2024 CVEs (page 244)
Page 244 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37677 | High | 7.5 | 2024-06-24 | An issue in Shenzhen Weitillage Industrial Co., Ltd the access management specialist V6.62.51215 allows a remote attacker to obtain sensitive information. |
CVE-2024-6104 | Medium | 6.0 | 2024-06-24 | go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth… |
CVE-2024-38373 | Critical | 9.6 | 2024-06-24 | FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Respon… |
CVE-2024-38369 | Critical | 9.9 | 2024-06-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of a document included using `{{include re… |
CVE-2024-33881 | Medium | 5.3 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted… |
CVE-2024-33880 | Medium | 5.3 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/A… |
CVE-2024-33879 | Critical | 9.8 | 2024-06-24 | An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted… |
CVE-2024-6287 | High | 7.5 | 2024-06-24 | Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. When checking whether a new image invades/overlaps with a… |
CVE-2024-6285 | High | 7.5 | 2024-06-24 | Integer Underflow (Wrap or Wraparound) vulnerability in Renesas arm-trusted-firmware. An integer underflow in image range check calculations could lead to bypa… |
CVE-2024-33687 | High | 7.5 | 2024-06-24 | Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the af… |
CVE-2024-4748 | High | 8.8 | 2024-06-24 | The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited si… |
CVE-2024-39292 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: um: Add winch to winch_handlers before registering winch IRQ Registering a winch IRQ is r… |
CVE-2024-39291 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()… |
CVE-2024-38667 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: riscv: prevent pt_regs corruption for secondary idle threads Top of the kernel thread sta… |
CVE-2024-38664 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm: zynqmp_dpsub: Always register bridge We must always register the DRM bridge, since z… |
CVE-2024-38663 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from resetting io stat Since commit 3b8cc6298724 ("blk-cg… |
CVE-2024-38384 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can… |
CVE-2024-37825 | Medium | 5.4 | 2024-06-24 | An issue in EnvisionWare Computer Access & Reservation Control SelfCheck v1.0 (fixed in OneStop 3.2.0.27184 Hotfix May 2024) allows unauthenticated attackers o… |
CVE-2024-37026 | Medium | 5.5 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Only use reserved BCS instances for usm migrate exec queue The GuC context schedu… |
CVE-2024-37021 | Medium | 5.5 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: fpga: manager: add owner module and take its refcount The current implementation of the f… |
CVE-2024-36479 | Medium | 5.5 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: fpga: bridge: add owner module and take its refcount The current implementation of the fp… |
CVE-2024-35247 | Medium | 5.5 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: fpga: region: add owner module and take its refcount The current implementation of the fp… |
CVE-2024-34030 | Medium | 4.7 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Return error for int_map allocation failure Return -ENOMEM from of_pci_… |
CVE-2024-34027 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock It need… |
CVE-2024-33847 | High | 7.1 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: don't allow unaligned truncation on released compress inode f2fs image ma… |
CVE-2024-33278 | Critical | 9.8 | 2024-06-24 | Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker to execute arbitrary code via the conn… |
CVE-2024-32936 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: media: ti: j721e-csi2rx: Fix races while restarting DMA After the frame is submitted to D… |
CVE-2024-5862 | High | 7.5 | 2024-06-24 | Improper Restriction of Excessive Authentication Attempts vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Interface Manipulation. This i… |
CVE-2024-4839 | Low | 3.3 | 2024-06-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The… |
CVE-2024-3264 | Medium | 5.3 | 2024-06-24 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Signature Spoofing by Improper Validatio… |
CVE-2024-37233 | Medium | 4.3 | 2024-06-24 | Improper Authentication vulnerability in Play.Ht allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Play.Ht: from n/a through 3… |
CVE-2024-37231 | High | 8.6 | 2024-06-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Salon booking system allows File Manipulat… |
CVE-2024-37228 | Critical | 10.0 | 2024-06-24 | Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <… |
CVE-2024-37111 | High | 7.5 | 2024-06-24 | Missing Authorization vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7. |
CVE-2024-37109 | Critical | 9.9 | 2024-06-24 | Improper Control of Generation of Code ('Code Injection') vulnerability in Membership Software WishList Member X allows Code Injection.This issue affects WishL… |
CVE-2024-37107 | High | 8.8 | 2024-06-24 | Improper Privilege Management vulnerability in Membership Software WishList Member X allows Privilege Escalation.This issue affects WishList Member X: from n/a… |
CVE-2024-37092 | High | 8.5 | 2024-06-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local Fi… |
CVE-2024-37091 | Critical | 9.9 | 2024-06-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixTheme… |
CVE-2024-37089 | Critical | 9.0 | 2024-06-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local Fi… |
CVE-2024-36038 | Medium | 6.3 | 2024-06-24 | Zoho ManageEngine ITOM products versions from 128234 to 128248 are affected by the stored cross-site scripting vulnerability in the proxy server option. |
CVE-2024-6160 | | 2024-06-24 | SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages… | |
CVE-2024-29868 | Critical | 9.1 | 2024-06-24 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism… |
CVE-2024-5683 | Critical | 9.8 | 2024-06-24 | Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code In… |
CVE-2024-4754 | Medium | 5.4 | 2024-06-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement… |
CVE-2024-36497 | Critical | 9.1 | 2024-06-24 | The decrypted configuration file contains the password in cleartext which is used to configure WINSelect. It can be used to remove the existing restrictions… |
CVE-2024-36496 | High | 7.5 | 2024-06-24 | The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The applic… |
CVE-2024-36495 | High | 7.7 | 2024-06-24 | The application Faronics WINSelect (Standard + Enterprise) saves its configuration in an encrypted file on the file system which "Everyone" has read and write… |
CVE-2024-27136 | Medium | 6.1 | 2024-06-24 | XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information abo… |
CVE-2024-24554 | High | 8.2 | 2024-06-24 | Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allow… |
CVE-2024-24553 | High | 7.5 | 2024-06-24 | Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inh… |
CVE-2024-24552 | High | 8.8 | 2024-06-24 | A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into a… |
CVE-2024-24551 | High | 8.8 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability ar… |
CVE-2024-24550 | High | 8.1 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which… |
CVE-2024-4900 | Medium | 6.1 | 2024-06-24 | The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open r… |
CVE-2024-4899 | Medium | 5.0 | 2024-06-24 | The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to… |
CVE-2024-6280 | Medium | 6.3 | 2024-06-24 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /adm… |
CVE-2024-6279 | Medium | 6.3 | 2024-06-24 | A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this issue is some unknown functionali… |
CVE-2024-6278 | Medium | 4.7 | 2024-06-24 | A vulnerability has been found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2024-6277 | Medium | 4.7 | 2024-06-24 | A vulnerability, which was classified as critical, was found in lahirudanushka School Management System 1.0.0/1.0.1. Affected is an unknown function of the fil… |
CVE-2024-4499 | Medium | 6.3 | 2024-06-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows a… |
CVE-2024-6276 | Medium | 4.7 | 2024-06-24 | A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. This issue affects some unknown proce… |
CVE-2024-6275 | Medium | 4.7 | 2024-06-24 | A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1. This vulnerability affects unknown code of the file pa… |
CVE-2024-6274 | Medium | 4.7 | 2024-06-24 | A vulnerability classified as critical has been found in lahirudanushka School Management System 1.0.0/1.0.1. This affects an unknown part of the file /attenda… |
CVE-2024-3121 | Low | 3.3 | 2024-06-24 | A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from t… |
CVE-2024-39337 | Medium | 6.5 | 2024-06-24 | Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass. |
CVE-2024-39334 | Medium | 6.5 | 2024-06-23 | MENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data. When a victim opens the details of this trans… |
CVE-2024-6273 | Medium | 4.3 | 2024-06-23 | A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as problematic. Affected by this vulnerability is the function save… |
CVE-2024-39331 | Critical | 9.8 | 2024-06-23 | In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-str… |
CVE-2024-4841 | Low | 3.3 | 2024-06-23 | A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input san… |
CVE-2024-6269 | Medium | 4.7 | 2024-06-23 | A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects the function get_ip.addr_details of the file /view/v… |
CVE-2024-6268 | High | 7.3 | 2024-06-23 | A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. Affected by this issue is some unknow… |
CVE-2024-6267 | Low | 2.4 | 2024-06-23 | A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown func… |
CVE-2024-6266 | Medium | 6.3 | 2024-06-23 | A vulnerability classified as critical has been found in Pear Admin Boot up to 2.0.2. Affected is an unknown function of the file /system/dictData/loadDictItem… |
CVE-2024-38319 | High | 7.5 | 2024-06-22 | IBM Security SOAR 51.0.2.0 could allow an authenticated user to execute malicious code loaded from a specially crafted script. IBM X-Force ID: 294830. |
CVE-2024-5443 | Critical | 9.8 | 2024-06-22 | CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().build_extension()` function. The vulnerabi… |
CVE-2024-6253 | High | 7.3 | 2024-06-22 | A vulnerability was found in itsourcecode Online Food Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of t… |
CVE-2024-6252 | Low | 2.4 | 2024-06-22 | A vulnerability has been found in Zorlan SkyCaiji up to 2.8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2024-6251 | Low | 2.4 | 2024-06-22 | A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_p… |
CVE-2024-38379 | Medium | 4.8 | 2024-06-22 | Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limit… |
CVE-2024-5596 | Medium | 6.3 | 2024-06-22 | The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly impleme… |
CVE-2024-4940 | Medium | 6.1 | 2024-06-22 | An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitra… |
CVE-2024-3593 | High | 7.2 | 2024-06-22 | The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect… |
CVE-2024-4874 | Medium | 4.3 | 2024-06-22 | The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter… |
CVE-2024-21519 | Medium | 6.6 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restoration functionality… |
CVE-2024-21518 | High | 7.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization… |
CVE-2024-21517 | Medium | 4.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the redirect parameter of customer account/login r… |
CVE-2024-21516 | Medium | 4.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0. A reflected XSS issue was identified in the directory parameter of admi… |
CVE-2024-21515 | Medium | 4.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route… |
CVE-2024-21514 | High | 7.4 | 2024-06-22 | This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is… |
CVE-2024-5966 | Medium | 6.4 | 2024-06-22 | The Grey Opaque theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Download-Button shortcode in all ve… |
CVE-2024-5965 | Medium | 6.4 | 2024-06-22 | The Mosaic theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to… |
CVE-2024-5791 | High | 7.2 | 2024-06-22 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp_id' parameter in… |
CVE-2024-5346 | Medium | 6.4 | 2024-06-22 | The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Video, UX Slider, UX Sidebar, and UX Payme… |
CVE-2024-4313 | Medium | 6.4 | 2024-06-22 | The Table Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including… |
CVE-2024-2484 | Medium | 6.4 | 2024-06-22 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Services and Post Type Grid widgets in all versions up to… |
CVE-2024-6120 | Medium | 6.5 | 2024-06-22 | The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability check on the multi… |
CVE-2024-37654 | Medium | 6.1 | 2024-06-21 | An issue in BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, A… |
CVE-2024-36532 | Critical | 10.0 | 2024-06-21 | Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-34989 | Critical | 9.8 | 2024-06-21 | In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFProductListModuleFro… |
CVE-2024-34452 | Medium | 6.1 | 2024-06-21 | CMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document. |