2024 CVEs (page 261)
Page 261 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5003 | Medium | 5.4 | 2024-06-07 | The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attac… |
CVE-2024-4756 | Medium | 5.4 | 2024-06-07 | The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-4621 | Medium | 4.8 | 2024-06-07 | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privi… |
CVE-2024-4620 | Critical | 9.8 | 2024-06-07 | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP co… |
CVE-2024-4354 | Medium | 6.4 | 2024-06-07 | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3 via… |
CVE-2024-4042 | Medium | 6.4 | 2024-06-07 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-3592 | Critical | 9.9 | 2024-06-07 | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' paramete… |
CVE-2024-3288 | Medium | 5.4 | 2024-06-07 | The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could… |
CVE-2024-5640 | Medium | 6.4 | 2024-06-07 | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-5612 | Medium | 6.4 | 2024-06-07 | The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_lightbox_open_btn_icon’ parameter within… |
CVE-2024-4902 | High | 7.2 | 2024-06-07 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versio… |
CVE-2024-5425 | Medium | 6.4 | 2024-06-07 | The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4… |
CVE-2024-4887 | High | 7.5 | 2024-06-07 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attribute… |
CVE-2024-37385 | Critical | 9.8 | 2024-06-07 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists bec… |
CVE-2024-37384 | Medium | 6.1 | 2024-06-07 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences. |
CVE-2024-37383 | Medium | 6.1 | 2024-06-07 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. |
CVE-2024-36082 | Medium | 6.5 | 2024-06-07 | SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privile… |
CVE-2024-1988 | Medium | 6.4 | 2024-06-07 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-5607 | Medium | 5.4 | 2024-06-07 | The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on s… |
CVE-2024-3987 | Medium | 5.4 | 2024-06-07 | The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions u… |
CVE-2024-1768 | Medium | 6.4 | 2024-06-07 | The Clever Fox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's info box block in all versions up to, and including, 25.2.0 d… |
CVE-2024-1689 | Medium | 4.3 | 2024-06-07 | The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommerce_tool_toggle_… |
CVE-2024-4013 | Medium | 5.6 | 2024-06-06 | A bug exists in the API, mesh_node_power_off(), which fails to copy the contents of the Replay Protection List (RPL) from RAM to NVM before powering down, res… |
CVE-2024-36823 | High | 7.5 | 2024-06-06 | The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information. |
CVE-2024-36775 | Medium | 5.4 | 2024-06-06 | A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2024-36774 | High | 7.2 | 2024-06-06 | An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file. |
CVE-2024-24199 | High | 7.5 | 2024-06-06 | smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/dns.c. |
CVE-2024-24198 | High | 7.5 | 2024-06-06 | smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c. |
CVE-2024-24195 | High | 7.5 | 2024-06-06 | robdns commit d76d2e6 was discovered to contain a misaligned address at /src/zonefile-insertion.c. |
CVE-2024-24194 | High | 7.5 | 2024-06-06 | robdns commit d76d2e6 was discovered to contain a NULL pointer dereference via the item->tokens component at /src/conf-parse.c. |
CVE-2024-24192 | Critical | 9.1 | 2024-06-06 | robdns commit d76d2e6 was discovered to contain a heap overflow via the component block->filename at /src/zonefile-insertion.c. |
CVE-2024-22525 | Medium | 5.5 | 2024-06-06 | dnspod-sr 0dfbd37 contains a SEGV. |
CVE-2024-22524 | Medium | 5.5 | 2024-06-06 | dnspod-sr 0dfbd37 is vulnerable to buffer overflow. |
CVE-2024-36795 | Medium | 4.0 | 2024-06-06 | Insecure permissions in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to access URLs and directories embedded within the firmware via unspecif… |
CVE-2024-32752 | Critical | 9.1 | 2024-06-06 | The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain… |
CVE-2024-22074 | Critical | 9.8 | 2024-06-06 | Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.3116, 1.4.0618 through 1.4.1230, and 1… |
CVE-2024-5552 | High | 7.5 | 2024-06-06 | kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validati… |
CVE-2024-5550 | Medium | 5.3 | 2024-06-06 | In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability a… |
CVE-2024-5478 | Medium | 6.1 | 2024-06-06 | A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata endpoint `/auth/saml/${org?.id}/metadata` of lunary-ai/lunary version 1.2.7. The vulnera… |
CVE-2024-5328 | Critical | 9.3 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the lunary-ai/lunary application, specifically within the endpoint '/auth/saml/tto/download-idp-xm… |
CVE-2024-5307 | Low | 3.3 | 2024-06-06 | Kofax Power PDF AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2024-5306 | High | 7.8 | 2024-06-06 | Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-5305 | High | 7.8 | 2024-06-06 | Kofax Power PDF PDF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2024-5304 | High | 7.8 | 2024-06-06 | Kofax Power PDF TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-5278 | Medium | 6.1 | 2024-06-06 | gaizhenbiao/chuanhuchatgpt is vulnerable to an unrestricted file upload vulnerability due to insufficient validation of uploaded file types in its `/upload` en… |
CVE-2024-5248 | Medium | 6.5 | 2024-06-06 | In lunary-ai/lunary version 1.2.5, an improper access control vulnerability exists due to a missing permission check in the `GET /v1/users/me/org` endpoint. Th… |
CVE-2024-5225 | High | 7.2 | 2024-06-06 | An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerability arises due to… |
CVE-2024-5206 | Medium | 4.7 | 2024-06-06 | A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fi… |
CVE-2024-5187 | High | 8.8 | 2024-06-06 | A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequa… |
CVE-2024-5186 | High | 7.2 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers… |
CVE-2024-5133 | High | 8.1 | 2024-06-06 | In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, whe… |
CVE-2024-5131 | Medium | 6.5 | 2024-06-06 | An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to and including 1.2.2. The vulnerability allows unau… |
CVE-2024-5130 | High | 7.5 | 2024-06-06 | An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any datase… |
CVE-2024-5129 | High | 8.2 | 2024-06-06 | A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The… |
CVE-2024-5128 | High | 8.8 | 2024-06-06 | An Insecure Direct Object Reference (IDOR) vulnerability was identified in lunary-ai/lunary, affecting versions up to and including 1.2.2. This vulnerability a… |
CVE-2024-5126 | Medium | 6.5 | 2024-06-06 | An improper access control vulnerability exists in the lunary-ai/lunary repository, specifically within the versions.patch functionality for updating prompts… |
CVE-2024-5124 | High | 7.5 | 2024-06-06 | A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, specifically within the password comparison logic. The vulnerability is pres… |
CVE-2024-4890 | Medium | 4.9 | 2024-06-06 | A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to… |
CVE-2024-4888 | High | 8.1 | 2024-06-06 | BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An… |
CVE-2024-4881 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0… |
CVE-2024-4851 | High | 7.7 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204, which allows attackers to access internal netwo… |
CVE-2024-4320 | Critical | 9.8 | 2024-06-06 | A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@rou… |
CVE-2024-3429 | Critical | 9.8 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions i… |
CVE-2024-3408 | Critical | 9.8 | 2024-06-06 | man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability ar… |
CVE-2024-3404 | Medium | 6.5 | 2024-06-06 | In gaizhenbiao/chuanhuchatgpt, specifically the version tagged as 20240121, there exists a vulnerability due to improper access control mechanisms. This flaw a… |
CVE-2024-3402 | Medium | 5.4 | 2024-06-06 | A stored Cross-Site Scripting (XSS) vulnerability existed in version (20240121) of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of… |
CVE-2024-3322 | Critical | 9.8 | 2024-06-06 | A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vuln… |
CVE-2024-3234 | Critical | 9.8 | 2024-06-06 | The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed… |
CVE-2024-3166 | Critical | 9.6 | 2024-06-06 | A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of… |
CVE-2024-3153 | Medium | 6.5 | 2024-06-06 | mintplex-labs/anything-llm is affected by an uncontrolled resource consumption vulnerability in its upload file endpoint, leading to a denial of service (DOS)… |
CVE-2024-3150 | High | 8.8 | 2024-06-06 | In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges… |
CVE-2024-3149 | High | 8.8 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manag… |
CVE-2024-3110 | High | 8.7 | 2024-06-06 | A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest befor… |
CVE-2024-3102 | Medium | 5.3 | 2024-06-06 | A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the login process at t… |
CVE-2024-3099 | Medium | 5.4 | 2024-06-06 | A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to… |
CVE-2024-3095 | High | 7.7 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability ar… |
CVE-2024-37364 | Medium | 6.8 | 2024-06-06 | Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensitive information (s… |
CVE-2024-37154 | Medium | 5.3 | 2024-06-06 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees… |
CVE-2024-37153 | High | 7.5 | 2024-06-06 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bu… |
CVE-2024-36740 | High | 7.5 | 2024-06-06 | An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when index as a negative number exceeds the range of size. |
CVE-2024-36735 | Medium | 5.3 | 2024-06-06 | OneFlow-Inc. Oneflow v0.9.1 does not display an error or warning when the oneflow.eye parameter is floating. |
CVE-2024-36734 | High | 7.5 | 2024-06-06 | Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the dim parame… |
CVE-2024-36732 | High | 7.5 | 2024-06-06 | An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.tensordot. |
CVE-2024-36730 | High | 7.5 | 2024-06-06 | Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting negative values into the oneflow.zer… |
CVE-2024-32873 | Low | 3.5 | 2024-06-06 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue a… |
CVE-2024-30373 | High | 7.8 | 2024-06-06 | Kofax Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-2965 | Medium | 4.7 | 2024-06-06 | A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_site… |
CVE-2024-2928 | High | 7.5 | 2024-06-06 | A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerabilit… |
CVE-2024-2624 | Critical | 9.8 | 2024-06-06 | A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_persona… |
CVE-2024-2548 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `lollms_core/lollms/server/endpoints/lollms_binding_fil… |
CVE-2024-2383 | Medium | 6.1 | 2024-06-06 | A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options o… |
CVE-2024-2362 | Critical | 9.1 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Window… |
CVE-2024-2360 | Critical | 9.8 | 2024-06-06 | parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in… |
CVE-2024-2359 | Critical | 9.8 | 2024-06-06 | A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code. The issue arises f… |
CVE-2024-2288 | High | 8.3 | 2024-06-06 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lo… |
CVE-2024-2213 | Low | 3.3 | 2024-06-06 | An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active… |
CVE-2024-2171 | Medium | 4.8 | 2024-06-06 | A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malic… |
CVE-2024-2035 | Medium | 6.5 | 2024-06-06 | An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability… |
CVE-2024-2032 | Low | 3.1 | 2024-06-06 | A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same user… |
CVE-2024-23793 | Medium | 6.3 | 2024-06-06 | The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to… |