2024 CVEs (page 239)
Page 239 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38994 | High | 7.3 | 2024-07-01 | amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary co… |
CVE-2024-38993 | Critical | 9.8 | 2024-07-01 | rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary c… |
CVE-2024-38992 | High | 8.8 | 2024-07-01 | airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitr… |
CVE-2024-38991 | High | 8.8 | 2024-07-01 | akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary cod… |
CVE-2024-38990 | Medium | 6.3 | 2024-07-01 | Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to execute arbitrary c… |
CVE-2024-38987 | Medium | 6.3 | 2024-07-01 | aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary c… |
CVE-2024-39430 | Medium | 5.1 | 2024-07-01 | In faceid servive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executi… |
CVE-2024-39429 | Medium | 5.1 | 2024-07-01 | In faceid servive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executi… |
CVE-2024-39428 | Medium | 6.8 | 2024-07-01 | In trusty service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution priv… |
CVE-2024-39427 | Medium | 5.1 | 2024-07-01 | In trusty service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution priv… |
CVE-2024-0153 | High | 7.8 | 2024-07-01 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Valhall GPU Firmware, Arm Ltd Arm 5th Gen GPU Architecture Fir… |
CVE-2024-6130 | Medium | 4.8 | 2024-07-01 | The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-4934 | Medium | 5.5 | 2024-07-01 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post… |
CVE-2024-3123 | High | 7.2 | 2024-07-01 | CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can… |
CVE-2024-3122 | Medium | 4.9 | 2024-07-01 | CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privile… |
CVE-2024-38480 | Medium | 4.0 | 2024-07-01 | "Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the AP… |
CVE-2024-20081 | Medium | 6.7 | 2024-07-01 | In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System executi… |
CVE-2024-20080 | Critical | 9.8 | 2024-07-01 | In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to remote escalation of privilege with no… |
CVE-2024-20079 | Medium | 6.7 | 2024-07-01 | In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System executi… |
CVE-2024-20078 | Critical | 9.8 | 2024-07-01 | In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges neede… |
CVE-2024-20077 | High | 7.5 | 2024-07-01 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service with no additional execution privileges… |
CVE-2024-20076 | High | 7.5 | 2024-07-01 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service with no additional execution privileges… |
CVE-2024-6419 | Medium | 6.3 | 2024-07-01 | A vulnerability classified as critical was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file /classes/Ma… |
CVE-2024-6418 | High | 7.3 | 2024-06-30 | A vulnerability classified as critical has been found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file /classes/Users.ph… |
CVE-2024-6417 | Medium | 6.3 | 2024-06-30 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionali… |
CVE-2024-6416 | Medium | 6.3 | 2024-06-30 | A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/d… |
CVE-2024-34703 | High | 7.5 | 2024-06-30 | Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parame… |
CVE-2024-28794 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2024-31898 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure dir… |
CVE-2024-28797 | Medium | 6.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable stored to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2024-35119 | Medium | 5.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a s… |
CVE-2024-31902 | Medium | 4.3 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2024-28798 | High | 7.2 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2024-5062 | Medium | 6.1 | 2024-06-30 | A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization o… |
CVE-2024-28795 | Medium | 5.4 | 2024-06-30 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2024-6415 | Low | 2.4 | 2024-06-30 | A vulnerability classified as problematic was found in Ingenico Estate Manager 2023. Affected by this vulnerability is an unknown functionality of the file /em… |
CVE-2024-6414 | Medium | 5.3 | 2024-06-30 | A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x. Affected is an unknown function of the file TS/export/contentpage… |
CVE-2024-5926 | Critical | 9.1 | 2024-06-30 | A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and caus… |
CVE-2024-39848 | Critical | 9.1 | 2024-06-29 | Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is related to internet2.middleware.grouper.ws… |
CVE-2024-39846 | Low | 3.5 | 2024-06-29 | NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitive information. NOT… |
CVE-2024-39840 | High | 8.8 | 2024-06-29 | Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain Lua base module fun… |
CVE-2024-2386 | High | 8.8 | 2024-06-29 | The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all ve… |
CVE-2024-25943 | High | 7.6 | 2024-06-29 | iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A r… |
CVE-2024-5819 | Medium | 6.4 | 2024-06-29 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data at… |
CVE-2024-6363 | Medium | 6.4 | 2024-06-29 | The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions up to, and including… |
CVE-2024-5790 | Medium | 6.4 | 2024-06-29 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Gradient Heading w… |
CVE-2024-5666 | Medium | 6.4 | 2024-06-29 | The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versi… |
CVE-2024-6265 | Critical | 9.8 | 2024-06-29 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based S… |
CVE-2024-5942 | Medium | 4.3 | 2024-06-29 | The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone… |
CVE-2024-5889 | Medium | 6.1 | 2024-06-29 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in… |
CVE-2024-5598 | High | 7.5 | 2024-06-29 | The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_f… |
CVE-2024-5192 | Medium | 6.4 | 2024-06-29 | The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPres… |
CVE-2024-6405 | Medium | 6.1 | 2024-06-29 | The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing… |
CVE-2024-37371 | Critical | 9.1 | 2024-06-28 | In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid… |
CVE-2024-39828 | Medium | 6.1 | 2024-06-28 | R74n Sandboxels 1.9 through 1.9.5 allows XSS via a message in a modified saved-game file. This was fixed in a hotfix to 1.9.5 on 2024-06-29. |
CVE-2024-38533 | Medium | 6.5 | 2024-06-28 | ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. There is possible invalid stack access due to the addresses used to access th… |
CVE-2024-38532 | High | 7.1 | 2024-06-28 | The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryp… |
CVE-2024-38525 | High | 7.5 | 2024-06-28 | dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited… |
CVE-2024-37370 | High | 7.5 | 2024-06-28 | In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped… |
CVE-2024-39307 | Low | 3.5 | 2024-06-28 | Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't s… |
CVE-2024-39302 | Low | 3.7 | 2024-06-28 | BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated fi… |
CVE-2024-38518 | Medium | 4.6 | 2024-06-28 | BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick… |
CVE-2024-29040 | Medium | 4.3 | 2024-06-28 | This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to… |
CVE-2024-5827 | Critical | 9.8 | 2024-06-28 | Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and gener… |
CVE-2024-5712 | High | 8.1 | 2024-06-28 | A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the latest version. This vulnerability allows a… |
CVE-2024-3995 | | 2024-06-28 | In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins. | |
CVE-2024-38528 | High | 7.5 | 2024-06-28 | nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. Th… |
CVE-2024-38514 | High | 7.4 | 2024-06-28 | NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the `endpoint` GET p… |
CVE-2024-38322 | Medium | 5.3 | 2024-06-28 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration… |
CVE-2024-35156 | Medium | 6.5 | 2024-06-28 | IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th… |
CVE-2024-35116 | Medium | 5.9 | 2024-06-28 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes. IBM X-For… |
CVE-2024-27629 | High | 7.8 | 2024-06-28 | An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly escaped and injected in… |
CVE-2024-27628 | High | 8.1 | 2024-06-28 | Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component. |
CVE-2024-25053 | Medium | 5.9 | 2024-06-28 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Pla… |
CVE-2024-25041 | Medium | 5.4 | 2024-06-28 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is potentially vulnerable to cross site scripting (XSS). A remote attac… |
CVE-2024-25031 | Medium | 6.5 | 2024-06-28 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute f… |
CVE-2024-38374 | High | 7.5 | 2024-06-28 | The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deseria… |
CVE-2024-38371 | High | 8.6 | 2024-06-28 | authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This cou… |
CVE-2024-37905 | High | 8.8 | 2024-06-28 | authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin… |
CVE-2024-35155 | Medium | 6.5 | 2024-06-28 | IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is retur… |
CVE-2024-31919 | Medium | 5.9 | 2024-06-28 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service attack caused by an error processing mess… |
CVE-2024-31912 | High | 7.5 | 2024-06-28 | IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. I… |
CVE-2024-6403 | Medium | 6.5 | 2024-06-28 | A vulnerability, which was classified as critical, has been found in Tenda A301 15.13.08.12. Affected by this issue is the function formWifiBasicSet of the fil… |
CVE-2024-6402 | Medium | 6.5 | 2024-06-28 | A vulnerability classified as critical was found in Tenda A301 15.13.08.12. Affected by this vulnerability is the function fromSetWirelessRepeat of the file /g… |
CVE-2024-38522 | Medium | 6.3 | 2024-06-28 | Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` websit… |
CVE-2024-38521 | High | 8.8 | 2024-06-28 | Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is display… |
CVE-2024-35139 | Medium | 6.2 | 2024-06-28 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from the container due to incorrect defau… |
CVE-2024-35137 | Medium | 6.2 | 2024-06-28 | IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration infor… |
CVE-2024-29039 | Critical | 9.0 | 2024-06-28 | tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by alte… |
CVE-2024-38531 | Low | 3.6 | 2024-06-28 | Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change… |
CVE-2024-29038 | Medium | 4.3 | 2024-06-28 | tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detecte… |
CVE-2024-3816 | Critical | 9.8 | 2024-06-28 | Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to a blind SQL Injection executed using the search bar. Only a part of observed services is… |
CVE-2024-3801 | Medium | 6.1 | 2024-06-28 | Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to Reflected XSS via including scripts in one of GET header parameters. Only a part of obser… |
CVE-2024-3800 | Medium | 6.1 | 2024-06-28 | Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to Reflected XSS via including scripts in requested file names. Only a part of observed serv… |
CVE-2024-39704 | Critical | 9.8 | 2024-06-28 | Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary code on a client's mach… |
CVE-2024-37741 | Medium | 5.4 | 2024-06-28 | OpenPLC 3 through 9cd8f1b allows XSS via an SVG document as a profile picture. |
CVE-2024-5737 | Medium | 6.1 | 2024-06-28 | Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML… |
CVE-2024-5736 | High | 7.5 | 2024-06-28 | Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages avail… |
CVE-2024-5735 | High | 7.5 | 2024-06-28 | Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root f… |
CVE-2024-5925 | Medium | 6.4 | 2024-06-28 | The Theron Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up… |