2024 CVEs (page 246)
Page 246 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38093 | Medium | 4.3 | 2024-06-20 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-38082 | Medium | 4.7 | 2024-06-20 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-37818 | High | 8.6 | 2024-06-20 | Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to… |
CVE-2024-37897 | Medium | 5.4 | 2024-06-20 | SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient s… |
CVE-2024-37699 | Critical | 9.8 | 2024-06-20 | An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption. |
CVE-2024-37674 | Medium | 5.5 | 2024-06-20 | Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity. |
CVE-2024-37352 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06 that allows attackers with system administr… |
CVE-2024-37351 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permis… |
CVE-2024-37350 | Medium | 6.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Attackers can interfere with a syst… |
CVE-2024-37349 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permis… |
CVE-2024-37626 | High | 8.8 | 2024-06-20 | A command injection issue in TOTOLINK A6000R V1.0.1-B20201211.2000 firmware allows a remote attacker to execute arbitrary code via the iface parameter in the v… |
CVE-2024-37348 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permis… |
CVE-2024-37347 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the pool configuration component of the management UI of Absolute Secure Access prior to 13.06. Attackers with… |
CVE-2024-37346 | Medium | 4.9 | 2024-06-20 | There is an insufficient input validation vulnerability in the Warehouse component of Absolute Secure Access prior to 13.06. Attackers with system administrato… |
CVE-2024-37345 | Medium | 5.3 | 2024-06-20 | There is a cross-site scripting vulnerability in the Secure Access administrative UI of Absolute Secure Access prior to version 13.06. Attackers can pass a lim… |
CVE-2024-37344 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the Policy management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator… |
CVE-2024-37343 | Medium | 4.8 | 2024-06-20 | There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.06. Attackers with vali… |
CVE-2024-33335 | Medium | 6.3 | 2024-06-20 | SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file. |
CVE-2024-28397 | Medium | 5.3 | 2024-06-20 | An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. |
CVE-2024-6196 | High | 7.3 | 2024-06-20 | A vulnerability was found in itsourcecode Banking Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-6195 | Medium | 6.3 | 2024-06-20 | A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-6194 | Medium | 6.3 | 2024-06-20 | A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file editm… |
CVE-2024-6193 | High | 7.3 | 2024-06-20 | A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. This issue affects some unknown processing of… |
CVE-2024-37676 | High | 8.4 | 2024-06-20 | An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function. |
CVE-2024-6192 | High | 7.3 | 2024-06-20 | A vulnerability classified as critical was found in itsourcecode Loan Management System 1.0. This vulnerability affects unknown code of the file login.php of t… |
CVE-2024-6191 | High | 7.3 | 2024-06-20 | A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. This affects an unknown part of the file login.php of the… |
CVE-2024-6190 | High | 7.3 | 2024-06-20 | A vulnerability was found in itsourcecode Farm Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of th… |
CVE-2024-6162 | High | 7.5 | 2024-06-20 | A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises beca… |
CVE-2024-37222 | High | 7.1 | 2024-06-20 | Cross Site Scripting (XSS) vulnerability in Averta Master Slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.10.0. |
CVE-2024-6189 | High | 8.8 | 2024-06-20 | A vulnerability was found in Tenda A301 15.13.08.12. It has been classified as critical. Affected is the function fromSetWirelessRepeat of the file /goform/Wif… |
CVE-2024-6188 | Medium | 5.3 | 2024-06-20 | A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export… |
CVE-2024-5156 | Medium | 6.4 | 2024-06-20 | The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.18.7 due to… |
CVE-2024-37532 | High | 8.8 | 2024-06-20 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID… |
CVE-2024-6187 | Medium | 6.3 | 2024-06-20 | A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/vpn/autovpn/sub_commi… |
CVE-2024-6186 | Medium | 6.3 | 2024-06-20 | A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0. This affects an unknown part of the file /view/userAuthentication/SSO/commit… |
CVE-2024-6185 | Medium | 6.3 | 2024-06-20 | A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC 1.0. Affected by this issue is the function get_ip_addr_details of the file… |
CVE-2024-6184 | Medium | 6.3 | 2024-06-20 | A vulnerability classified as critical was found in Ruijie RG-UAC 1.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfi… |
CVE-2024-6183 | Medium | 4.3 | 2024-06-20 | A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. Th… |
CVE-2024-6182 | Low | 3.5 | 2024-06-20 | A vulnerability was found in LabVantage LIMS 2017. It has been rated as problematic. This issue affects some unknown processing of the file /labvantage/rc?comm… |
CVE-2024-6181 | Low | 3.5 | 2024-06-20 | A vulnerability was found in LabVantage LIMS 2017. It has been declared as problematic. This vulnerability affects unknown code of the file /labvantage/rc?comm… |
CVE-2024-5036 | Medium | 6.4 | 2024-06-20 | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress i… |
CVE-2024-28147 | High | 7.4 | 2024-06-20 | An authenticated user can upload arbitrary files in the upload function for collection preview images. An attacker may upload an HTML file that includes mali… |
CVE-2024-34693 | Medium | 6.8 | 2024-06-20 | Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If b… |
CVE-2024-29013 | Medium | 6.5 | 2024-06-20 | Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via memcpy function. |
CVE-2024-29012 | High | 7.5 | 2024-06-20 | Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoS) via sscanf functi… |
CVE-2024-38620 | High | 8.8 | 2024-06-20 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Remove HCI_AMP support Since BT_HS has been remove HCI_AMP controllers no… |
CVE-2024-4098 | Critical | 9.8 | 2024-06-20 | The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_fetch_sharecounts fu… |
CVE-2024-38619 | Medium | 5.5 | 2024-06-20 | In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of str… |
CVE-2024-6113 | High | 7.3 | 2024-06-20 | A vulnerability was found in itsourcecode Monbela Tourist Inn Online Reservation System 1.0. It has been rated as critical. This issue affects some unknown pro… |
CVE-2024-5522 | Medium | 6.5 | 2024-06-20 | The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing… |
CVE-2024-5475 | Medium | 5.4 | 2024-06-20 | The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/po… |
CVE-2024-4565 | Medium | 6.5 | 2024-06-20 | The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values… |
CVE-2024-5686 | Medium | 6.4 | 2024-06-20 | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugi… |
CVE-2024-5605 | High | 8.8 | 2024-06-20 | The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all… |
CVE-2024-4390 | Medium | 6.5 | 2024-06-20 | The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Arbitrary Nonce Generation in all versions up to, and including, 3.0.2. This m… |
CVE-2024-5213 | Medium | 6.5 | 2024-06-20 | In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after l… |
CVE-2024-6179 | Medium | 6.1 | 2024-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This i… |
CVE-2024-6178 | Medium | 6.1 | 2024-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This i… |
CVE-2024-6177 | Medium | 6.1 | 2024-06-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS… |
CVE-2024-5432 | Critical | 9.8 | 2024-06-20 | The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to insufficient verifica… |
CVE-2024-4742 | Medium | 6.5 | 2024-06-20 | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the… |
CVE-2024-4626 | Medium | 6.4 | 2024-06-20 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to… |
CVE-2024-3627 | Medium | 5.4 | 2024-06-20 | The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missin… |
CVE-2024-3605 | Critical | 10.0 | 2024-06-20 | The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in… |
CVE-2024-3602 | Medium | 4.3 | 2024-06-20 | The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to unauthorized plugin… |
CVE-2024-3597 | High | 7.1 | 2024-06-20 | The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.2.2. This is due to insuffici… |
CVE-2024-3562 | High | 8.8 | 2024-06-20 | The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop custom field. This is… |
CVE-2024-3561 | High | 8.8 | 2024-06-20 | The Custom Field Suite plugin for WordPress is vulnerable to SQL Injection via the the 'Term' custom field in all versions up to, and including, 2.6.7 due to i… |
CVE-2024-3558 | Medium | 6.4 | 2024-06-20 | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_title]' parameter versions up to, and including… |
CVE-2024-1168 | Medium | 6.4 | 2024-06-20 | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social image URL in all versions up to, and inclu… |
CVE-2024-6176 | | 2024-06-20 | Allocation of Resources Without Limits or Throttling vulnerability in LG Electronics LG SuperSign CMS allows Port Scanning.This issue affects LG SuperSign CMS… | |
CVE-2024-6103 | High | 8.8 | 2024-06-20 | Use after free in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-6102 | High | 8.8 | 2024-06-20 | Out of bounds memory access in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2024-6101 | High | 8.8 | 2024-06-20 | Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to perform out of bounds memory access via a crafted HTML… |
CVE-2024-6100 | High | 8.8 | 2024-06-20 | Type Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security s… |
CVE-2024-5182 | Critical | 9.1 | 2024-06-20 | A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process t… |
CVE-2024-36684 | Critical | 9.8 | 2024-06-19 | In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive S… |
CVE-2024-36680 | High | 7.5 | 2024-06-19 | In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a se… |
CVE-2024-36679 | Critical | 10.0 | 2024-06-19 | In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the meth… |
CVE-2024-36678 | Critical | 9.8 | 2024-06-19 | In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensi… |
CVE-2024-36677 | High | 7.5 | 2024-06-19 | In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer accoun… |
CVE-2024-34994 | Critical | 9.8 | 2024-06-19 | In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFeedModuleFrontControl… |
CVE-2024-34990 | Critical | 10.0 | 2024-06-19 | In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files… |
CVE-2024-33836 | Critical | 9.8 | 2024-06-19 | In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .php. In version 6.X… |
CVE-2024-38358 | Low | 2.9 | 2024-06-19 | Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can tra… |
CVE-2024-38357 | Medium | 6.1 | 2024-06-19 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially… |
CVE-2024-38356 | Medium | 6.1 | 2024-06-19 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the `non… |
CVE-2024-38355 | High | 7.3 | 2024-06-19 | Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught excep… |
CVE-2024-34993 | Medium | 6.3 | 2024-06-19 | In the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaShop, a guest can per… |
CVE-2024-36117 | High | 8.6 | 2024-06-19 | Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an A… |
CVE-2024-36116 | High | 7.5 | 2024-06-19 | Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite provides support for JavaDo… |
CVE-2024-36115 | High | 7.1 | 2024-06-19 | Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. As a Maven repository manager, Reposil… |
CVE-2024-32030 | High | 8.1 | 2024-06-19 | Kafka UI is an Open-Source Web UI for Apache Kafka Management. Kafka UI API allows users to connect to different Kafka brokers by specifying their network addr… |
CVE-2024-34444 | High | 7.1 | 2024-06-19 | Missing Authorization vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a before 6.7.0. |
CVE-2024-34443 | Medium | 5.9 | 2024-06-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemePunch OHG Slider Revolution allows Stored XSS… |
CVE-2024-22263 | High | 8.8 | 2024-06-19 | Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has the ability to rece… |
CVE-2024-38618 | Medium | 5.5 | 2024-06-19 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Set lower bound of start tick time Currently ALSA timer doesn't have the low… |
CVE-2024-38617 | Medium | 5.5 | 2024-06-19 | In the Linux kernel, the following vulnerability has been resolved: kunit/fortify: Fix mismatched kvalloc()/vfree() usage The kv*() family of tests were acci… |
CVE-2024-38616 | High | 8.2 | 2024-06-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: re-fix fortified-memset warning The carl9170_tx_release() function someti… |
CVE-2024-38615 | Medium | 5.5 | 2024-06-19 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: exit() callback is optional The exit() callback is optional and shouldn't be cal… |