2024 CVEs (page 257)
Page 257 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35292 | High | 8.2 | 2024-06-11 | A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (A… |
CVE-2024-35212 | Medium | 6.2 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application lacks input validation due t… |
CVE-2024-35211 | Medium | 5.5 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server, after a successful login, se… |
CVE-2024-35210 | Medium | 5.1 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is not enforcing HSTS. This c… |
CVE-2024-35209 | Medium | 6.2 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is allowing HTTP methods like… |
CVE-2024-35208 | Medium | 6.3 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server stored the password in cleart… |
CVE-2024-35207 | High | 7.8 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The web interface of the affected devices are vulnera… |
CVE-2024-35206 | High | 7.7 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application does not expire the session… |
CVE-2024-33500 | Medium | 5.9 | 2024-06-11 | A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions… |
CVE-2024-5829 | Low | 3.5 | 2024-06-11 | A vulnerability classified as problematic was found in smallweigit Avue up to 3.4.4. Affected by this vulnerability is an unknown functionality of the componen… |
CVE-2024-35685 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in Anders Norén Radcliffe 2.This issue affects Radcliffe 2: from n/a through 2.0.17. |
CVE-2024-34813 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert.This issue affects MC Woocommerce Wishlist: fro… |
CVE-2024-5584 | Medium | 6.4 | 2024-06-11 | The WordPress Online Booking and Scheduling Plugin – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Color Profile parameter i… |
CVE-2024-35716 | Medium | 6.5 | 2024-06-11 | Missing Authorization vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n… |
CVE-2024-35692 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in Termly Cookie Consent.This issue affects Cookie Consent: from n/a through 3.2. |
CVE-2024-34824 | Medium | 4.3 | 2024-06-11 | Missing Authorization vulnerability in ThemeBoy SportsPress – Sports Club & League Manager.This issue affects SportsPress – Sports Club & League Manager: from… |
CVE-2024-24704 | Medium | 5.4 | 2024-06-11 | Missing Authorization vulnerability in AddonMaster Load More Anything.This issue affects Load More Anything: from n/a through 3.3.3. |
CVE-2024-5531 | Medium | 6.4 | 2024-06-11 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flickr widget in all versions up to, and including, 2.2.8 due to insu… |
CVE-2024-4266 | Medium | 5.3 | 2024-06-11 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions… |
CVE-2024-3549 | Critical | 9.9 | 2024-06-11 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up… |
CVE-2024-4319 | Medium | 5.3 | 2024-06-11 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_ex… |
CVE-2024-3723 | Medium | 5.3 | 2024-06-11 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-cont… |
CVE-2024-31402 | Medium | 4.3 | 2024-06-11 | Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared To-Dos. |
CVE-2024-31399 | Medium | 6.5 | 2024-06-11 | Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, processing a crafted m… |
CVE-2024-31398 | Medium | 4.3 | 2024-06-11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to t… |
CVE-2024-31397 | Medium | 4.9 | 2024-06-11 | Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product with… |
CVE-2024-5530 | Medium | 6.4 | 2024-06-11 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Sto… |
CVE-2024-36360 | Critical | 9.8 | 2024-06-11 | OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated att… |
CVE-2024-31404 | Medium | 4.3 | 2024-06-11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view th… |
CVE-2024-31403 | Medium | 5.4 | 2024-06-11 | Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data of Memo. |
CVE-2024-31401 | Critical | 9.0 | 2024-06-11 | Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitr… |
CVE-2024-31400 | Medium | 6.5 | 2024-06-11 | Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, unintended data may be lef… |
CVE-2024-29855 | Critical | 9.0 | 2024-06-11 | Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator |
CVE-2024-5090 | Medium | 6.4 | 2024-06-11 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SiteOrigin Blog Widget in all versions up to… |
CVE-2024-37176 | Medium | 5.5 | 2024-06-11 | SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting i… |
CVE-2024-34691 | Medium | 6.5 | 2024-06-11 | Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of priv… |
CVE-2024-34690 | Medium | 5.4 | 2024-06-11 | SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privilege… |
CVE-2024-34688 | High | 7.5 | 2024-06-11 | Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prev… |
CVE-2024-34686 | Medium | 6.1 | 2024-06-11 | Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victi… |
CVE-2024-34684 | Low | 3.7 | 2024-06-11 | On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to acce… |
CVE-2024-34683 | Medium | 6.5 | 2024-06-11 | An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, mod… |
CVE-2024-33001 | Medium | 6.5 | 2024-06-11 | SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial… |
CVE-2024-2473 | Medium | 5.3 | 2024-06-11 | The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is… |
CVE-2024-28164 | Medium | 5.3 | 2024-06-11 | SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be re… |
CVE-2024-0653 | Medium | 4.4 | 2024-06-11 | The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due… |
CVE-2024-0627 | Medium | 6.4 | 2024-06-11 | The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all versions up to, an… |
CVE-2024-37178 | Medium | 5.0 | 2024-06-11 | SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exp… |
CVE-2024-37177 | High | 8.1 | 2024-06-11 | SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the… |
CVE-2024-37130 | High | 7.3 | 2024-06-11 | Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privilege… |
CVE-2024-22261 | Low | 2.7 | 2024-06-11 | SQL-Injection in Harbor allows priviledge users to leak the task IDs |
CVE-2024-22244 | Medium | 4.3 | 2024-06-10 | Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site. |
CVE-2024-37289 | High | 7.8 | 2024-06-10 | An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note… |
CVE-2024-37169 | Medium | 5.3 | 2024-06-10 | @jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's sc… |
CVE-2024-37168 | Medium | 5.3 | 2024-06-10 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two… |
CVE-2024-37166 | High | 8.9 | 2024-06-10 | ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross… |
CVE-2024-36473 | Medium | 5.3 | 2024-06-10 | Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to local Denial of Servi… |
CVE-2024-36471 | High | 7.5 | 2024-06-10 | Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, whic… |
CVE-2024-36419 | Medium | 4.3 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injec… |
CVE-2024-36359 | Medium | 5.4 | 2024-06-10 | A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to escalate privileges o… |
CVE-2024-36358 | High | 7.8 | 2024-06-10 | A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate privileges on affected… |
CVE-2024-36307 | Medium | 4.7 | 2024-06-10 | A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information… |
CVE-2024-36306 | Medium | 6.1 | 2024-06-10 | A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to create a denial-of-s… |
CVE-2024-36305 | High | 7.8 | 2024-06-10 | A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please… |
CVE-2024-36304 | High | 7.8 | 2024-06-10 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on af… |
CVE-2024-36303 | High | 7.8 | 2024-06-10 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2024-36302 | High | 7.8 | 2024-06-10 | An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. … |
CVE-2024-35242 | High | 8.8 | 2024-06-10 | Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg reposito… |
CVE-2024-35241 | High | 8.8 | 2024-06-10 | Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages i… |
CVE-2024-32849 | High | 7.8 | 2024-06-10 | Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileg… |
CVE-2024-36418 | High | 8.5 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allow… |
CVE-2024-33850 | Medium | 4.3 | 2024-06-10 | Pexip Infinity before 34.1 has Improper Access Control for persons in a waiting room. They can see the conference roster list, and perform certain actions that… |
CVE-2024-27885 | Medium | 6.3 | 2024-06-10 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An app ma… |
CVE-2024-27857 | High | 7.8 | 2024-06-10 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visio… |
CVE-2024-27855 | High | 8.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, macOS Ventura 1… |
CVE-2024-27851 | High | 8.8 | 2024-06-10 | The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2… |
CVE-2024-27850 | Medium | 6.5 | 2024-06-10 | This issue was addressed with improvements to the noise injection algorithm. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, v… |
CVE-2024-27848 | High | 7.8 | 2024-06-10 | This issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. A malicious app may be able to… |
CVE-2024-27845 | Low | 3.3 | 2024-06-10 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.5 and iPadOS 17.5. An app may be able to access Notes at… |
CVE-2024-27844 | Medium | 5.5 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in Safari 17.5, macOS Sonoma 14.5, visionOS 1.2. A website's permission dialog may persist af… |
CVE-2024-27840 | Medium | 6.3 | 2024-06-10 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, ma… |
CVE-2024-27838 | Medium | 6.5 | 2024-06-10 | The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14… |
CVE-2024-27836 | High | 7.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, visionOS 1.2. Processing a maliciously crafte… |
CVE-2024-27833 | High | 8.8 | 2024-06-10 | An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, t… |
CVE-2024-27832 | High | 7.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app… |
CVE-2024-27831 | High | 7.8 | 2024-06-10 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS… |
CVE-2024-27830 | Medium | 6.5 | 2024-06-10 | This issue was addressed through improved state management. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionO… |
CVE-2024-27828 | High | 7.8 | 2024-06-10 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be ab… |
CVE-2024-27820 | High | 8.8 | 2024-06-10 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma… |
CVE-2024-27819 | Low | 2.4 | 2024-06-10 | The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access ma… |
CVE-2024-27817 | High | 7.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonom… |
CVE-2024-27815 | High | 7.8 | 2024-06-10 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visio… |
CVE-2024-27814 | Low | 2.4 | 2024-06-10 | This issue was addressed through improved state management. This issue is fixed in watchOS 10.5. A person with physical access to a device may be able to view… |
CVE-2024-27812 | Medium | 6.5 | 2024-06-10 | A logic issue was addressed with improved file handling. This issue is fixed in visionOS 1.2. Processing web content may lead to a denial-of-service. |
CVE-2024-27811 | High | 7.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app… |
CVE-2024-27808 | High | 8.8 | 2024-06-10 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2… |
CVE-2024-27807 | Medium | 4.3 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5. An app may be able to circumvent A… |
CVE-2024-27806 | Medium | 5.5 | 2024-06-10 | This issue was addressed with improved environment sanitization. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey… |
CVE-2024-27805 | Medium | 5.5 | 2024-06-10 | An issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS… |
CVE-2024-27802 | High | 7.8 | 2024-06-10 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monter… |
CVE-2024-27801 | High | 7.8 | 2024-06-10 | The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app… |