2024 CVEs (page 248)
Page 248 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35298 | Medium | 4.3 | 2024-06-19 | Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to acces… |
CVE-2024-5768 | Medium | 6.4 | 2024-06-19 | The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mimo_upda… |
CVE-2024-5724 | High | 8.8 | 2024-06-19 | The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of un… |
CVE-2024-5649 | Medium | 5.4 | 2024-06-19 | The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted in… |
CVE-2024-5021 | Critical | 9.3 | 2024-06-19 | The WordPress Picture / Portfolio / Media Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.1… |
CVE-2024-4873 | Medium | 4.3 | 2024-06-19 | The Replace Image plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.10 via the image replacement… |
CVE-2024-4787 | Medium | 5.8 | 2024-06-19 | The Cost Calculator Builder PRO for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 3.1.75. This is due to i… |
CVE-2024-4663 | Medium | 6.4 | 2024-06-19 | The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and includi… |
CVE-2024-4623 | Medium | 6.4 | 2024-06-19 | The Blogmentor – Blog Layouts for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagination_style’ parameter in all versi… |
CVE-2024-4541 | Medium | 4.3 | 2024-06-19 | The Custom Product List Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to miss… |
CVE-2024-4450 | Medium | 6.3 | 2024-06-19 | The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions… |
CVE-2024-3984 | Medium | 6.4 | 2024-06-19 | The EmbedSocial – Social Media Feeds, Reviews and Galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedsocial_rev… |
CVE-2024-2381 | High | 8.8 | 2024-06-19 | The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save… |
CVE-2024-6125 | High | 8.1 | 2024-06-19 | The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plug… |
CVE-2024-6146 | High | 8.8 | 2024-06-19 | Actiontec WCB6200Q uh_get_postdata_withupload Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attac… |
CVE-2024-6145 | High | 8.8 | 2024-06-19 | Actiontec WCB6200Q Cookie Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2024-6144 | High | 8.8 | 2024-06-19 | Actiontec WCB6200Q Multipart Boundary Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2024-6143 | High | 8.8 | 2024-06-19 | Actiontec WCB6200Q uh_tcp_recv_header Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbi… |
CVE-2024-6142 | High | 8.8 | 2024-06-19 | Actiontec WCB6200Q uh_tcp_recv_content Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arb… |
CVE-2024-5970 | Medium | 6.4 | 2024-06-18 | The MaxGalleria plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's maxgallery_thumb shortcode in all versions up to, and includ… |
CVE-2024-6129 | Low | 3.7 | 2024-06-18 | A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login of the component Use… |
CVE-2024-6128 | Medium | 5.3 | 2024-06-18 | A vulnerability, which was classified as problematic, has been found in spa-cartcms 1.9.0.6. This issue affects some unknown processing of the file /checkout o… |
CVE-2024-38277 | Medium | 5.4 | 2024-06-18 | A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two. |
CVE-2024-38276 | High | 8.8 | 2024-06-18 | Incorrect CSRF token checks resulted in multiple CSRF risks. |
CVE-2024-38275 | High | 7.5 | 2024-06-18 | The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally se… |
CVE-2024-38274 | Medium | 6.1 | 2024-06-18 | Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt. |
CVE-2024-38273 | Medium | 5.4 | 2024-06-18 | Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access. |
CVE-2024-37821 | High | 8.8 | 2024-06-18 | An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploadi… |
CVE-2024-36977 | High | 7.8 | 2024-06-18 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Wait unconditionally after issuing EndXfer command Currently all controller IP… |
CVE-2024-36976 | Medium | 5.5 | 2024-06-18 | In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-ctrls: show all owned controls in log_status" This reverts commit 980… |
CVE-2024-36975 | Medium | 5.5 | 2024-06-18 | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Do not use WARN when encode fails When asn1_encode_sequence() fails, WARN… |
CVE-2024-36974 | High | 7.8 | 2024-06-18 | In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP If one TCA_TAPRIO_ATTR_PRIOMAP… |
CVE-2024-37791 | Medium | 6.0 | 2024-06-18 | DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id. |
CVE-2024-22002 | High | 7.8 | 2024-06-18 | CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the installation directory. |
CVE-2024-38351 | Medium | 5.4 | 2024-06-18 | Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exp… |
CVE-2024-38348 | High | 8.8 | 2024-06-18 | CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Staff Info module via the searvalu para… |
CVE-2024-38347 | High | 8.8 | 2024-06-18 | CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Room Information module via the id para… |
CVE-2024-37904 | Medium | 5.7 | 2024-06-18 | Minder is an open source Software Supply Chain Security Platform. Minder's Git provider is vulnerable to a denial of service from a maliciously configured GitH… |
CVE-2024-37803 | Medium | 5.4 | 2024-06-18 | Multiple stored cross-site scripting (XSS) vulnerabilities in CodeProjects Health Care hospital Management System v1.0 allows attackers to execute arbitrary we… |
CVE-2024-37802 | High | 8.8 | 2024-06-18 | CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Patient Info module via the searvalu pa… |
CVE-2024-37800 | Medium | 6.1 | 2024-06-18 | CodeProjects Restaurant Reservation System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Date parameter at index… |
CVE-2024-37799 | Medium | 5.4 | 2024-06-18 | CodeProjects Restaurant Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the reserv_id parameter at view_reservations.php. |
CVE-2024-21685 | Medium | 6.5 | 2024-06-18 | This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information D… |
CVE-2024-5275 | High | 7.8 | 2024-06-18 | A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example… |
CVE-2024-6116 | High | 7.3 | 2024-06-18 | A vulnerability, which was classified as critical, has been found in itsourcecode Simple Online Hotel Reservation System 1.0. Affected by this issue is some un… |
CVE-2024-6115 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical was found in itsourcecode Simple Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown funct… |
CVE-2024-6114 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical has been found in itsourcecode Monbela Tourist Inn Online Reservation System up to 1.0. Affected is an unknown function… |
CVE-2024-6112 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical was found in itsourcecode Pool of Bethesda Online Reservation System 1.0. This vulnerability affects unknown code of the… |
CVE-2024-6111 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical has been found in itsourcecode Pool of Bethesda Online Reservation System 1.0. This affects an unknown part of the file… |
CVE-2024-6110 | High | 7.3 | 2024-06-18 | A vulnerability was found in itsourcecode Magbanua Beach Resort Online Reservation System up to 1.0. It has been rated as critical. Affected by this issue is s… |
CVE-2024-6109 | Medium | 6.3 | 2024-06-18 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown funct… |
CVE-2024-5967 | Low | 2.7 | 2024-06-18 | A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured… |
CVE-2024-38507 | Low | 3.5 | 2024-06-18 | In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible |
CVE-2024-38506 | Medium | 6.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows |
CVE-2024-38505 | Medium | 5.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site |
CVE-2024-38504 | Medium | 4.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles |
CVE-2024-6108 | Medium | 4.3 | 2024-06-18 | A vulnerability was found in Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05. It has been classified as problematic. Affected is an unknown function of the… |
CVE-2024-5953 | Medium | 5.7 | 2024-06-18 | A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service whil… |
CVE-2024-5899 | Low | 3.3 | 2024-06-18 | When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This com… |
CVE-2024-5533 | Medium | 6.4 | 2024-06-18 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 due to insufficient input sanitization a… |
CVE-2024-5172 | Medium | 4.8 | 2024-06-18 | The Expert Invoice WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-4094 | Medium | 5.4 | 2024-06-18 | The Simple Share Buttons Adder WordPress plugin before 8.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-3276 | Medium | 4.8 | 2024-06-18 | The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 does not sanitise and… |
CVE-2024-37081 | High | 7.8 | 2024-06-18 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administr… |
CVE-2024-37080 | Critical | 9.8 | 2024-06-18 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… |
CVE-2024-37079 | Critical | 9.8 | 2024-06-18 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… |
CVE-2024-34024 | Medium | 6.3 | 2024-06-18 | Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remot… |
CVE-2024-33622 | Medium | 6.5 | 2024-06-18 | Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sen… |
CVE-2024-33620 | High | 8.6 | 2024-06-18 | Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents includ… |
CVE-2024-0066 | Medium | 5.3 | 2024-06-18 | Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device) and (O3C… |
CVE-2024-5860 | Medium | 4.3 | 2024-06-18 | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tc_dl_delete_t… |
CVE-2024-5541 | Medium | 5.3 | 2024-06-18 | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ibtana… |
CVE-2024-4375 | Medium | 6.4 | 2024-06-18 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_layer' shortcode in all vers… |
CVE-2024-1634 | Medium | 6.5 | 2024-06-18 | The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '… |
CVE-2024-0845 | Medium | 6.4 | 2024-06-18 | The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to, and including, 2… |
CVE-2024-6084 | High | 7.3 | 2024-06-18 | A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by this vulnerability… |
CVE-2024-6083 | Medium | 6.3 | 2024-06-18 | A vulnerability, which was classified as critical, was found in PHPVibe 11.0.46. Affected is an unknown function of the file /app/uploading/upload-mp3.php of t… |
CVE-2024-6082 | Low | 2.4 | 2024-06-17 | A vulnerability, which was classified as problematic, has been found in PHPVibe 11.0.46. This issue affects some unknown processing of the file functionalities… |
CVE-2024-6080 | High | 7.8 | 2024-06-17 | A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component incontrolWebcam Servi… |
CVE-2024-6067 | Medium | 6.3 | 2024-06-17 | A vulnerability classified as critical was found in SourceCodester Music Class Enrollment System 1.0. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-6066 | Medium | 6.3 | 2024-06-17 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file pa… |
CVE-2024-6065 | High | 7.3 | 2024-06-17 | A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2024-6064 | Medium | 5.3 | 2024-06-17 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmt_node_end o… |
CVE-2024-6063 | Low | 3.3 | 2024-06-17 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the fi… |
CVE-2024-37828 | Medium | 4.8 | 2024-06-17 | A stored cross-site scripting (XSS) in Vermeg Agile Reporter v23.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected i… |
CVE-2024-37798 | Medium | 5.9 | 2024-06-17 | Cross-site scripting (XSS) vulnerability in search-appointment.php in the Admin Panel in Phpgurukul Beauty Parlour Management System 1.0 allows remote attacker… |
CVE-2024-34833 | Critical | 9.8 | 2024-06-17 | Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "save_settings" page. An unauthenticated attacker c… |
CVE-2024-6062 | Low | 3.3 | 2024-06-17 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample… |
CVE-2024-6061 | Low | 3.3 | 2024-06-17 | A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_p… |
CVE-2024-37902 | Critical | 10.0 | 2024-06-17 | DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts f… |
CVE-2024-37896 | High | 8.8 | 2024-06-17 | Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.6.5 has SQL injection vulnerability. The SQL injection vulnerabilities… |
CVE-2024-37895 | Medium | 5.7 | 2024-06-17 | Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain… |
CVE-2024-37893 | Medium | 5.9 | 2024-06-17 | Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to b… |
CVE-2024-37891 | Medium | 4.4 | 2024-06-17 | urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only se… |
CVE-2024-37890 | High | 7.5 | 2024-06-17 | ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to… |
CVE-2024-37305 | High | 8.2 | 2024-06-17 | oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum… |
CVE-2024-6059 | Low | 2.4 | 2024-06-17 | A vulnerability, which was classified as problematic, has been found in Ingenico Estate Manager 2023. This issue affects some unknown processing of the file /e… |
CVE-2024-38449 | High | 7.7 | 2024-06-17 | A Directory Traversal vulnerability in KasmVNC 1.3.1.230e50f7b89663316c70de7b0e3db6f6b9340489 and possibly earlier versions allows remote authenticated attacke… |
CVE-2024-37840 | High | 8.8 | 2024-06-17 | SQL injection vulnerability in processscore.php in Itsourcecode Learning Management System Project In PHP With Source Code v1.0 allows remote attackers to exec… |
CVE-2024-36543 | Critical | 9.8 | 2024-06-17 | Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, po… |