2024 CVEs (page 248)
Page 248 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38541 | High | 7.8 | 2024-06-19 | In the Linux kernel, the following vulnerability has been resolved: of: module: add buffer overflow check in of_modalias() In of_modalias(), if the buffer ha… |
CVE-2024-38540 | Medium | 4.4 | 2024-06-19 | In the Linux kernel, the following vulnerability has been resolved: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Undefined behavior i… |
CVE-2024-38539 | High | 7.5 | 2024-06-19 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw When runni… |
CVE-2024-38538 | High | 7.3 | 2024-06-19 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: make sure we have at least eth header len bytes syzbot triggered an un… |
CVE-2024-38329 | High | 7.7 | 2024-06-19 | IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass securit… |
CVE-2024-36979 | High | 7.8 | 2024-06-19 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in br… |
CVE-2024-23443 | Medium | 4.9 | 2024-06-19 | A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack. |
CVE-2024-35780 | High | 8.5 | 2024-06-19 | Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a thro… |
CVE-2024-35765 | Medium | 6.5 | 2024-06-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wpsoul Greenshift – animation and page builder blo… |
CVE-2024-5676 | Medium | 6.8 | 2024-06-19 | The Paradox IP150 Internet Module in version 1.40.00 is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to a lack of countermeasures and the use of… |
CVE-2024-4632 | Medium | 6.4 | 2024-06-19 | The WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-0383 | Medium | 6.4 | 2024-06-19 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [wprm-recipe-instructions] and [wprm-recipe-ingredients]… |
CVE-2024-0789 | Medium | 5.3 | 2024-06-19 | The WP Maintenance plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 6.1.9.2 due to insufficient IP address valid… |
CVE-2024-3894 | Medium | 6.4 | 2024-06-19 | The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an Image Title in all versions up… |
CVE-2024-37881 | Medium | 5.3 | 2024-06-19 | SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs… |
CVE-2024-37387 | Medium | 4.0 | 2024-06-19 | Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. If this vulnerability is exploited, files in the PC where the product is i… |
CVE-2024-37124 | Critical | 9.8 | 2024-06-19 | Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. If this vulnerability is exploited, an attacker may create an arbitrary fi… |
CVE-2024-36978 | High | 7.8 | 2024-06-19 | In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will be assigned… |
CVE-2024-36480 | Critical | 9.8 | 2024-06-19 | Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain L… |
CVE-2024-36252 | Medium | 6.3 | 2024-06-19 | Improper restriction of communication channel to intended endpoints issue exists in Ricoh Streamline NX PC Client ver.3.6.x and earlier. If this vulnerability… |
CVE-2024-1407 | Medium | 5.4 | 2024-06-19 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… |
CVE-2024-6132 | High | 8.8 | 2024-06-19 | The Pexels: Free Stock Photos plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'pexels_fsp_images_option… |
CVE-2024-5853 | Critical | 9.9 | 2024-06-19 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sirv_upload… |
CVE-2024-5574 | High | 7.5 | 2024-06-19 | The WP Magazine Modules Lite plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'blockLayout' param… |
CVE-2024-5343 | High | 8.8 | 2024-06-19 | The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3… |
CVE-2024-5208 | Medium | 6.5 | 2024-06-19 | An uncontrolled resource consumption vulnerability exists in the `upload-link` endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to c… |
CVE-2024-3229 | Critical | 9.8 | 2024-06-19 | The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistan… |
CVE-2024-35298 | Medium | 4.3 | 2024-06-19 | Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to acces… |
CVE-2024-5768 | Medium | 6.4 | 2024-06-19 | The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mimo_upda… |
CVE-2024-5724 | High | 8.8 | 2024-06-19 | The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of un… |
CVE-2024-5649 | Medium | 5.4 | 2024-06-19 | The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserialization of untrusted in… |
CVE-2024-5021 | Critical | 9.3 | 2024-06-19 | The WordPress Picture / Portfolio / Media Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.1… |
CVE-2024-4873 | Medium | 4.3 | 2024-06-19 | The Replace Image plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.10 via the image replacement… |
CVE-2024-4787 | Medium | 5.8 | 2024-06-19 | The Cost Calculator Builder PRO for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 3.1.75. This is due to i… |
CVE-2024-4663 | Medium | 6.4 | 2024-06-19 | The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and includi… |
CVE-2024-4623 | Medium | 6.4 | 2024-06-19 | The Blogmentor – Blog Layouts for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagination_style’ parameter in all versi… |
CVE-2024-4541 | Medium | 4.3 | 2024-06-19 | The Custom Product List Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to miss… |
CVE-2024-4450 | Medium | 6.3 | 2024-06-19 | The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions… |
CVE-2024-3984 | Medium | 6.4 | 2024-06-19 | The EmbedSocial – Social Media Feeds, Reviews and Galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedsocial_rev… |
CVE-2024-2381 | High | 8.8 | 2024-06-19 | The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save… |
CVE-2024-6125 | High | 8.1 | 2024-06-19 | The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plug… |
CVE-2024-6146 | High | 8.8 | 2024-06-19 | Actiontec WCB6200Q uh_get_postdata_withupload Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attac… |
CVE-2024-6145 | High | 8.8 | 2024-06-19 | Actiontec WCB6200Q Cookie Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2024-6144 | High | 8.8 | 2024-06-19 | Actiontec WCB6200Q Multipart Boundary Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2024-6143 | High | 8.8 | 2024-06-19 | Actiontec WCB6200Q uh_tcp_recv_header Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbi… |
CVE-2024-6142 | High | 8.8 | 2024-06-19 | Actiontec WCB6200Q uh_tcp_recv_content Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arb… |
CVE-2024-5970 | Medium | 6.4 | 2024-06-18 | The MaxGalleria plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's maxgallery_thumb shortcode in all versions up to, and includ… |
CVE-2024-6129 | Low | 3.7 | 2024-06-18 | A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login of the component Use… |
CVE-2024-6128 | Medium | 5.3 | 2024-06-18 | A vulnerability, which was classified as problematic, has been found in spa-cartcms 1.9.0.6. This issue affects some unknown processing of the file /checkout o… |
CVE-2024-38277 | Medium | 5.4 | 2024-06-18 | A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two. |
CVE-2024-38276 | High | 8.8 | 2024-06-18 | Incorrect CSRF token checks resulted in multiple CSRF risks. |
CVE-2024-38275 | High | 7.5 | 2024-06-18 | The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally se… |
CVE-2024-38274 | Medium | 6.1 | 2024-06-18 | Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt. |
CVE-2024-38273 | Medium | 5.4 | 2024-06-18 | Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access. |
CVE-2024-37821 | High | 8.8 | 2024-06-18 | An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploadi… |
CVE-2024-36977 | High | 7.8 | 2024-06-18 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Wait unconditionally after issuing EndXfer command Currently all controller IP… |
CVE-2024-36976 | Medium | 5.5 | 2024-06-18 | In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-ctrls: show all owned controls in log_status" This reverts commit 980… |
CVE-2024-36975 | Medium | 5.5 | 2024-06-18 | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Do not use WARN when encode fails When asn1_encode_sequence() fails, WARN… |
CVE-2024-36974 | High | 7.8 | 2024-06-18 | In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP If one TCA_TAPRIO_ATTR_PRIOMAP… |
CVE-2024-37791 | Medium | 6.0 | 2024-06-18 | DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id. |
CVE-2024-22002 | High | 7.8 | 2024-06-18 | CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the installation directory. |
CVE-2024-38351 | Medium | 5.4 | 2024-06-18 | Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exp… |
CVE-2024-38348 | High | 8.8 | 2024-06-18 | CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Staff Info module via the searvalu para… |
CVE-2024-38347 | High | 8.8 | 2024-06-18 | CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Room Information module via the id para… |
CVE-2024-37904 | Medium | 5.7 | 2024-06-18 | Minder is an open source Software Supply Chain Security Platform. Minder's Git provider is vulnerable to a denial of service from a maliciously configured GitH… |
CVE-2024-37803 | Medium | 5.4 | 2024-06-18 | Multiple stored cross-site scripting (XSS) vulnerabilities in CodeProjects Health Care hospital Management System v1.0 allows attackers to execute arbitrary we… |
CVE-2024-37802 | High | 8.8 | 2024-06-18 | CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Patient Info module via the searvalu pa… |
CVE-2024-37800 | Medium | 6.1 | 2024-06-18 | CodeProjects Restaurant Reservation System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Date parameter at index… |
CVE-2024-37799 | Medium | 5.4 | 2024-06-18 | CodeProjects Restaurant Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the reserv_id parameter at view_reservations.php. |
CVE-2024-21685 | Medium | 6.5 | 2024-06-18 | This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information D… |
CVE-2024-5275 | High | 7.8 | 2024-06-18 | A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example… |
CVE-2024-6116 | High | 7.3 | 2024-06-18 | A vulnerability, which was classified as critical, has been found in itsourcecode Simple Online Hotel Reservation System 1.0. Affected by this issue is some un… |
CVE-2024-6115 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical was found in itsourcecode Simple Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown funct… |
CVE-2024-6114 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical has been found in itsourcecode Monbela Tourist Inn Online Reservation System up to 1.0. Affected is an unknown function… |
CVE-2024-6112 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical was found in itsourcecode Pool of Bethesda Online Reservation System 1.0. This vulnerability affects unknown code of the… |
CVE-2024-6111 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical has been found in itsourcecode Pool of Bethesda Online Reservation System 1.0. This affects an unknown part of the file… |
CVE-2024-6110 | High | 7.3 | 2024-06-18 | A vulnerability was found in itsourcecode Magbanua Beach Resort Online Reservation System up to 1.0. It has been rated as critical. Affected by this issue is s… |
CVE-2024-6109 | Medium | 6.3 | 2024-06-18 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown funct… |
CVE-2024-5967 | Low | 2.7 | 2024-06-18 | A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured… |
CVE-2024-38507 | Low | 3.5 | 2024-06-18 | In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible |
CVE-2024-38506 | Medium | 6.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows |
CVE-2024-38505 | Medium | 5.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site |
CVE-2024-38504 | Medium | 4.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles |
CVE-2024-6108 | Medium | 4.3 | 2024-06-18 | A vulnerability was found in Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05. It has been classified as problematic. Affected is an unknown function of the… |
CVE-2024-5953 | Medium | 5.7 | 2024-06-18 | A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service whil… |
CVE-2024-5899 | Low | 3.3 | 2024-06-18 | When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This com… |
CVE-2024-5533 | Medium | 6.4 | 2024-06-18 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 due to insufficient input sanitization a… |
CVE-2024-5172 | Medium | 4.8 | 2024-06-18 | The Expert Invoice WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-4094 | Medium | 5.4 | 2024-06-18 | The Simple Share Buttons Adder WordPress plugin before 8.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-3276 | Medium | 4.8 | 2024-06-18 | The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 does not sanitise and… |
CVE-2024-37081 | High | 7.8 | 2024-06-18 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administr… |
CVE-2024-37080 | Critical | 9.8 | 2024-06-18 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… |
CVE-2024-37079 | Critical | 9.8 | 2024-06-18 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… |
CVE-2024-34024 | Medium | 6.3 | 2024-06-18 | Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remot… |
CVE-2024-33622 | Medium | 6.5 | 2024-06-18 | Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sen… |
CVE-2024-33620 | High | 8.6 | 2024-06-18 | Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents includ… |
CVE-2024-0066 | Medium | 5.3 | 2024-06-18 | Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device) and (O3C… |
CVE-2024-5860 | Medium | 4.3 | 2024-06-18 | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tc_dl_delete_t… |
CVE-2024-5541 | Medium | 5.3 | 2024-06-18 | The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ibtana… |
CVE-2024-4375 | Medium | 6.4 | 2024-06-18 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_layer' shortcode in all vers… |