2024 CVEs (page 249)
Page 249 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6058 | Low | 3.5 | 2024-06-17 | A vulnerability classified as problematic has been found in LabVantage LIMS 2017. This affects an unknown part of the file /labvantage/rc?command=page&page=Sam… |
CVE-2024-6056 | Low | 3.7 | 2024-06-17 | A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2024-37795 | High | 7.5 | 2024-06-17 | A segmentation fault in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT-LIB input file containing the `set-logic` comm… |
CVE-2024-37794 | High | 7.5 | 2024-06-17 | Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file. |
CVE-2024-37664 | Medium | 5.2 | 2024-06-17 | Redmi router RB03 v1.0.57 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic betwee… |
CVE-2024-37663 | Medium | 4.1 | 2024-06-17 | Redmi router RB03 v1.0.57 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the… |
CVE-2024-37662 | Medium | 6.3 | 2024-06-17 | TP-LINK TL-7DR5130 v1.0.23 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic betwe… |
CVE-2024-37661 | Medium | 6.3 | 2024-06-17 | TP-LINK TL-7DR5130 v1.0.23 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the… |
CVE-2024-36973 | High | 8.4 | 2024-06-17 | In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe() Wh… |
CVE-2024-36527 | Medium | 6.5 | 2024-06-17 | puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive i… |
CVE-2024-36578 | Medium | 5.9 | 2024-06-17 | akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js. |
CVE-2024-36577 | High | 8.3 | 2024-06-17 | apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty. |
CVE-2024-36575 | Critical | 9.8 | 2024-06-17 | A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor. |
CVE-2024-36574 | Medium | 6.3 | 2024-06-17 | A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42) |
CVE-2024-36573 | Critical | 9.8 | 2024-06-17 | almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/inde… |
CVE-2024-0397 | High | 7.4 | 2024-06-17 | A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_cert… |
CVE-2024-4032 | High | 7.5 | 2024-06-17 | The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This… |
CVE-2024-36582 | Critical | 9.8 | 2024-06-17 | alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js) |
CVE-2024-36581 | High | 7.6 | 2024-06-17 | A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm. |
CVE-2024-38470 | Medium | 6.1 | 2024-06-17 | zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /own.php. |
CVE-2024-38469 | Medium | 6.3 | 2024-06-17 | zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php. |
CVE-2024-37848 | High | 8.4 | 2024-06-17 | SQL Injection vulnerability in Online-Bookstore-Project-In-PHP v1.0 allows a local attacker to execute arbitrary code via the admin_delete.php component. |
CVE-2024-37625 | Medium | 6.1 | 2024-06-17 | zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /index.php. |
CVE-2024-37624 | Medium | 6.1 | 2024-06-17 | Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /chajian/inputChajian.php. component. |
CVE-2024-37623 | Medium | 6.1 | 2024-06-17 | Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange.html component. |
CVE-2024-37622 | Medium | 6.1 | 2024-06-17 | Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php. |
CVE-2024-37621 | High | 7.2 | 2024-06-17 | StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/index.blade.php. |
CVE-2024-37620 | Medium | 6.1 | 2024-06-17 | PHPVOD v4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /view/admin/view.php. |
CVE-2024-37619 | Medium | 6.1 | 2024-06-17 | StrongShop v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the spec_group_id parameter at /spec/index.blade.php. |
CVE-2024-37159 | Low | 3.5 | 2024-06-17 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit t… |
CVE-2024-37158 | Low | 3.5 | 2024-06-17 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in… |
CVE-2024-36583 | High | 8.1 | 2024-06-17 | A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index. |
CVE-2024-36580 | Critical | 9.8 | 2024-06-17 | A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code. |
CVE-2024-6057 | Critical | 9.8 | 2024-06-17 | Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an… |
CVE-2024-6055 | Medium | 4.7 | 2024-06-17 | Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an atta… |
CVE-2024-5741 | Medium | 6.5 | 2024-06-17 | Stored XSS in inventory tree rendering in Checkmk before 2.3.0p7, 2.2.0p28, 2.1.0p45 and 2.0.0 (EOL) |
CVE-2024-6048 | Critical | 9.8 | 2024-06-17 | Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker can exploit this vul… |
CVE-2024-36289 | Medium | 5.3 | 2024-06-17 | Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is… |
CVE-2024-36279 | Medium | 5.3 | 2024-06-17 | Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior t… |
CVE-2024-36277 | Medium | 5.3 | 2024-06-17 | Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. The affected ap… |
CVE-2024-5650 | High | 8.5 | 2024-06-17 | DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow able to intrude into… |
CVE-2024-6047 | Critical | 9.8 | 2024-06-17 | Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerabilit… |
CVE-2024-4305 | Medium | 6.8 | 2024-06-17 | The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block options before outputtin… |
CVE-2024-3236 | Medium | 5.4 | 2024-06-17 | The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and… |
CVE-2024-6045 | High | 8.8 | 2024-06-17 | Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the de… |
CVE-2024-6044 | Medium | 6.5 | 2024-06-17 | Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary syst… |
CVE-2024-5163 | Critical | 9.8 | 2024-06-17 | Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks. |
CVE-2024-6043 | High | 7.3 | 2024-06-17 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects the function login of the file ad… |
CVE-2024-6042 | High | 7.3 | 2024-06-17 | A vulnerability was found in itsourcecode Real Estate Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2024-6041 | Medium | 6.3 | 2024-06-16 | A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-6039 | Medium | 6.3 | 2024-06-16 | A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of the component Workspaces. The manipula… |
CVE-2024-34451 | Critical | 9.1 | 2024-06-16 | Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different v… |
CVE-2024-38396 | Critical | 9.8 | 2024-06-16 | An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux inte… |
CVE-2024-38468 | Critical | 9.8 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API. |
CVE-2024-38467 | High | 7.5 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API. |
CVE-2024-38466 | Critical | 9.8 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password. |
CVE-2024-38465 | Medium | 5.3 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus error. |
CVE-2024-38462 | Critical | 9.8 | 2024-06-16 | iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference. |
CVE-2024-38461 | High | 7.5 | 2024-06-16 | irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory. |
CVE-2024-38460 | Medium | 4.9 | 2024-06-16 | In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the UR… |
CVE-2024-38459 | High | 7.8 | 2024-06-16 | langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists bec… |
CVE-2024-38458 | High | 8.8 | 2024-06-16 | Xenforo before 2.2.16 allows code injection. |
CVE-2024-38457 | High | 8.8 | 2024-06-16 | Xenforo before 2.2.16 allows CSRF. |
CVE-2024-38454 | Medium | 6.1 | 2024-06-16 | ExpressionEngine before 7.4.11 allows XSS. |
CVE-2024-38448 | Critical | 9.1 | 2024-06-16 | htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used. |
CVE-2024-38443 | Medium | 6.2 | 2024-06-16 | C/sorting/binary_insertion_sort.c in The Algorithms - C through e5dad3f has a segmentation fault for deep recursion, which may affect common use cases such as… |
CVE-2024-38441 | Critical | 9.8 | 2024-06-16 | Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/… |
CVE-2024-38440 | High | 7.5 | 2024-06-16 | Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in… |
CVE-2024-38439 | Critical | 9.8 | 2024-06-16 | Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc… |
CVE-2024-36397 | Medium | 6.1 | 2024-06-16 | Vantiva - MediaAccess DGA2232 v19.4 - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2024-38428 | Critical | 9.1 | 2024-06-16 | url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was su… |
CVE-2024-38427 | High | 8.8 | 2024-06-16 | In International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTagXml.cpp results in… |
CVE-2024-38395 | Critical | 9.8 | 2024-06-16 | In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploit… |
CVE-2024-38394 | Medium | 4.3 | 2024-06-16 | Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic al… |
CVE-2024-6016 | Medium | 6.3 | 2024-06-15 | A vulnerability, which was classified as critical, has been found in itsourcecode Online Laundry Management System 1.0. Affected by this issue is some unknown… |
CVE-2024-6015 | Medium | 6.3 | 2024-06-15 | A vulnerability classified as critical was found in itsourcecode Online House Rental System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-6014 | Medium | 6.3 | 2024-06-15 | A vulnerability classified as critical has been found in itsourcecode Document Management System 1.0. Affected is an unknown function of the file edithis.php… |
CVE-2024-6013 | Medium | 6.3 | 2024-06-15 | A vulnerability was found in itsourcecode Online Book Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin_de… |
CVE-2024-6009 | Medium | 6.3 | 2024-06-15 | A vulnerability has been found in itsourcecode Event Calendar 1.0 and classified as critical. Affected by this vulnerability is the function regConfirm/regDele… |
CVE-2024-6008 | Medium | 6.3 | 2024-06-15 | A vulnerability, which was classified as critical, was found in itsourcecode Online Book Store up to 1.0. Affected is an unknown function of the file /edit_boo… |
CVE-2024-31870 | Low | 3.3 | 2024-06-15 | IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having a… |
CVE-2024-27275 | High | 7.4 | 2024-06-15 | IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administ… |
CVE-2024-6007 | Medium | 6.3 | 2024-06-15 | A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /protocol/… |
CVE-2024-6006 | Low | 3.5 | 2024-06-15 | A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2024-6005 | Low | 3.5 | 2024-06-15 | A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2024-5611 | Medium | 6.4 | 2024-06-15 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘label_years’ attribute within the Countdown widget i… |
CVE-2024-5858 | Medium | 4.3 | 2024-06-15 | The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_openai_title_gen… |
CVE-2024-4551 | Medium | 6.4 | 2024-06-15 | The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including… |
CVE-2024-4258 | Critical | 9.8 | 2024-06-15 | The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including… |
CVE-2024-4095 | Medium | 6.4 | 2024-06-15 | The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'expand' and 'expandsub' shortcode in all versions up t… |
CVE-2024-3105 | Critical | 9.9 | 2024-06-15 | The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includi… |
CVE-2024-2695 | Medium | 6.4 | 2024-06-15 | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including… |
CVE-2024-1399 | Medium | 6.4 | 2024-06-15 | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s)… |
CVE-2024-6000 | High | 7.1 | 2024-06-15 | The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_t… |
CVE-2024-5871 | Critical | 9.8 | 2024-06-15 | The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of un… |
CVE-2024-5868 | Medium | 6.5 | 2024-06-15 | The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficient… |
CVE-2024-5263 | Medium | 6.4 | 2024-06-15 | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and… |
CVE-2024-4479 | Medium | 6.4 | 2024-06-15 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordion_style attributes… |
CVE-2024-3815 | Medium | 5.5 | 2024-06-15 | The Newspaper theme for WordPress is vulnerable to Stored Cross-Site Scripting via attachment meta in the archive page in all versions up to, and including, 12… |
CVE-2024-3814 | Medium | 5.5 | 2024-06-15 | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to, and including, 4… |