2024 CVEs (page 257)
Page 257 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35671 | Medium | 4.3 | 2024-06-11 | Missing Authorization vulnerability in Minoji MJ Update History.This issue affects MJ Update History: from n/a through 1.0.4. |
CVE-2024-34442 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in weDevs weDocs.This issue affects weDocs: from n/a through 2.1.4. |
CVE-2024-2013 | Critical | 10.0 | 2024-06-11 | An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to in… |
CVE-2024-2012 | Critical | 9.1 | 2024-06-11 | vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on… |
CVE-2024-2011 | High | 8.6 | 2024-06-11 | A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but can be used to execut… |
CVE-2024-28023 | Medium | 5.7 | 2024-06-11 | A vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintended actors, possi… |
CVE-2024-28021 | High | 7.4 | 2024-06-11 | A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation. If exploited an attacker could spoof… |
CVE-2024-5702 | High | 7.5 | 2024-06-11 | Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, an… |
CVE-2024-5701 | Critical | 9.8 | 2024-06-11 | Memory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2024-5700 | High | 7.0 | 2024-06-11 | Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume t… |
CVE-2024-5699 | Critical | 9.8 | 2024-06-11 | In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be checked with a case… |
CVE-2024-5698 | Medium | 6.1 | 2024-06-11 | By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user… |
CVE-2024-5697 | Medium | 4.3 | 2024-06-11 | A website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Firefox. This vulnerability affects Firefox… |
CVE-2024-5696 | High | 8.6 | 2024-06-11 | By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. This vulnerability… |
CVE-2024-5695 | Critical | 9.8 | 2024-06-11 | If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been triggered, and in ra… |
CVE-2024-5694 | High | 7.5 | 2024-06-11 | An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap. This vulnerability affects… |
CVE-2024-5693 | Medium | 6.1 | 2024-06-11 | Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. T… |
CVE-2024-5692 | Medium | 6.5 | 2024-06-11 | On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.ur… |
CVE-2024-5691 | Medium | 4.7 | 2024-06-11 | By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions… |
CVE-2024-5690 | Medium | 4.3 | 2024-06-11 | By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulner… |
CVE-2024-5689 | Medium | 4.3 | 2024-06-11 | In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button that appeared, and direct the user to a… |
CVE-2024-5688 | High | 8.1 | 2024-06-11 | If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. This vulnerability affects Firefox < 12… |
CVE-2024-5687 | Medium | 5.3 | 2024-06-11 | If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The trigge… |
CVE-2024-2462 | | 2024-06-11 | Allow attackers to intercept or falsify data exchanges between the client and the server | |
CVE-2024-2461 | | 2024-06-11 | If exploited an attacker could traverse the file system to access files or directories that would otherwise be inaccessible | |
CVE-2024-36266 | Critical | 9.3 | 2024-06-11 | A vulnerability has been identified in PowerSys (All versions < V3.11). The affected application insufficiently protects responses to authentication requests… |
CVE-2024-35303 | High | 7.8 | 2024-06-11 | A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0012), Tecnomatix Plant Simulation V2404 (All versions < V2404.0… |
CVE-2024-35292 | High | 8.2 | 2024-06-11 | A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (A… |
CVE-2024-35212 | Medium | 6.2 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application lacks input validation due t… |
CVE-2024-35211 | Medium | 5.5 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server, after a successful login, se… |
CVE-2024-35210 | Medium | 5.1 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is not enforcing HSTS. This c… |
CVE-2024-35209 | Medium | 6.2 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is allowing HTTP methods like… |
CVE-2024-35208 | Medium | 6.3 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server stored the password in cleart… |
CVE-2024-35207 | High | 7.8 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The web interface of the affected devices are vulnera… |
CVE-2024-35206 | High | 7.7 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application does not expire the session… |
CVE-2024-33500 | Medium | 5.9 | 2024-06-11 | A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions… |
CVE-2024-5829 | Low | 3.5 | 2024-06-11 | A vulnerability classified as problematic was found in smallweigit Avue up to 3.4.4. Affected by this vulnerability is an unknown functionality of the componen… |
CVE-2024-35685 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in Anders Norén Radcliffe 2.This issue affects Radcliffe 2: from n/a through 2.0.17. |
CVE-2024-34813 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert.This issue affects MC Woocommerce Wishlist: fro… |
CVE-2024-5584 | Medium | 6.4 | 2024-06-11 | The WordPress Online Booking and Scheduling Plugin – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Color Profile parameter i… |
CVE-2024-35716 | Medium | 6.5 | 2024-06-11 | Missing Authorization vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n… |
CVE-2024-35692 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in Termly Cookie Consent.This issue affects Cookie Consent: from n/a through 3.2. |
CVE-2024-34824 | Medium | 4.3 | 2024-06-11 | Missing Authorization vulnerability in ThemeBoy SportsPress – Sports Club & League Manager.This issue affects SportsPress – Sports Club & League Manager: from… |
CVE-2024-24704 | Medium | 5.4 | 2024-06-11 | Missing Authorization vulnerability in AddonMaster Load More Anything.This issue affects Load More Anything: from n/a through 3.3.3. |
CVE-2024-5531 | Medium | 6.4 | 2024-06-11 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flickr widget in all versions up to, and including, 2.2.8 due to insu… |
CVE-2024-4266 | Medium | 5.3 | 2024-06-11 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions… |
CVE-2024-3549 | Critical | 9.9 | 2024-06-11 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up… |
CVE-2024-4319 | Medium | 5.3 | 2024-06-11 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_ex… |
CVE-2024-3723 | Medium | 5.3 | 2024-06-11 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-cont… |
CVE-2024-31402 | Medium | 4.3 | 2024-06-11 | Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared To-Dos. |
CVE-2024-31399 | Medium | 6.5 | 2024-06-11 | Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, processing a crafted m… |
CVE-2024-31398 | Medium | 4.3 | 2024-06-11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to t… |
CVE-2024-31397 | Medium | 4.9 | 2024-06-11 | Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product with… |
CVE-2024-5530 | Medium | 6.4 | 2024-06-11 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Sto… |
CVE-2024-36360 | Critical | 9.8 | 2024-06-11 | OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated att… |
CVE-2024-31404 | Medium | 4.3 | 2024-06-11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view th… |
CVE-2024-31403 | Medium | 5.4 | 2024-06-11 | Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data of Memo. |
CVE-2024-31401 | Critical | 9.0 | 2024-06-11 | Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitr… |
CVE-2024-31400 | Medium | 6.5 | 2024-06-11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, unintended data may be lef… |
CVE-2024-29855 | Critical | 9.0 | 2024-06-11 | Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator |
CVE-2024-5090 | Medium | 6.4 | 2024-06-11 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SiteOrigin Blog Widget in all versions up to… |
CVE-2024-37176 | Medium | 5.5 | 2024-06-11 | SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting i… |
CVE-2024-34691 | Medium | 6.5 | 2024-06-11 | Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of priv… |
CVE-2024-34690 | Medium | 5.4 | 2024-06-11 | SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privilege… |
CVE-2024-34688 | High | 7.5 | 2024-06-11 | Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prev… |
CVE-2024-34686 | Medium | 6.1 | 2024-06-11 | Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victi… |
CVE-2024-34684 | Low | 3.7 | 2024-06-11 | On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to acce… |
CVE-2024-34683 | Medium | 6.5 | 2024-06-11 | An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, mod… |
CVE-2024-33001 | Medium | 6.5 | 2024-06-11 | SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial… |
CVE-2024-2473 | Medium | 5.3 | 2024-06-11 | The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is… |
CVE-2024-28164 | Medium | 5.3 | 2024-06-11 | SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be re… |
CVE-2024-0653 | Medium | 4.4 | 2024-06-11 | The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due… |
CVE-2024-0627 | Medium | 6.4 | 2024-06-11 | The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all versions up to, an… |
CVE-2024-37178 | Medium | 5.0 | 2024-06-11 | SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exp… |
CVE-2024-37177 | High | 8.1 | 2024-06-11 | SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the… |
CVE-2024-37130 | High | 7.3 | 2024-06-11 | Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privilege… |
CVE-2024-22261 | Low | 2.7 | 2024-06-11 | SQL-Injection in Harbor allows priviledge users to leak the task IDs |
CVE-2024-22244 | Medium | 4.3 | 2024-06-10 | Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site. |
CVE-2024-37289 | High | 7.8 | 2024-06-10 | An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note… |
CVE-2024-37169 | Medium | 5.3 | 2024-06-10 | @jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's sc… |
CVE-2024-37168 | Medium | 5.3 | 2024-06-10 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two… |
CVE-2024-37166 | High | 8.9 | 2024-06-10 | ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross… |
CVE-2024-36473 | Medium | 5.3 | 2024-06-10 | Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to local Denial of Servi… |
CVE-2024-36471 | High | 7.5 | 2024-06-10 | Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, whic… |
CVE-2024-36419 | Medium | 4.3 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injec… |
CVE-2024-36359 | Medium | 5.4 | 2024-06-10 | A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to escalate privileges o… |
CVE-2024-36358 | High | 7.8 | 2024-06-10 | A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate privileges on affected… |
CVE-2024-36307 | Medium | 4.7 | 2024-06-10 | A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information… |
CVE-2024-36306 | Medium | 6.1 | 2024-06-10 | A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to create a denial-of-s… |
CVE-2024-36305 | High | 7.8 | 2024-06-10 | A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please… |
CVE-2024-36304 | High | 7.8 | 2024-06-10 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on af… |
CVE-2024-36303 | High | 7.8 | 2024-06-10 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2024-36302 | High | 7.8 | 2024-06-10 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2024-35242 | High | 8.8 | 2024-06-10 | Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg reposito… |
CVE-2024-35241 | High | 8.8 | 2024-06-10 | Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages i… |
CVE-2024-32849 | High | 7.8 | 2024-06-10 | Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileg… |
CVE-2024-36418 | High | 8.5 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allow… |
CVE-2024-33850 | Medium | 4.3 | 2024-06-10 | Pexip Infinity before 34.1 has Improper Access Control for persons in a waiting room. They can see the conference roster list, and perform certain actions that… |
CVE-2024-27885 | Medium | 6.3 | 2024-06-10 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An app ma… |
CVE-2024-27857 | High | 7.8 | 2024-06-10 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visio… |