2024 CVEs (page 250)
Page 250 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38394 | Medium | 4.3 | 2024-06-16 | Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic al… |
CVE-2024-6016 | Medium | 6.3 | 2024-06-15 | A vulnerability, which was classified as critical, has been found in itsourcecode Online Laundry Management System 1.0. Affected by this issue is some unknown… |
CVE-2024-6015 | Medium | 6.3 | 2024-06-15 | A vulnerability classified as critical was found in itsourcecode Online House Rental System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-6014 | Medium | 6.3 | 2024-06-15 | A vulnerability classified as critical has been found in itsourcecode Document Management System 1.0. Affected is an unknown function of the file edithis.php… |
CVE-2024-6013 | Medium | 6.3 | 2024-06-15 | A vulnerability was found in itsourcecode Online Book Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin_de… |
CVE-2024-6009 | Medium | 6.3 | 2024-06-15 | A vulnerability has been found in itsourcecode Event Calendar 1.0 and classified as critical. Affected by this vulnerability is the function regConfirm/regDele… |
CVE-2024-6008 | Medium | 6.3 | 2024-06-15 | A vulnerability, which was classified as critical, was found in itsourcecode Online Book Store up to 1.0. Affected is an unknown function of the file /edit_boo… |
CVE-2024-31870 | Low | 3.3 | 2024-06-15 | IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having a… |
CVE-2024-27275 | High | 7.4 | 2024-06-15 | IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administ… |
CVE-2024-6007 | Medium | 6.3 | 2024-06-15 | A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /protocol/… |
CVE-2024-6006 | Low | 3.5 | 2024-06-15 | A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2024-6005 | Low | 3.5 | 2024-06-15 | A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2024-5611 | Medium | 6.4 | 2024-06-15 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘label_years’ attribute within the Countdown widget i… |
CVE-2024-5858 | Medium | 4.3 | 2024-06-15 | The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_openai_title_gen… |
CVE-2024-4551 | Medium | 6.4 | 2024-06-15 | The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including… |
CVE-2024-4258 | Critical | 9.8 | 2024-06-15 | The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including… |
CVE-2024-4095 | Medium | 6.4 | 2024-06-15 | The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'expand' and 'expandsub' shortcode in all versions up t… |
CVE-2024-3105 | Critical | 9.9 | 2024-06-15 | The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includi… |
CVE-2024-2695 | Medium | 6.4 | 2024-06-15 | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including… |
CVE-2024-1399 | Medium | 6.4 | 2024-06-15 | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s)… |
CVE-2024-6000 | High | 7.1 | 2024-06-15 | The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_t… |
CVE-2024-5871 | Critical | 9.8 | 2024-06-15 | The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of un… |
CVE-2024-5868 | Medium | 6.5 | 2024-06-15 | The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficient… |
CVE-2024-5263 | Medium | 6.4 | 2024-06-15 | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and… |
CVE-2024-4479 | Medium | 6.4 | 2024-06-15 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordion_style attributes… |
CVE-2024-3815 | Medium | 5.5 | 2024-06-15 | The Newspaper theme for WordPress is vulnerable to Stored Cross-Site Scripting via attachment meta in the archive page in all versions up to, and including, 12… |
CVE-2024-3814 | Medium | 5.5 | 2024-06-15 | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to, and including, 4… |
CVE-2024-3813 | High | 8.8 | 2024-06-15 | The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'bl… |
CVE-2024-2544 | High | 7.4 | 2024-06-15 | The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX action… |
CVE-2024-6003 | High | 7.3 | 2024-06-14 | A vulnerability was found in Guangdong Baolun Electronics IP Network Broadcasting Service Platform 2.0. It has been classified as critical. Affected is an unkn… |
CVE-2024-30120 | Low | 2.9 | 2024-06-14 | HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application. |
CVE-2024-30119 | Low | 3.7 | 2024-06-14 | HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data durin… |
CVE-2024-21988 | Medium | 5.3 | 2024-06-14 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information via complex MiTM a… |
CVE-2024-37889 | Medium | 6.5 | 2024-06-14 | MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an… |
CVE-2024-37831 | Critical | 9.8 | 2024-06-14 | Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. |
CVE-2024-36600 | High | 8.4 | 2024-06-14 | Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file. |
CVE-2024-37888 | Medium | 6.1 | 2024-06-14 | The Open Link is a CKEditor plugin, extending context menu with a possibility to open link in a new tab. The vulnerability allowed to execute JavaScript code b… |
CVE-2024-36599 | Medium | 6.1 | 2024-06-14 | A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-36598 | High | 8.1 | 2024-06-14 | An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file. |
CVE-2024-36597 | High | 8.8 | 2024-06-14 | Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php. |
CVE-2024-24320 | High | 8.8 | 2024-06-14 | Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information and execute arbitrar… |
CVE-2024-5659 | Medium | 6.5 | 2024-06-14 | Rockwell Automation was made aware of a vulnerability that causes all affected controllers on the same network to result in a major nonrecoverable fault(MNRF/A… |
CVE-2024-37369 | High | 8.8 | 2024-06-14 | A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lis… |
CVE-2024-37887 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that t… |
CVE-2024-37886 | Medium | 5.4 | 2024-06-14 | user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the c… |
CVE-2024-37885 | Low | 3.8 | 2024-06-14 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS al… |
CVE-2024-37884 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with… |
CVE-2024-37883 | Medium | 4.3 | 2024-06-14 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access… |
CVE-2024-37882 | High | 8.1 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is… |
CVE-2024-37645 | High | 8.8 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow vulnerability via the submit-url parameter at /formSysLog . |
CVE-2024-37643 | High | 8.8 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow vulnerability via the submit-url parameter at /formPasswordAuth . |
CVE-2024-37642 | Critical | 9.1 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /formSystemCheck . |
CVE-2024-37641 | High | 8.8 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule |
CVE-2024-37317 | Medium | 4.6 | 2024-06-14 | The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created use… |
CVE-2024-37316 | Medium | 4.6 | 2024-06-14 | Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for pa… |
CVE-2024-37315 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the f… |
CVE-2024-33373 | Medium | 6.3 | 2024-06-14 | An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for authentication. Th… |
CVE-2024-37644 | High | 8.8 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root. |
CVE-2024-37368 | High | 7.5 | 2024-06-14 | A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to… |
CVE-2024-37367 | High | 7.5 | 2024-06-14 | A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE v12. The vulnerability allows a user from a remote system with FTVie… |
CVE-2024-37314 | Low | 3.5 | 2024-06-14 | Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded… |
CVE-2024-37313 | High | 7.3 | 2024-06-14 | Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providin… |
CVE-2024-37312 | Medium | 6.3 | 2024-06-14 | user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventuall… |
CVE-2024-36656 | Medium | 6.1 | 2024-06-14 | In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack. |
CVE-2024-34694 | High | 8.1 | 2024-06-14 | LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment b… |
CVE-2024-34539 | Critical | 9.4 | 2024-06-14 | Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials ca… |
CVE-2024-33377 | High | 8.1 | 2024-06-14 | LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arb… |
CVE-2024-33375 | Critical | 9.8 | 2024-06-14 | LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware. |
CVE-2024-33374 | Critical | 9.8 | 2024-06-14 | Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access the root terminal without authentication. |
CVE-2024-23442 | Medium | 6.1 | 2024-06-14 | An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. |
CVE-2024-5731 | Medium | 6.8 | 2024-06-14 | A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by man… |
CVE-2024-5671 | Critical | 9.8 | 2024-06-14 | Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vul… |
CVE-2024-37640 | High | 8.8 | 2024-06-14 | TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid5g in the function setWiFiEasyGuestCfg. |
CVE-2024-37639 | High | 8.8 | 2024-06-14 | TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via eport in the function setIpPortFilterRules. |
CVE-2024-37637 | Critical | 9.8 | 2024-06-14 | TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid5g in the function setWizardCfg. |
CVE-2024-2024 | High | 8.8 | 2024-06-14 | The Folders Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_folders_file_upload' function i… |
CVE-2024-2023 | Medium | 4.3 | 2024-06-14 | The Folders and Folders Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0 in Folders and 3.0.2 in Folders… |
CVE-2024-36459 | | 2024-06-14 | A CRLF cross-site scripting vulnerability has been identified in certain configurations of the SiteMinder Web Agent for IIS Web Server and SiteMinder Web Agent… | |
CVE-2024-5685 | High | 7.6 | 2024-06-14 | Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call… |
CVE-2024-3912 | Critical | 9.8 | 2024-06-14 | Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute ar… |
CVE-2024-34012 | Medium | 4.4 | 2024-06-14 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.24135.272. |
CVE-2024-2472 | Critical | 9.1 | 2024-06-14 | The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start… |
CVE-2024-4863 | Medium | 6.4 | 2024-06-14 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titleFont’ parame… |
CVE-2024-37182 | Medium | 4.7 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim ove… |
CVE-2024-36287 | Low | 3.8 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS. |
CVE-2024-25142 | Medium | 5.5 | 2024-06-14 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content… |
CVE-2024-5995 | High | 8.8 | 2024-06-14 | The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly configured, remainin… |
CVE-2024-5961 | | 2024-06-14 | Improper neutralization of input during web page generation vulnerability in 2ClickPortal software allows reflected cross-site scripting (XSS). An attacker mig… | |
CVE-2024-5577 | Critical | 9.8 | 2024-06-14 | The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version <= 1.1.1 via the WIW_HEADER parameter of the /system/in… |
CVE-2024-5465 | Medium | 5.9 | 2024-06-14 | Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-5464 | Medium | 4.0 | 2024-06-14 | Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2024-36503 | High | 7.3 | 2024-06-14 | Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-36502 | High | 7.9 | 2024-06-14 | Out-of-bounds read vulnerability in the audio module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-36501 | Medium | 5.6 | 2024-06-14 | Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect integrity. |
CVE-2024-36500 | High | 7.8 | 2024-06-14 | Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-36499 | Medium | 6.8 | 2024-06-14 | Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-5994 | Medium | 6.4 | 2024-06-14 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions up to, and includin… |
CVE-2024-31163 | High | 7.2 | 2024-06-14 | ASUS Download Master has a buffer overflow vulnerability. An unauthenticated remote attacker with administrative privileges can exploit this vulnerability to e… |
CVE-2024-31162 | High | 7.2 | 2024-06-14 | The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote attacker with administrative privileges… |
CVE-2024-5551 | High | 7.5 | 2024-06-14 | The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This i… |