2024 CVEs (page 262)
Page 262 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-3102 | Medium | 5.3 | 2024-06-06 | A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the login process at t… |
CVE-2024-3099 | Medium | 5.4 | 2024-06-06 | A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to… |
CVE-2024-3095 | High | 7.7 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability ar… |
CVE-2024-37364 | Medium | 6.8 | 2024-06-06 | Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensitive information (s… |
CVE-2024-37154 | Medium | 5.3 | 2024-06-06 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees… |
CVE-2024-37153 | High | 7.5 | 2024-06-06 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bu… |
CVE-2024-36740 | High | 7.5 | 2024-06-06 | An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when index as a negative number exceeds the range of size. |
CVE-2024-36735 | Medium | 5.3 | 2024-06-06 | OneFlow-Inc. Oneflow v0.9.1 does not display an error or warning when the oneflow.eye parameter is floating. |
CVE-2024-36734 | High | 7.5 | 2024-06-06 | Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the dim parame… |
CVE-2024-36732 | High | 7.5 | 2024-06-06 | An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.tensordot. |
CVE-2024-36730 | High | 7.5 | 2024-06-06 | Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting negative values into the oneflow.zer… |
CVE-2024-32873 | Low | 3.5 | 2024-06-06 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue a… |
CVE-2024-30373 | High | 7.8 | 2024-06-06 | Kofax Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-2965 | Medium | 4.7 | 2024-06-06 | A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_site… |
CVE-2024-2928 | High | 7.5 | 2024-06-06 | A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerabilit… |
CVE-2024-2624 | Critical | 9.8 | 2024-06-06 | A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_persona… |
CVE-2024-2548 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `lollms_core/lollms/server/endpoints/lollms_binding_fil… |
CVE-2024-2383 | Medium | 6.1 | 2024-06-06 | A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options o… |
CVE-2024-2362 | Critical | 9.1 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Window… |
CVE-2024-2360 | Critical | 9.8 | 2024-06-06 | parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in… |
CVE-2024-2359 | Critical | 9.8 | 2024-06-06 | A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code. The issue arises f… |
CVE-2024-2288 | High | 8.3 | 2024-06-06 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lo… |
CVE-2024-2213 | Low | 3.3 | 2024-06-06 | An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active… |
CVE-2024-2171 | Medium | 4.8 | 2024-06-06 | A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malic… |
CVE-2024-2035 | Medium | 6.5 | 2024-06-06 | An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability… |
CVE-2024-2032 | Low | 3.1 | 2024-06-06 | A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same user… |
CVE-2024-23793 | Medium | 6.3 | 2024-06-06 | The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to… |
CVE-2024-22326 | Medium | 5.0 | 2024-06-06 | IBM System Storage DS8900F 89.22.19.0, 89.30.68.0, 89.32.40.0, 89.33.48.0, 89.40.83.0, and 89.40.93.0 could allow a remote user to create an LDAP connection wi… |
CVE-2024-1881 | Critical | 9.8 | 2024-06-06 | AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements used in an OS command ('OS Command Inject… |
CVE-2024-1880 | High | 7.8 | 2024-06-06 | An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecting versions up to v… |
CVE-2024-1873 | Critical | 9.1 | 2024-06-06 | parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpo… |
CVE-2024-0520 | High | 8.8 | 2024-06-06 | A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Comm… |
CVE-2024-5509 | High | 7.8 | 2024-06-06 | Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2024-5508 | High | 7.8 | 2024-06-06 | Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2024-5507 | High | 7.8 | 2024-06-06 | Luxion KeyShot Viewer KSP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2024-5506 | High | 7.8 | 2024-06-06 | Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2024-5505 | High | 8.8 | 2024-06-06 | NETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-5482 | Critical | 9.8 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the 'add_webpage' endpoint of the parisneo/lollms-webui application, affecting the latest version… |
CVE-2024-5452 | Critical | 9.8 | 2024-06-06 | A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user in… |
CVE-2024-5303 | High | 7.8 | 2024-06-06 | Kofax Power PDF PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-5302 | High | 7.8 | 2024-06-06 | Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-5301 | High | 7.8 | 2024-06-06 | Kofax Power PDF PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2024-5277 | High | 7.5 | 2024-06-06 | In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This… |
CVE-2024-5269 | High | 8.8 | 2024-06-06 | Sonos Era 100 SMB2 Message Handling Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitra… |
CVE-2024-5268 | Medium | 6.5 | 2024-06-06 | Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose s… |
CVE-2024-5267 | High | 8.8 | 2024-06-06 | Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute ar… |
CVE-2024-5256 | Medium | 4.3 | 2024-06-06 | Sonos Era 100 SMB2 Message Handling Integer Underflow Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose se… |
CVE-2024-5127 | Medium | 5.4 | 2024-06-06 | In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign th… |
CVE-2024-4941 | High | 7.5 | 2024-06-06 | A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in… |
CVE-2024-4889 | High | 7.2 | 2024-06-06 | A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the s… |
CVE-2024-4325 | High | 8.6 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save… |
CVE-2024-3504 | Medium | 6.5 | 2024-06-06 | An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the… |
CVE-2024-3152 | High | 8.8 | 2024-06-06 | mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulne… |
CVE-2024-3104 | Critical | 9.8 | 2024-06-06 | A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulner… |
CVE-2024-3033 | Critical | 9.4 | 2024-06-06 | An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. Th… |
CVE-2024-36745 | High | 7.5 | 2024-06-06 | An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the oneflow.index_select parame… |
CVE-2024-36743 | High | 7.5 | 2024-06-06 | An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.dot. |
CVE-2024-36737 | High | 7.5 | 2024-06-06 | Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the oneflow.fu… |
CVE-2024-36736 | Critical | 9.8 | 2024-06-06 | An issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9.1 causes an incorrect calculation when the same dimension operation is performed. |
CVE-2024-30375 | High | 7.8 | 2024-06-06 | Luxion KeyShot Viewer KSP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-30374 | High | 7.8 | 2024-06-06 | Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2024-30369 | High | 7.8 | 2024-06-06 | A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on a… |
CVE-2024-30368 | High | 8.8 | 2024-06-06 | A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2024-2914 | High | 8.8 | 2024-06-06 | A TarSlip vulnerability exists in the deepjavalibrary/djl, affecting version 0.26.0 and fixed in version 0.27.0. This vulnerability allows an attacker to manip… |
CVE-2024-1879 | High | 8.8 | 2024-06-06 | A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT… |
CVE-2024-36742 | High | 7.5 | 2024-06-06 | An issue in the oneflow.scatter_nd parameter OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when index parameter exceeds the r… |
CVE-2024-33655 | High | 7.5 | 2024-06-06 | The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumul… |
CVE-2024-37156 | Medium | 6.1 | 2024-06-06 | The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input fie… |
CVE-2024-37152 | Medium | 5.3 | 2024-06-06 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /a… |
CVE-2024-37150 | High | 7.6 | 2024-06-06 | An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provid… |
CVE-2024-36399 | High | 8.2 | 2024-06-06 | Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(… |
CVE-2024-35178 | High | 7.5 | 2024-06-06 | The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak th… |
CVE-2024-36106 | Medium | 4.3 | 2024-06-06 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting err… |
CVE-2024-34832 | Critical | 9.8 | 2024-06-06 | Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to the _g and node pa… |
CVE-2024-5684 | Medium | 6.3 | 2024-06-06 | An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty implementation of t… |
CVE-2024-5675 | Critical | 10.0 | 2024-06-06 | Untrusted data deserialization vulnerability has been found in Mentor - Employee Portal, affecting version 3.83.35. This vulnerability could allow an attacker… |
CVE-2024-36779 | Critical | 9.8 | 2024-06-06 | Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php. |
CVE-2024-5489 | Medium | 4.3 | 2024-06-06 | The Wbcom Designs – Custom Font Uploader plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cfu_delete_c… |
CVE-2024-5673 | Medium | 6.1 | 2024-06-06 | Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fm_current_dir parameter of index.php… |
CVE-2024-5658 | Medium | 4.8 | 2024-06-06 | The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period. |
CVE-2024-5657 | Low | 3.7 | 2024-06-06 | The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitti… |
CVE-2024-5188 | Medium | 6.4 | 2024-06-06 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-5038 | Medium | 6.4 | 2024-06-06 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including… |
CVE-2024-5329 | High | 8.8 | 2024-06-06 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘data[addonID]’ parame… |
CVE-2024-5259 | Medium | 6.4 | 2024-06-06 | The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hover_an… |
CVE-2024-5221 | Medium | 6.4 | 2024-06-06 | The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 1.2.9 due… |
CVE-2024-36394 | Critical | 9.1 | 2024-06-06 | SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
CVE-2024-36393 | Critical | 9.9 | 2024-06-06 | SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
CVE-2024-28995 | High | 8.6 | 2024-06-06 | SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. |
CVE-2024-5665 | Medium | 4.3 | 2024-06-06 | The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the… |
CVE-2024-4177 | High | 8.1 | 2024-06-06 | A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This… |
CVE-2024-3049 | Medium | 5.9 | 2024-06-06 | A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accep… |
CVE-2024-5615 | Medium | 5.3 | 2024-06-06 | The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'opengraph_default_des… |
CVE-2024-5449 | Medium | 4.3 | 2024-06-06 | The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unau… |
CVE-2024-5162 | Medium | 6.4 | 2024-06-06 | The WordPress prettyPhoto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.2.3… |
CVE-2024-5161 | Medium | 6.4 | 2024-06-06 | The Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) plugin for WordPress is vulnerable to Stored Cr… |
CVE-2024-5153 | Critical | 9.1 | 2024-06-06 | The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' p… |
CVE-2024-5152 | Medium | 6.4 | 2024-06-06 | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and inc… |
CVE-2024-5141 | Medium | 6.4 | 2024-06-06 | The Rotating Tweets (Twitter widget and shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's' 'rotatingtweets' in all… |
CVE-2024-4707 | Medium | 6.4 | 2024-06-06 | The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions u… |