2024 CVEs (page 241)
Page 241 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39153 | Medium | 4.7 | 2024-06-27 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/info_deal.php?mudi=del&dataType=news&dataTypeCN. |
CVE-2024-1153 | Medium | 4.6 | 2024-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrect… |
CVE-2024-6373 | High | 7.3 | 2024-06-27 | A vulnerability has been found in itsourcecode Online Food Ordering System up to 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-6372 | Medium | 6.3 | 2024-06-27 | A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part of the file customer… |
CVE-2024-6371 | High | 7.3 | 2024-06-27 | A vulnerability, which was classified as critical, has been found in itsourcecode Pool of Bethesda Online Reservation System 1.0. Affected by this issue is som… |
CVE-2024-1107 | Critical | 9.8 | 2024-06-27 | Authorization Bypass Through User-Controlled Key vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2024-6370 | Low | 3.5 | 2024-06-27 | A vulnerability classified as problematic was found in LabVantage LIMS 2017. Affected by this vulnerability is an unknown functionality of the file /labvantage… |
CVE-2024-6369 | Low | 3.5 | 2024-06-27 | A vulnerability classified as problematic has been found in LabVantage LIMS 2017. Affected is an unknown function of the file /labvantage/rc?command=page&sdcid… |
CVE-2024-6368 | Low | 3.5 | 2024-06-27 | A vulnerability was found in LabVantage LIMS 2017. It has been rated as problematic. This issue affects some unknown processing of the file /labvantage/rc?comm… |
CVE-2024-6367 | Low | 3.5 | 2024-06-27 | A vulnerability was found in LabVantage LIMS 2017. It has been declared as problematic. This vulnerability affects unknown code of the file /labvantage/rc?comm… |
CVE-2024-6262 | Medium | 6.4 | 2024-06-27 | The Portfolio Gallery – Image Gallery Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PFG' shortcode in all versions… |
CVE-2024-5535 | Critical | 9.1 | 2024-06-27 | Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to b… |
CVE-2024-0949 | Critical | 9.8 | 2024-06-27 | Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows… |
CVE-2024-0947 | Critical | 9.8 | 2024-06-27 | Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Man… |
CVE-2024-4983 | Medium | 6.4 | 2024-06-27 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-5601 | Medium | 6.4 | 2024-06-27 | The Create by Mediavine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Schema Meta shortcode in all versions up to, and inc… |
CVE-2024-22232 | High | 7.7 | 2024-06-27 | A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt ma… |
CVE-2024-22231 | Medium | 5.0 | 2024-06-27 | Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary direct… |
CVE-2024-4704 | Medium | 6.1 | 2024-06-27 | The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosing. |
CVE-2024-4664 | Medium | 4.8 | 2024-06-27 | The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perfo… |
CVE-2024-3111 | Medium | 5.4 | 2024-06-27 | The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, lea… |
CVE-2024-1330 | Medium | 4.3 | 2024-06-27 | The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to… |
CVE-2024-6283 | Medium | 5.4 | 2024-06-27 | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL parameter of the De Gallery widget in all versions u… |
CVE-2024-4570 | Medium | 6.4 | 2024-06-27 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 1.13.5… |
CVE-2024-4569 | Medium | 6.4 | 2024-06-27 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 1.13.5… |
CVE-2024-6054 | High | 8.8 | 2024-06-27 | The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'create_post_attachment_from_ur… |
CVE-2024-5289 | Medium | 6.4 | 2024-06-27 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget… |
CVE-2024-6323 | High | 7.5 | 2024-06-27 | Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allow… |
CVE-2024-5655 | Critical | 9.6 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-5430 | Medium | 6.8 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-4901 | High | 8.7 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-4557 | Medium | 6.5 | 2024-06-27 | Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 16.11.5, starting from 17.0 p… |
CVE-2024-4011 | Low | 3.1 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-3959 | Medium | 6.5 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-3115 | Medium | 4.3 | 2024-06-27 | An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 pri… |
CVE-2024-2191 | Medium | 5.3 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-1816 | Medium | 5.3 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 12.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1… |
CVE-2024-1493 | Medium | 6.5 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 p… |
CVE-2024-28984 | High | 8.8 | 2024-06-26 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Anal… |
CVE-2024-28983 | High | 8.8 | 2024-06-26 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Anal… |
CVE-2024-28982 | High | 7.1 | 2024-06-26 | Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of th… |
CVE-2024-37734 | Critical | 9.8 | 2024-06-26 | An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter. |
CVE-2024-37571 | Medium | 4.3 | 2024-06-26 | Buffer Overflow vulnerability in SAS Broker 9.2 build 1495 allows attackers to cause denial of service or obtain sensitive information via crafted payload to t… |
CVE-2024-37248 | Medium | 6.5 | 2024-06-26 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Anima allows Stored XSS.This issue… |
CVE-2024-37247 | Medium | 6.5 | 2024-06-26 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in twinpictures, baden03 jQuery T(-) Countdown Widget… |
CVE-2024-6355 | Medium | 4.3 | 2024-06-26 | A vulnerability was found in Genexis Tilgin Fiber Home Gateway HG1522 CSx000-01_09_01_12. It has been declared as problematic. Affected by this vulnerability i… |
CVE-2024-36829 | High | 7.5 | 2024-06-26 | Incorrect access control in Teldat M1 v11.00.05.50.01 allows attackers to obtain sensitive information via a crafted query string. |
CVE-2024-23767 | High | 8.8 | 2024-06-26 | An issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3. The HICP protocol allows unauthenticated changes to a device's network configurati… |
CVE-2024-23766 | High | 7.5 | 2024-06-26 | An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web interface on port 80. An unauthenticated GET request to a specifi… |
CVE-2024-23765 | Medium | 4.0 | 2024-06-26 | An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes an unidentified service on port 7412 on the network. All the network se… |
CVE-2024-1839 | Critical | 10.0 | 2024-06-26 | Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticated remote attacker… |
CVE-2024-39243 | Critical | 9.8 | 2024-06-26 | An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_save. |
CVE-2024-39242 | Medium | 6.1 | 2024-06-26 | A cross-site scripting (XSS) vulnerability in skycaiji v2.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload using eval(String.f… |
CVE-2024-39241 | Medium | 6.1 | 2024-06-26 | Cross Site Scripting (XSS) vulnerability in skycaiji 2.8 allows attackers to run arbitrary code via /admin/tool/preview. |
CVE-2024-38950 | Medium | 6.5 | 2024-06-26 | Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to __interceptor_memcpy function. |
CVE-2024-38949 | Medium | 6.5 | 2024-06-26 | Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc |
CVE-2024-38527 | Medium | 5.4 | 2024-06-26 | ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diag… |
CVE-2024-38520 | Medium | 5.3 | 2024-06-26 | SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. When SoftEtherVPN is deployed with L2TP enabled on a device, it introduces the poss… |
CVE-2024-38375 | Medium | 5.3 | 2024-06-26 | @fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include… |
CVE-2024-33329 | High | 7.5 | 2024-06-26 | A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other sensitive information. |
CVE-2024-33328 | Medium | 6.1 | 2024-06-26 | A cross-site scripting (XSS) vulnerability in the component main.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2024-33327 | Medium | 6.1 | 2024-06-26 | A cross-site scripting (XSS) vulnerability in the component UrlAccessibilityEvaluation.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary… |
CVE-2024-33326 | Medium | 6.1 | 2024-06-26 | A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary we… |
CVE-2024-35545 | Medium | 6.1 | 2024-06-26 | MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2024-6354 | High | 7.2 | 2024-06-26 | Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the exec… |
CVE-2024-39460 | Medium | 4.3 | 2024-06-26 | Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in s… |
CVE-2024-39459 | Medium | 4.3 | 2024-06-26 | In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins… |
CVE-2024-39458 | Low | 3.1 | 2024-06-26 | When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that m… |
CVE-2024-38272 | Medium | 4.3 | 2024-06-26 | There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows… |
CVE-2024-38271 | Medium | 4.8 | 2024-06-26 | There exists a vulnerability in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created for the sharing. As p… |
CVE-2024-25637 | Low | 3.1 | 2024-06-26 | October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allo… |
CVE-2024-4604 | Medium | 6.1 | 2024-06-26 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magarsus Consultancy SSO (Single Sign On) allows Manipulating Hidden Fields. This issue a… |
CVE-2024-4228 | Critical | 9.8 | 2024-06-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, C… |
CVE-2024-6344 | Low | 2.4 | 2024-06-26 | A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the component Push Conf… |
CVE-2024-37252 | Critical | 9.3 | 2024-06-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Icegram Email Subscribers & Newsletters allows SQL Inject… |
CVE-2024-37098 | Medium | 4.4 | 2024-06-26 | Server-Side Request Forgery (SSRF) vulnerability in Blossom Themes BlossomThemes Email Newsletter.This issue affects BlossomThemes Email Newsletter: from n/a t… |
CVE-2024-28830 | Low | 2.7 | 2024-06-26 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p7, <2.2.0p28, <2.1.0p45 and <=2.0.0p39 (EOL) causes automation user… |
CVE-2024-5215 | Medium | 6.4 | 2024-06-26 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and i… |
CVE-2024-5573 | Medium | 5.9 | 2024-06-26 | The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privilege users such as edi… |
CVE-2024-5473 | Medium | 4.0 | 2024-06-26 | The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-5332 | Medium | 6.4 | 2024-06-26 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and in… |
CVE-2024-5199 | Medium | 5.4 | 2024-06-26 | The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2024-5169 | Medium | 4.8 | 2024-06-26 | The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-5071 | Medium | 6.5 | 2024-06-26 | The Bookster WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulate the data sent whe… |
CVE-2024-4959 | Medium | 4.8 | 2024-06-26 | The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-4957 | Medium | 4.3 | 2024-06-26 | The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-4758 | High | 7.6 | 2024-06-26 | The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attackers to make a logg… |
CVE-2024-4106 | Medium | 5.3 | 2024-06-26 | A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is op… |
CVE-2024-4105 | Medium | 5.8 | 2024-06-26 | A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Refl… |
CVE-2024-3633 | Medium | 5.4 | 2024-06-26 | The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a ma… |
CVE-2024-34581 | High | 7.3 | 2024-06-26 | The W3C XML Signature Syntax and Processing (XMLDsig) specification, starting with 1.0, was originally published with a "RetrievalMethod is a URI ... that may… |
CVE-2024-34580 | Medium | 5.3 | 2024-06-26 | Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload… |
CVE-2024-21520 | Medium | 6.1 | 2024-06-26 | Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improp… |
CVE-2024-37141 | Low | 3.5 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an open redirect vulnerability. A remote low privileged attacker… |
CVE-2024-37140 | High | 8.8 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection vulnerability in an admin operation. A r… |
CVE-2024-37139 | Medium | 6.5 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through its Lifetime vulnerabi… |
CVE-2024-37138 | Medium | 4.1 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerability. A remote high p… |
CVE-2024-27867 | Medium | 4.3 | 2024-06-26 | An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Be… |
CVE-2024-5181 | Critical | 9.8 | 2024-06-26 | A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend paramete… |
CVE-2024-29177 | Low | 2.7 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a disclosure of temporary sensitive information vulnerability. A… |