2024 CVEs (page 261)
Page 261 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-32503 | High | 8.4 | 2024-06-07 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos… |
CVE-2024-37162 | Medium | 4.0 | 2024-06-07 | zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server t… |
CVE-2024-36792 | High | 8.2 | 2024-06-07 | An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to gain access to the router's pin. |
CVE-2024-36790 | High | 8.8 | 2024-06-07 | Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext. |
CVE-2024-36789 | High | 8.1 | 2024-06-07 | An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to create passwords that do not conform to defined security standards. |
CVE-2024-36788 | Medium | 4.8 | 2024-06-07 | Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly intercept and access sensi… |
CVE-2024-36787 | High | 8.8 | 2024-06-07 | An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 allows attackers to bypass authentication and access the administrative interface via unspecified vec… |
CVE-2024-36773 | Medium | 4.8 | 2024-06-07 | A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2024-37160 | Medium | 4.8 | 2024-06-07 | Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying si… |
CVE-2024-31878 | Medium | 5.3 | 2024-06-07 | IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can be used by a malici… |
CVE-2024-5599 | High | 7.5 | 2024-06-07 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin… |
CVE-2024-5542 | High | 7.2 | 2024-06-07 | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-5438 | Medium | 4.3 | 2024-06-07 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2024-5382 | Medium | 6.5 | 2024-06-07 | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification o… |
CVE-2024-36673 | Critical | 9.8 | 2024-06-07 | Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. This vulnerability stems from inadequate validation o… |
CVE-2024-5734 | Medium | 6.3 | 2024-06-07 | A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. Affected is an unknown function of the file /members/poster… |
CVE-2024-5733 | High | 7.3 | 2024-06-07 | A vulnerability was found in itsourcecode Online Discussion Forum 1.0. It has been rated as critical. This issue affects some unknown processing of the file re… |
CVE-2024-4610 | High | 7.8 | 2024-06-07 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU me… |
CVE-2024-5637 | High | 7.5 | 2024-06-07 | The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' function in all ver… |
CVE-2024-5732 | High | 7.3 | 2024-06-07 | A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Po… |
CVE-2024-5645 | Medium | 6.4 | 2024-06-07 | The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_css_id’ parameter within the Button widget in all versions up… |
CVE-2024-5481 | Medium | 6.8 | 2024-06-07 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 vi… |
CVE-2024-5426 | Medium | 6.4 | 2024-06-07 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ parameter in all ver… |
CVE-2024-4703 | Medium | 6.4 | 2024-06-07 | The One Page Express Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's one_page_express_contact_form shortcode in al… |
CVE-2024-4489 | Medium | 6.4 | 2024-06-07 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions u… |
CVE-2024-4488 | Medium | 6.4 | 2024-06-07 | The Royal Elementor Addons and Templates for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘inline_list’ parameter in versions up to, and incl… |
CVE-2024-4451 | Medium | 6.4 | 2024-06-07 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode in all versions up t… |
CVE-2024-5003 | Medium | 5.4 | 2024-06-07 | The WP Stacker WordPress plugin through 1.8.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attac… |
CVE-2024-4756 | Medium | 5.4 | 2024-06-07 | The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-4621 | Medium | 4.8 | 2024-06-07 | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privi… |
CVE-2024-4620 | Critical | 9.8 | 2024-06-07 | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP co… |
CVE-2024-4354 | Medium | 6.4 | 2024-06-07 | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3 via… |
CVE-2024-4042 | Medium | 6.4 | 2024-06-07 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-3592 | Critical | 9.9 | 2024-06-07 | The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' paramete… |
CVE-2024-3288 | Medium | 5.4 | 2024-06-07 | The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could… |
CVE-2024-5640 | Medium | 6.4 | 2024-06-07 | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-5612 | Medium | 6.4 | 2024-06-07 | The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_lightbox_open_btn_icon’ parameter within… |
CVE-2024-4902 | High | 7.2 | 2024-06-07 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versio… |
CVE-2024-5425 | Medium | 6.4 | 2024-06-07 | The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4… |
CVE-2024-4887 | High | 7.5 | 2024-06-07 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attribute… |
CVE-2024-37385 | Critical | 9.8 | 2024-06-07 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists bec… |
CVE-2024-37384 | Medium | 6.1 | 2024-06-07 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences. |
CVE-2024-37383 | Medium | 6.1 | 2024-06-07 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. |
CVE-2024-36082 | Medium | 6.5 | 2024-06-07 | SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privile… |
CVE-2024-1988 | Medium | 6.4 | 2024-06-07 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-5607 | Medium | 5.4 | 2024-06-07 | The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on s… |
CVE-2024-3987 | Medium | 5.4 | 2024-06-07 | The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions u… |
CVE-2024-1768 | Medium | 6.4 | 2024-06-07 | The Clever Fox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's info box block in all versions up to, and including, 25.2.0 d… |
CVE-2024-1689 | Medium | 4.3 | 2024-06-07 | The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommerce_tool_toggle_… |
CVE-2024-4013 | Medium | 5.6 | 2024-06-06 | A bug exists in the API, mesh_node_power_off(), which fails to copy the contents of the Replay Protection List (RPL) from RAM to NVM before powering down, res… |
CVE-2024-36823 | High | 7.5 | 2024-06-06 | The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information. |
CVE-2024-36775 | Medium | 5.4 | 2024-06-06 | A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2024-36774 | High | 7.2 | 2024-06-06 | An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file. |
CVE-2024-24199 | High | 7.5 | 2024-06-06 | smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/dns.c. |
CVE-2024-24198 | High | 7.5 | 2024-06-06 | smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c. |
CVE-2024-24195 | High | 7.5 | 2024-06-06 | robdns commit d76d2e6 was discovered to contain a misaligned address at /src/zonefile-insertion.c. |
CVE-2024-24194 | High | 7.5 | 2024-06-06 | robdns commit d76d2e6 was discovered to contain a NULL pointer dereference via the item->tokens component at /src/conf-parse.c. |
CVE-2024-24192 | Critical | 9.1 | 2024-06-06 | robdns commit d76d2e6 was discovered to contain a heap overflow via the component block->filename at /src/zonefile-insertion.c. |
CVE-2024-22525 | Medium | 5.5 | 2024-06-06 | dnspod-sr 0dfbd37 contains a SEGV. |
CVE-2024-22524 | Medium | 5.5 | 2024-06-06 | dnspod-sr 0dfbd37 is vulnerable to buffer overflow. |
CVE-2024-36795 | Medium | 4.0 | 2024-06-06 | Insecure permissions in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to access URLs and directories embedded within the firmware via unspecif… |
CVE-2024-32752 | Critical | 9.1 | 2024-06-06 | The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain… |
CVE-2024-22074 | Critical | 9.8 | 2024-06-06 | Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.3116, 1.4.0618 through 1.4.1230, and 1… |
CVE-2024-5552 | High | 7.5 | 2024-06-06 | kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validati… |
CVE-2024-5550 | Medium | 5.3 | 2024-06-06 | In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability a… |
CVE-2024-5478 | Medium | 6.1 | 2024-06-06 | A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata endpoint `/auth/saml/${org?.id}/metadata` of lunary-ai/lunary version 1.2.7. The vulnera… |
CVE-2024-5328 | Critical | 9.3 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the lunary-ai/lunary application, specifically within the endpoint '/auth/saml/tto/download-idp-xm… |
CVE-2024-5307 | Low | 3.3 | 2024-06-06 | Kofax Power PDF AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2024-5306 | High | 7.8 | 2024-06-06 | Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-5305 | High | 7.8 | 2024-06-06 | Kofax Power PDF PDF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2024-5304 | High | 7.8 | 2024-06-06 | Kofax Power PDF TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-5278 | Medium | 6.1 | 2024-06-06 | gaizhenbiao/chuanhuchatgpt is vulnerable to an unrestricted file upload vulnerability due to insufficient validation of uploaded file types in its `/upload` en… |
CVE-2024-5248 | Medium | 6.5 | 2024-06-06 | In lunary-ai/lunary version 1.2.5, an improper access control vulnerability exists due to a missing permission check in the `GET /v1/users/me/org` endpoint. Th… |
CVE-2024-5225 | High | 7.2 | 2024-06-06 | An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerability arises due to… |
CVE-2024-5206 | Medium | 4.7 | 2024-06-06 | A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fi… |
CVE-2024-5187 | High | 8.8 | 2024-06-06 | A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequa… |
CVE-2024-5186 | High | 7.2 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers… |
CVE-2024-5133 | High | 8.1 | 2024-06-06 | In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, whe… |
CVE-2024-5131 | Medium | 6.5 | 2024-06-06 | An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to and including 1.2.2. The vulnerability allows unau… |
CVE-2024-5130 | High | 7.5 | 2024-06-06 | An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any datase… |
CVE-2024-5129 | High | 8.2 | 2024-06-06 | A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The… |
CVE-2024-5128 | High | 8.8 | 2024-06-06 | An Insecure Direct Object Reference (IDOR) vulnerability was identified in lunary-ai/lunary, affecting versions up to and including 1.2.2. This vulnerability a… |
CVE-2024-5126 | Medium | 6.5 | 2024-06-06 | An improper access control vulnerability exists in the lunary-ai/lunary repository, specifically within the versions.patch functionality for updating prompts… |
CVE-2024-5124 | High | 7.5 | 2024-06-06 | A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, specifically within the password comparison logic. The vulnerability is pres… |
CVE-2024-4890 | Medium | 4.9 | 2024-06-06 | A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to… |
CVE-2024-4888 | High | 8.1 | 2024-06-06 | BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An… |
CVE-2024-4881 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0… |
CVE-2024-4851 | High | 7.7 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204, which allows attackers to access internal netwo… |
CVE-2024-4320 | Critical | 9.8 | 2024-06-06 | A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@rou… |
CVE-2024-3429 | Critical | 9.8 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions i… |
CVE-2024-3408 | Critical | 9.8 | 2024-06-06 | man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability ar… |
CVE-2024-3404 | Medium | 6.5 | 2024-06-06 | In gaizhenbiao/chuanhuchatgpt, specifically the version tagged as 20240121, there exists a vulnerability due to improper access control mechanisms. This flaw a… |
CVE-2024-3402 | Medium | 5.4 | 2024-06-06 | A stored Cross-Site Scripting (XSS) vulnerability existed in version (20240121) of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of… |
CVE-2024-3322 | Critical | 9.8 | 2024-06-06 | A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vuln… |
CVE-2024-3234 | Critical | 9.8 | 2024-06-06 | The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed… |
CVE-2024-3166 | Critical | 9.6 | 2024-06-06 | A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of… |
CVE-2024-3153 | Medium | 6.5 | 2024-06-06 | mintplex-labs/anything-llm is affected by an uncontrolled resource consumption vulnerability in its upload file endpoint, leading to a denial of service (DOS)… |
CVE-2024-3150 | High | 8.8 | 2024-06-06 | In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges… |
CVE-2024-3149 | High | 8.8 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manag… |
CVE-2024-3110 | High | 8.7 | 2024-06-06 | A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest befor… |