07-01 | Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space. |
CVE-2024-21458 | Medium | 6.5 | 2024-07-01 | Information disclosure while handling SA query action frame. |
CVE-2024-21457 | Medium | 6.5 | 2024-07-01 | INformation disclosure while handling Multi-link IE in beacon frame. |
CVE-2024-21456 | Medium | 6.5 | 2024-07-01 | Information Disclosure while parsing beacon frame in STA. |
CVE-2024-6050 | Medium | 6.1 | 2024-07-01 | Improper Neutralization of Input During Web Page Generation vulnerability in SOKRATES-software SOWA OPAC allows a Reflected Cross-Site Scripting (XSS). An atta… |
CVE-2024-38953 | Medium | 6.1 | 2024-07-01 | phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file. |
CVE-2024-24749 | High | 7.5 | 2024-07-01 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Wi… |
CVE-2024-6425 | Critical | 9.1 | 2024-07-01 | Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts with… |
CVE-2024-6424 | Critical | 9.3 | 2024-07-01 | External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/P… |
CVE-2024-6387 | High | 8.1 | 2024-07-01 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an uns… |
CVE-2024-4007 | High | 8.8 | 2024-07-01 | Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured. |
CVE-2024-39853 | Medium | 6.5 | 2024-07-01 | adolph_dudu ratio-swiper 0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary… |
CVE-2024-39018 | Medium | 6.3 | 2024-07-01 | harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execut… |
CVE-2024-39017 | Critical | 9.8 | 2024-07-01 | agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vulnerability allows attackers to execute… |
CVE-2024-39016 | High | 8.1 | 2024-07-01 | che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. This vulnerability allows attackers to execute arbitrary… |
CVE-2024-39015 | Critical | 9.8 | 2024-07-01 | cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability allows attackers to execute arbitrary code… |
CVE-2024-39014 | Critical | 9.8 | 2024-07-01 | ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary cod… |
CVE-2024-39013 | Critical | 9.8 | 2024-07-01 | 2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or c… |
CVE-2024-39008 | Critical | 10.0 | 2024-07-01 | robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute a… |
CVE-2024-39003 | High | 7.3 | 2024-07-01 | amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary… |
CVE-2024-39002 | Medium | 6.3 | 2024-07-01 | rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. This vulnerability allows attackers to execute arbitr… |
CVE-2024-39001 | Medium | 6.3 | 2024-07-01 | ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to e… |
CVE-2024-39000 | Medium | 6.5 | 2024-07-01 | adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrar… |
CVE-2024-38999 | Critical | 10.0 | 2024-07-01 | jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execut… |
CVE-2024-38997 | Medium | 6.5 | 2024-07-01 | adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute… |
CVE-2024-38996 | Critical | 9.8 | 2024-07-01 | ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allo… |