2024 CVEs (page 249)
Page 249 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1634 | Medium | 6.5 | 2024-06-18 | The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '… |
CVE-2024-0845 | Medium | 6.4 | 2024-06-18 | The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to, and including, 2… |
CVE-2024-6084 | High | 7.3 | 2024-06-18 | A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by this vulnerability… |
CVE-2024-6083 | Medium | 6.3 | 2024-06-18 | A vulnerability, which was classified as critical, was found in PHPVibe 11.0.46. Affected is an unknown function of the file /app/uploading/upload-mp3.php of t… |
CVE-2024-6082 | Low | 2.4 | 2024-06-17 | A vulnerability, which was classified as problematic, has been found in PHPVibe 11.0.46. This issue affects some unknown processing of the file functionalities… |
CVE-2024-6080 | High | 7.8 | 2024-06-17 | A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component incontrolWebcam Servi… |
CVE-2024-6067 | Medium | 6.3 | 2024-06-17 | A vulnerability classified as critical was found in SourceCodester Music Class Enrollment System 1.0. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-6066 | Medium | 6.3 | 2024-06-17 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file pa… |
CVE-2024-6065 | High | 7.3 | 2024-06-17 | A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2024-6064 | Medium | 5.3 | 2024-06-17 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmt_node_end o… |
CVE-2024-6063 | Low | 3.3 | 2024-06-17 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the fi… |
CVE-2024-37828 | Medium | 4.8 | 2024-06-17 | A stored cross-site scripting (XSS) in Vermeg Agile Reporter v23.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected i… |
CVE-2024-37798 | Medium | 5.9 | 2024-06-17 | Cross-site scripting (XSS) vulnerability in search-appointment.php in the Admin Panel in Phpgurukul Beauty Parlour Management System 1.0 allows remote attacker… |
CVE-2024-34833 | Critical | 9.8 | 2024-06-17 | Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "save_settings" page. An unauthenticated attacker c… |
CVE-2024-6062 | Low | 3.3 | 2024-06-17 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample… |
CVE-2024-6061 | Low | 3.3 | 2024-06-17 | A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_p… |
CVE-2024-37902 | Critical | 10.0 | 2024-06-17 | DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts f… |
CVE-2024-37896 | High | 8.8 | 2024-06-17 | Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.6.5 has SQL injection vulnerability. The SQL injection vulnerabilities… |
CVE-2024-37895 | Medium | 5.7 | 2024-06-17 | Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain… |
CVE-2024-37893 | Medium | 5.9 | 2024-06-17 | Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to b… |
CVE-2024-37891 | Medium | 4.4 | 2024-06-17 | urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only se… |
CVE-2024-37890 | High | 7.5 | 2024-06-17 | ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to… |
CVE-2024-37305 | High | 8.2 | 2024-06-17 | oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum… |
CVE-2024-6059 | Low | 2.4 | 2024-06-17 | A vulnerability, which was classified as problematic, has been found in Ingenico Estate Manager 2023. This issue affects some unknown processing of the file /e… |
CVE-2024-38449 | High | 7.7 | 2024-06-17 | A Directory Traversal vulnerability in KasmVNC 1.3.1.230e50f7b89663316c70de7b0e3db6f6b9340489 and possibly earlier versions allows remote authenticated attacke… |
CVE-2024-37840 | High | 8.8 | 2024-06-17 | SQL injection vulnerability in processscore.php in Itsourcecode Learning Management System Project In PHP With Source Code v1.0 allows remote attackers to exec… |
CVE-2024-36543 | Critical | 9.8 | 2024-06-17 | Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, po… |
CVE-2024-6058 | Low | 3.5 | 2024-06-17 | A vulnerability classified as problematic has been found in LabVantage LIMS 2017. This affects an unknown part of the file /labvantage/rc?command=page&page=Sam… |
CVE-2024-6056 | Low | 3.7 | 2024-06-17 | A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2024-37795 | High | 7.5 | 2024-06-17 | A segmentation fault in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT-LIB input file containing the `set-logic` comm… |
CVE-2024-37794 | High | 7.5 | 2024-06-17 | Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file. |
CVE-2024-37664 | Medium | 5.2 | 2024-06-17 | Redmi router RB03 v1.0.57 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic betwee… |
CVE-2024-37663 | Medium | 4.1 | 2024-06-17 | Redmi router RB03 v1.0.57 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the… |
CVE-2024-37662 | Medium | 6.3 | 2024-06-17 | TP-LINK TL-7DR5130 v1.0.23 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic betwe… |
CVE-2024-37661 | Medium | 6.3 | 2024-06-17 | TP-LINK TL-7DR5130 v1.0.23 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the… |
CVE-2024-36973 | High | 8.4 | 2024-06-17 | In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe() Wh… |
CVE-2024-36527 | Medium | 6.5 | 2024-06-17 | puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive i… |
CVE-2024-36578 | Medium | 5.9 | 2024-06-17 | akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js. |
CVE-2024-36577 | High | 8.3 | 2024-06-17 | apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty. |
CVE-2024-36575 | Critical | 9.8 | 2024-06-17 | A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor. |
CVE-2024-36574 | Medium | 6.3 | 2024-06-17 | A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42) |
CVE-2024-36573 | Critical | 9.8 | 2024-06-17 | almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/inde… |
CVE-2024-0397 | High | 7.4 | 2024-06-17 | A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_cert… |
CVE-2024-4032 | High | 7.5 | 2024-06-17 | The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This… |
CVE-2024-36582 | Critical | 9.8 | 2024-06-17 | alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js) |
CVE-2024-36581 | High | 7.6 | 2024-06-17 | A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm. |
CVE-2024-38470 | Medium | 6.1 | 2024-06-17 | zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /own.php. |
CVE-2024-38469 | Medium | 6.3 | 2024-06-17 | zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php. |
CVE-2024-37848 | High | 8.4 | 2024-06-17 | SQL Injection vulnerability in Online-Bookstore-Project-In-PHP v1.0 allows a local attacker to execute arbitrary code via the admin_delete.php component. |
CVE-2024-37625 | Medium | 6.1 | 2024-06-17 | zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /index.php. |
CVE-2024-37624 | Medium | 6.1 | 2024-06-17 | Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /chajian/inputChajian.php. component. |
CVE-2024-37623 | Medium | 6.1 | 2024-06-17 | Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange.html component. |
CVE-2024-37622 | Medium | 6.1 | 2024-06-17 | Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php. |
CVE-2024-37621 | High | 7.2 | 2024-06-17 | StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/index.blade.php. |
CVE-2024-37620 | Medium | 6.1 | 2024-06-17 | PHPVOD v4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /view/admin/view.php. |
CVE-2024-37619 | Medium | 6.1 | 2024-06-17 | StrongShop v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the spec_group_id parameter at /spec/index.blade.php. |
CVE-2024-37159 | Low | 3.5 | 2024-06-17 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit t… |
CVE-2024-37158 | Low | 3.5 | 2024-06-17 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in… |
CVE-2024-36583 | High | 8.1 | 2024-06-17 | A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index. |
CVE-2024-36580 | Critical | 9.8 | 2024-06-17 | A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code. |
CVE-2024-6057 | Critical | 9.8 | 2024-06-17 | Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an… |
CVE-2024-6055 | Medium | 4.7 | 2024-06-17 | Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an atta… |
CVE-2024-5741 | Medium | 6.5 | 2024-06-17 | Stored XSS in inventory tree rendering in Checkmk before 2.3.0p7, 2.2.0p28, 2.1.0p45 and 2.0.0 (EOL) |
CVE-2024-6048 | Critical | 9.8 | 2024-06-17 | Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker can exploit this vul… |
CVE-2024-36289 | Medium | 5.3 | 2024-06-17 | Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is… |
CVE-2024-36279 | Medium | 5.3 | 2024-06-17 | Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior t… |
CVE-2024-36277 | Medium | 5.3 | 2024-06-17 | Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. The affected ap… |
CVE-2024-5650 | High | 8.5 | 2024-06-17 | DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow able to intrude into… |
CVE-2024-6047 | Critical | 9.8 | 2024-06-17 | Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerabilit… |
CVE-2024-4305 | Medium | 6.8 | 2024-06-17 | The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block options before outputtin… |
CVE-2024-3236 | Medium | 5.4 | 2024-06-17 | The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and… |
CVE-2024-6045 | High | 8.8 | 2024-06-17 | Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the de… |
CVE-2024-6044 | Medium | 6.5 | 2024-06-17 | Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary syst… |
CVE-2024-5163 | Critical | 9.8 | 2024-06-17 | Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks. |
CVE-2024-6043 | High | 7.3 | 2024-06-17 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects the function login of the file ad… |
CVE-2024-6042 | High | 7.3 | 2024-06-17 | A vulnerability was found in itsourcecode Real Estate Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2024-6041 | Medium | 6.3 | 2024-06-16 | A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-6039 | Medium | 6.3 | 2024-06-16 | A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of the component Workspaces. The manipula… |
CVE-2024-34451 | Critical | 9.1 | 2024-06-16 | Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different v… |
CVE-2024-38396 | Critical | 9.8 | 2024-06-16 | An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux inte… |
CVE-2024-38468 | Critical | 9.8 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API. |
CVE-2024-38467 | High | 7.5 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API. |
CVE-2024-38466 | Critical | 9.8 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password. |
CVE-2024-38465 | Medium | 5.3 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus error. |
CVE-2024-38462 | Critical | 9.8 | 2024-06-16 | iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference. |
CVE-2024-38461 | High | 7.5 | 2024-06-16 | irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory. |
CVE-2024-38460 | Medium | 4.9 | 2024-06-16 | In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the UR… |
CVE-2024-38459 | High | 7.8 | 2024-06-16 | langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists bec… |
CVE-2024-38458 | High | 8.8 | 2024-06-16 | Xenforo before 2.2.16 allows code injection. |
CVE-2024-38457 | High | 8.8 | 2024-06-16 | Xenforo before 2.2.16 allows CSRF. |
CVE-2024-38454 | Medium | 6.1 | 2024-06-16 | ExpressionEngine before 7.4.11 allows XSS. |
CVE-2024-38448 | Critical | 9.1 | 2024-06-16 | htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used. |
CVE-2024-38443 | Medium | 6.2 | 2024-06-16 | C/sorting/binary_insertion_sort.c in The Algorithms - C through e5dad3f has a segmentation fault for deep recursion, which may affect common use cases such as… |
CVE-2024-38441 | Critical | 9.8 | 2024-06-16 | Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/… |
CVE-2024-38440 | High | 7.5 | 2024-06-16 | Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in… |
CVE-2024-38439 | Critical | 9.8 | 2024-06-16 | Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc… |
CVE-2024-36397 | Medium | 6.1 | 2024-06-16 | Vantiva - MediaAccess DGA2232 v19.4 - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2024-38428 | Critical | 9.1 | 2024-06-16 | url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was su… |
CVE-2024-38427 | High | 8.8 | 2024-06-16 | In International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTagXml.cpp results in… |
CVE-2024-38395 | Critical | 9.8 | 2024-06-16 | In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploit… |