2024 CVEs (page 242)
Page 242 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6344 | Low | 2.4 | 2024-06-26 | A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the component Push Conf… |
CVE-2024-37252 | Critical | 9.3 | 2024-06-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Icegram Email Subscribers & Newsletters allows SQL Inject… |
CVE-2024-37098 | Medium | 4.4 | 2024-06-26 | Server-Side Request Forgery (SSRF) vulnerability in Blossom Themes BlossomThemes Email Newsletter.This issue affects BlossomThemes Email Newsletter: from n/a t… |
CVE-2024-28830 | Low | 2.7 | 2024-06-26 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p7, <2.2.0p28, <2.1.0p45 and <=2.0.0p39 (EOL) causes automation user… |
CVE-2024-5215 | Medium | 6.4 | 2024-06-26 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and i… |
CVE-2024-5573 | Medium | 5.9 | 2024-06-26 | The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privilege users such as edi… |
CVE-2024-5473 | Medium | 4.0 | 2024-06-26 | The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-5332 | Medium | 6.4 | 2024-06-26 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and in… |
CVE-2024-5199 | Medium | 5.4 | 2024-06-26 | The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2024-5169 | Medium | 4.8 | 2024-06-26 | The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-5071 | Medium | 6.5 | 2024-06-26 | The Bookster WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulate the data sent whe… |
CVE-2024-4959 | Medium | 4.8 | 2024-06-26 | The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-4957 | Medium | 4.3 | 2024-06-26 | The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-4758 | High | 7.6 | 2024-06-26 | The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attackers to make a logg… |
CVE-2024-4106 | Medium | 5.3 | 2024-06-26 | A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is op… |
CVE-2024-4105 | Medium | 5.8 | 2024-06-26 | A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Refl… |
CVE-2024-3633 | Medium | 5.4 | 2024-06-26 | The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a ma… |
CVE-2024-34581 | High | 7.3 | 2024-06-26 | The W3C XML Signature Syntax and Processing (XMLDsig) specification, starting with 1.0, was originally published with a "RetrievalMethod is a URI ... that may… |
CVE-2024-34580 | Medium | 5.3 | 2024-06-26 | Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload… |
CVE-2024-21520 | Medium | 6.1 | 2024-06-26 | Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improp… |
CVE-2024-37141 | Low | 3.5 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an open redirect vulnerability. A remote low privileged attacker… |
CVE-2024-37140 | High | 8.8 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection vulnerability in an admin operation. A r… |
CVE-2024-37139 | Medium | 6.5 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through its Lifetime vulnerabi… |
CVE-2024-37138 | Medium | 4.1 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerability. A remote high p… |
CVE-2024-27867 | Medium | 4.3 | 2024-06-26 | An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Be… |
CVE-2024-5181 | Critical | 9.8 | 2024-06-26 | A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend paramete… |
CVE-2024-29177 | Low | 2.7 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a disclosure of temporary sensitive information vulnerability. A… |
CVE-2024-29176 | High | 8.8 | 2024-06-26 | Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. A low privileged attacker with remote acc… |
CVE-2024-29175 | Medium | 5.9 | 2024-06-26 | Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthen… |
CVE-2024-29174 | Medium | 4.4 | 2024-06-26 | Dell Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.30, LTS 7.10.1.20 contain an SQL Injection vulnerability. A local low privileged attacker could potenti… |
CVE-2024-29173 | Medium | 6.8 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Server-Side Request Forgery (SSRF) vulnerability. A remote hig… |
CVE-2024-28973 | Medium | 5.9 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. A remote high privi… |
CVE-2024-5173 | Medium | 6.4 | 2024-06-26 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versi… |
CVE-2024-24764 | Low | 3.5 | 2024-06-26 | October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted… |
CVE-2024-5460 | High | 8.1 | 2024-06-26 | A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow… |
CVE-2024-4869 | High | 7.2 | 2024-06-26 | The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ header in all version… |
CVE-2024-38526 | High | 7.2 | 2024-06-26 | pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CD… |
CVE-2024-38364 | Low | 2.6 | 2024-06-26 | DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable acces… |
CVE-2024-29954 | Medium | 5.9 | 2024-06-26 | A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log fil… |
CVE-2024-29953 | Medium | 4.3 | 2024-06-26 | A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual F… |
CVE-2024-6060 | | 2024-06-25 | An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with access to the log files to view logged HTTP requests that contain… | |
CVE-2024-37742 | High | 8.2 | 2024-06-25 | Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows. The vulnerability allows an attacker to share clipboard data between the SEB kiosk mode… |
CVE-2024-35527 | Critical | 9.8 | 2024-06-25 | An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrar… |
CVE-2024-30931 | Medium | 6.1 | 2024-06-25 | Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges via the notifications… |
CVE-2024-30112 | Medium | 5.4 | 2024-06-25 | HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an… |
CVE-2024-5019 | Medium | 5.3 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Arbitrary File Read issue exists in Wug.UI.Areas.Wug.Controllers.SessionController.Cach… |
CVE-2024-5018 | Medium | 5.3 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Path Traversal vulnerability exists Wug.UI.Areas.Wug.Controllers.SessionController.LoadNM… |
CVE-2024-5017 | Medium | 6.5 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a path traversal vulnerability exists. A specially crafted unauthenticated HTTP request to AppProfileImport… |
CVE-2024-5016 | High | 7.2 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code… |
CVE-2024-5015 | High | 7.1 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low pri… |
CVE-2024-5014 | High | 7.1 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticate… |
CVE-2024-5013 | High | 7.5 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated attacker can put the… |
CVE-2024-5012 | High | 8.6 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials. This vulnerability allows unau… |
CVE-2024-38516 | High | 8.8 | 2024-06-25 | ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This is… |
CVE-2024-37855 | High | 8.4 | 2024-06-25 | An issue in Nepstech Wifi Router xpon (terminal) NTPL-Xpon1GFEVN, hardware verstion 1.0 firmware 2.0.1 allows a remote attacker to execute arbitrary code via t… |
CVE-2024-37843 | Critical | 9.8 | 2024-06-25 | Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. |
CVE-2024-35526 | Medium | 5.9 | 2024-06-25 | An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory. |
CVE-2024-34400 | Medium | 6.1 | 2024-06-25 | An issue was discovered in VirtoSoftware Virto Kanban Board Web Part before 5.3.5.1 for SharePoint 2019. There is /_layouts/15/Virto.KanbanTaskManager/api/Kanb… |
CVE-2024-21741 | Critical | 9.8 | 2024-06-25 | GigaDevice GD32E103C8T6 devices have Incorrect Access Control. |
CVE-2024-21740 | High | 7.4 | 2024-06-25 | Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect Access Control. |
CVE-2024-21739 | Medium | 5.3 | 2024-06-25 | Geehy APM32F103CCT6, APM32F103RCT6, APM32F103RCT7, and APM32F103VCT6 devices have Incorrect Access Control. |
CVE-2024-6206 | High | 7.5 | 2024-06-25 | A security vulnerability has been identified in HPE Athonet Mobile Core software. The core application contains a code injection vulnerability where a threat a… |
CVE-2024-5276 | Critical | 9.8 | 2024-06-25 | A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative… |
CVE-2024-5011 | High | 7.5 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists. A specially crafted unauthenticated HTTP request … |
CVE-2024-5010 | High | 7.5 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality. A specially crafted unauthenticated HTTP req… |
CVE-2024-5009 | High | 8.4 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows loc… |
CVE-2024-5008 | High | 8.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Ar… |
CVE-2024-4885 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtiliti… |
CVE-2024-4884 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Contro… |
CVE-2024-4883 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated… |
CVE-2024-4498 | High | 7.7 | 2024-06-25 | A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vuln… |
CVE-2024-37894 | Medium | 6.3 | 2024-06-25 | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is suscepti… |
CVE-2024-37167 | Medium | 4.3 | 2024-06-25 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that they should not see… |
CVE-2024-37820 | Medium | 5.4 | 2024-06-25 | A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation. |
CVE-2024-36819 | Medium | 5.4 | 2024-06-25 | MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS). This vulnerability allows malicious users to insert a malicious payload into the "Client… |
CVE-2024-6308 | High | 7.3 | 2024-06-25 | A vulnerability was found in itsourcecode Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code… |
CVE-2024-6257 | High | 8.4 | 2024-06-25 | HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary… |
CVE-2024-6238 | High | 7.4 | 2024-06-25 | pgAdmin <= 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on t… |
CVE-2024-5990 | High | 7.5 | 2024-06-25 | Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automation ThinServer™ an… |
CVE-2024-5989 | Critical | 9.8 | 2024-06-25 | Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program and cause a remote c… |
CVE-2024-5988 | Critical | 9.8 | 2024-06-25 | Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote cod… |
CVE-2024-0171 | Medium | 5.3 | 2024-06-25 | Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gai… |
CVE-2024-5806 | Critical | 9.1 | 2024-06-25 | Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023… |
CVE-2024-5805 | Critical | 9.1 | 2024-06-25 | Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0. |
CVE-2024-39471 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add error handle to avoid out-of-bounds if the sdma_v4_0_irq_id_to_seq return… |
CVE-2024-39470 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix a possible null pointer dereference in eventfs_find_events() In function eve… |
CVE-2024-39469 | High | 7.1 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling… |
CVE-2024-39468 | High | 7.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix deadlock in smb2_find_smb_tcon() Unlock cifs_tcp_ses_lock before calling… |
CVE-2024-39467 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() syzbot reports a kern… |
CVE-2024-39466 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/qcom/lmh: Check for SCM availability at probe Up until now, the necessary… |
CVE-2024-39465 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: media: mgb4: Fix double debugfs remove Fixes an error where debugfs_remove_recursive() is… |
CVE-2024-39464 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Fix notifier list entry init struct v4l2_async_notifier has several li… |
CVE-2024-39463 | High | 7.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's d_… |
CVE-2024-39462 | Critical | 9.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: clk: bcm: dvp: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate st… |
CVE-2024-39461 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate st… |
CVE-2024-39371 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring: check for non-NULL file pointer in io_file_can_poll() In earlier kernels, it wa… |
CVE-2024-39301 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: net/9p: fix uninit-value in p9_client_rpc() Syzbot with the help of KMSAN reported the fo… |
CVE-2024-39298 | Medium | 5.5 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix handling of dissolved but not taken off from buddy pages When I di… |
CVE-2024-39296 | Medium | 4.7 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: bonding: fix oops during rmmod "rmmod bonding" causes an oops ever since commit cc317ea3d… |
CVE-2024-39293 | Critical | 9.8 | 2024-06-25 | In the Linux kernel, the following vulnerability has been resolved: Revert "xsk: Support redirect to any socket bound to the same umem" This reverts commit 2… |