2024 CVEs (page 255)
Page 255 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0865 | High | 7.8 | 2024-06-12 | CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrative user. |
CVE-2024-5909 | Medium | 5.5 | 2024-06-12 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the a… |
CVE-2024-5908 | High | 7.5 | 2024-06-12 | A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in applicat… |
CVE-2024-5907 | High | 7.0 | 2024-06-12 | A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-5906 | Medium | 4.8 | 2024-06-12 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for… |
CVE-2024-5905 | Medium | 4.4 | 2024-06-12 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local low privileged Windows user to disrupt some… |
CVE-2024-5898 | Medium | 6.3 | 2024-06-12 | A vulnerability was found in itsourcecode Payroll Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-5560 | Medium | 5.3 | 2024-06-12 | CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a specially crafted HT… |
CVE-2024-5558 | Medium | 6.4 | 2024-06-12 | CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could cause escalation of privileges when an attacker abuses a limited adm… |
CVE-2024-5557 | Medium | 4.5 | 2024-06-12 | CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attacker has access to the… |
CVE-2024-37878 | Medium | 6.1 | 2024-06-12 | Cross Site Scripting vulnerability in TWCMS v.2.0.3 allows a remote attacker to execute arbitrary code via the /TWCMS-gh-pages/twcms/runtime/twcms_view/default… |
CVE-2024-37040 | Medium | 5.4 | 2024-06-12 | CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to the device’s web in… |
CVE-2024-37039 | Medium | 5.9 | 2024-06-12 | CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request. |
CVE-2024-37038 | High | 7.5 | 2024-06-12 | CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unautho… |
CVE-2024-37037 | High | 8.1 | 2024-06-12 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticated user with access… |
CVE-2024-37036 | Critical | 9.8 | 2024-06-12 | CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and particular configurat… |
CVE-2024-22855 | Medium | 5.4 | 2024-06-12 | A cross-site scripting (XSS) vulnerability in the User Maintenance section of ITSS iMLog v1.307 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2024-5897 | Medium | 4.3 | 2024-06-12 | A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerabilit… |
CVE-2024-5896 | High | 7.3 | 2024-06-12 | A vulnerability, which was classified as critical, was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is the function save… |
CVE-2024-5759 | Medium | 5.4 | 2024-06-12 | An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and la… |
CVE-2024-37300 | High | 8.1 | 2024-06-12 | OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub < 5.0, when used with `GlobusOAuthentica… |
CVE-2024-36761 | Critical | 9.8 | 2024-06-12 | naga v0.14.0 was discovered to contain a stack overflow via the component /wgsl/parse/mod.rs. |
CVE-2024-1891 | Low | 3.5 | 2024-06-12 | A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web applica… |
CVE-2024-5895 | Medium | 6.3 | 2024-06-12 | A vulnerability, which was classified as critical, has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. This issue affects the f… |
CVE-2024-5894 | High | 7.3 | 2024-06-12 | A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects unknown code of the file manage_product… |
CVE-2024-5893 | Medium | 6.3 | 2024-06-12 | A vulnerability classified as critical has been found in SourceCodester Cab Management System 1.0. This affects an unknown part of the file /cms/classes/Users… |
CVE-2024-37304 | Medium | 6.1 | 2024-06-12 | NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown con… |
CVE-2024-37297 | Medium | 5.4 | 2024-06-12 | WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad acto… |
CVE-2024-36840 | Critical | 9.1 | 2024-06-12 | SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive information via the… |
CVE-2024-36691 | Medium | 6.3 | 2024-06-12 | Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account informati… |
CVE-2024-36265 | Critical | 9.8 | 2024-06-12 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0… |
CVE-2024-34065 | High | 7.1 | 2024-06-12 | Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @s… |
CVE-2024-31217 | Medium | 5.3 | 2024-06-12 | Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing t… |
CVE-2024-2300 | Medium | 6.2 | 2024-06-12 | HP Advance Mobile Applications for iOS and Android are potentially vulnerable to information disclosure when using an outdated version of the application via m… |
CVE-2024-29181 | Low | 2.3 | 2024-06-12 | Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an assoc… |
CVE-2024-28964 | High | 7.8 | 2024-06-12 | Dell Common Event Enabler, version 8.9.10.0 and prior, contain an insecure deserialization vulnerability in CAVATools. A local unauthenticated attacker could p… |
CVE-2024-5891 | Medium | 4.2 | 2024-06-12 | A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having a… |
CVE-2024-36264 | Critical | 9.8 | 2024-06-12 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set `submarine.auth.de… |
CVE-2024-36263 | High | 8.1 | 2024-06-12 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Submarine Server C… |
CVE-2024-23445 | Medium | 6.5 | 2024-06-12 | It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#… |
CVE-2024-1659 | Critical | 9.8 | 2024-06-12 | Arbitrary File Upload vulnerability in MegaBIP software allows attacker to upload any file to the server (including a PHP code file) without an authentication… |
CVE-2024-1577 | Critical | 9.8 | 2024-06-12 | Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by th… |
CVE-2024-1576 | Critical | 9.8 | 2024-06-12 | SQL Injection vulnerability in MegaBIP software allows attacker to obtain site administrator privileges, including access to the administration panel and the a… |
CVE-2024-5313 | Medium | 6.5 | 2024-06-12 | CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This does not allow to dir… |
CVE-2024-25949 | High | 8.8 | 2024-06-12 | Dell OS10 Networking Switches, versions10.5.6.x, 10.5.5.x, 10.5.4.x and 10.5.3.x ,contain an improper authorization vulnerability. A remote authenticated attac… |
CVE-2024-5211 | High | 7.2 | 2024-06-12 | A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the `normalizePath()` function, intended to defend against path traver… |
CVE-2024-5056 | Medium | 6.5 | 2024-06-12 | CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behav… |
CVE-2024-5674 | Medium | 6.5 | 2024-06-12 | The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_… |
CVE-2024-4898 | Critical | 9.8 | 2024-06-12 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on th… |
CVE-2024-3492 | Medium | 6.4 | 2024-06-12 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'event', 'locati… |
CVE-2024-1766 | Medium | 4.4 | 2024-06-12 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.2.86 d… |
CVE-2024-4845 | High | 8.8 | 2024-06-12 | The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘options[list_id]’ parameter in all versions up to, and including, 5.7.22 due t… |
CVE-2024-2092 | Medium | 5.4 | 2024-06-12 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Twitter Widget in all versions up to, and inclu… |
CVE-2024-5742 | Medium | 6.7 | 2024-06-12 | A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file i… |
CVE-2024-5468 | Medium | 6.5 | 2024-06-12 | The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability… |
CVE-2024-5266 | Medium | 6.4 | 2024-06-12 | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packages, wpdm_search_re… |
CVE-2024-5154 | High | 8.1 | 2024-06-12 | A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows th… |
CVE-2024-3183 | High | 8.1 | 2024-06-12 | A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session… |
CVE-2024-3925 | Medium | 6.4 | 2024-06-12 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-2698 | High | 8.8 | 2024-06-12 | A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on… |
CVE-2024-5739 | Medium | 6.1 | 2024-06-12 | The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS (UXSS) vulnerability. This vulnerability allows for cross-site scripti… |
CVE-2024-28970 | Medium | 4.7 | 2024-06-12 | Dell Client BIOS contains an Out-of-bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulne… |
CVE-2024-0160 | Medium | 6.8 | 2024-06-12 | Dell Client Platform contains an incorrect authorization vulnerability. An attacker with physical access to the system could potentially exploit this vulnerabi… |
CVE-2024-5892 | Medium | 6.4 | 2024-06-12 | The Divi Torque Lite – Divi Theme and Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘support_unfiltered_files_upload’ f… |
CVE-2024-4924 | Medium | 6.1 | 2024-06-12 | The Social Sharing Plugin WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-36454 | Medium | 5.3 | 2024-06-12 | Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 and earlier. If this… |
CVE-2024-0427 | Medium | 6.3 | 2024-06-12 | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some o… |
CVE-2024-3559 | Medium | 6.4 | 2024-06-12 | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_content]' parameter versions up to, and includin… |
CVE-2024-5553 | Medium | 4.4 | 2024-06-12 | The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via several parameters in all versions up to, and… |
CVE-2024-4564 | Medium | 6.4 | 2024-06-12 | The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-36856 | High | 7.5 | 2024-06-12 | RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management. An attacker can exhaust system memory and crash the da… |
CVE-2024-5543 | High | 8.1 | 2024-06-12 | The Slideshow Gallery LITE plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.8.1 due… |
CVE-2024-4892 | Medium | 6.4 | 2024-06-12 | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due… |
CVE-2024-4315 | Critical | 9.1 | 2024-06-12 | parisneo/lollms version 9.5 is vulnerable to Local File Inclusion (LFI) attacks due to insufficient path sanitization. The `sanitize_path_from_endpoint` functi… |
CVE-2024-36103 | Medium | 6.8 | 2024-06-12 | OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent attacker with an admi… |
CVE-2024-35225 | Critical | 9.6 | 2024-06-11 | Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of… |
CVE-2024-5847 | High | 8.8 | 2024-06-11 | Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chro… |
CVE-2024-5846 | High | 8.8 | 2024-06-11 | Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chro… |
CVE-2024-5845 | High | 8.8 | 2024-06-11 | Use after free in Audio in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chrom… |
CVE-2024-5844 | High | 8.8 | 2024-06-11 | Heap buffer overflow in Tab Strip in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML… |
CVE-2024-5843 | Medium | 6.5 | 2024-06-11 | Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file. (Chr… |
CVE-2024-5842 | High | 8.8 | 2024-06-11 | Use after free in Browser UI in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perfor… |
CVE-2024-5841 | High | 8.8 | 2024-06-11 | Use after free in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-5840 | Medium | 6.5 | 2024-06-11 | Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromi… |
CVE-2024-5839 | Medium | 6.5 | 2024-06-11 | Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a… |
CVE-2024-5838 | High | 8.8 | 2024-06-11 | Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromiu… |
CVE-2024-5837 | High | 8.8 | 2024-06-11 | Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pa… |
CVE-2024-5836 | High | 8.8 | 2024-06-11 | Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malicious extension to e… |
CVE-2024-5835 | High | 8.8 | 2024-06-11 | Heap buffer overflow in Tab Groups in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2024-5834 | High | 8.8 | 2024-06-11 | Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chro… |
CVE-2024-5833 | High | 8.8 | 2024-06-11 | Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pa… |
CVE-2024-5832 | High | 8.8 | 2024-06-11 | Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2024-5831 | High | 8.8 | 2024-06-11 | Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2024-5830 | High | 8.8 | 2024-06-11 | Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chrom… |
CVE-2024-5646 | Medium | 6.4 | 2024-06-11 | The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘header_size’ attribute within the Advanced Text Block widget in al… |
CVE-2024-4669 | Medium | 6.4 | 2024-06-11 | The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Basic Slider, Upcoming Events, and Schedule widgets in… |
CVE-2024-33606 | High | 8.8 | 2024-06-11 | An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM View… |
CVE-2024-28877 | High | 8.8 | 2024-06-11 | MicroDicom DICOM Viewer is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code on affected installations of DICO… |
CVE-2024-37301 | High | 7.2 | 2024-06-11 | Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are v… |
CVE-2024-36702 | High | 7.4 | 2024-06-11 | libiec61850 v1.5 was discovered to contain a heap overflow via the BerEncoder_encodeLength function at /asn1/ber_encoder.c. |