2024 CVEs (page 263)
Page 263 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-28818 | Medium | 5.9 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280… |
CVE-2024-27382 | Medium | 6.0 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame()… |
CVE-2024-27381 | Medium | 6.0 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame_u… |
CVE-2024-27380 | Medium | 6.0 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_set_delayed_wakeup_… |
CVE-2024-27379 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_subscribe_get_n… |
CVE-2024-27378 | Medium | 6.0 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame_c… |
CVE-2024-27377 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_get_security_in… |
CVE-2024-27376 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_subscribe_get_n… |
CVE-2024-27375 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl… |
CVE-2024-27374 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_publish_get_nl_… |
CVE-2024-27373 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_p… |
CVE-2024-27372 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_p… |
CVE-2024-27371 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl… |
CVE-2024-27370 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_p… |
CVE-2024-5184 | Medium | 6.5 | 2024-06-05 | The EmailGPT service contains a prompt injection vulnerability. The service uses an API service that allows a malicious user to inject a direct prompt and take… |
CVE-2024-5037 | High | 7.5 | 2024-06-05 | A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON… |
CVE-2024-4009 | Critical | 9.2 | 2024-06-05 | Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-Syst… |
CVE-2024-4008 | Critical | 9.6 | 2024-06-05 | FDSK Leak in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to take control via access to local KNX Bus-System |
CVE-2024-36129 | High | 8.2 | 2024-06-05 | The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability… |
CVE-2024-35674 | Medium | 4.3 | 2024-06-05 | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.T… |
CVE-2024-20405 | Medium | 4.8 | 2024-06-05 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploi… |
CVE-2024-20404 | High | 7.2 | 2024-06-05 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected… |
CVE-2024-24790 | Critical | 9.8 | 2024-06-05 | The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return t… |
CVE-2024-24789 | Medium | 5.5 | 2024-06-05 | The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be expl… |
CVE-2024-5629 | Medium | 4.7 | 2024-06-05 | An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception whic… |
CVE-2024-4812 | Medium | 4.8 | 2024-06-05 | A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can… |
CVE-2024-3716 | Medium | 6.2 | 2024-06-05 | A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list an… |
CVE-2024-36837 | High | 7.5 | 2024-06-05 | SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController… |
CVE-2024-35673 | Medium | 4.3 | 2024-06-05 | Cross-Site Request Forgery (CSRF) vulnerability in Pure Chat by Ruby Pure Chat.This issue affects Pure Chat: from n/a through 2.22. |
CVE-2024-5459 | Medium | 4.3 | 2024-06-05 | The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on 'add_section', '… |
CVE-2024-3469 | Medium | 6.1 | 2024-06-05 | The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due t… |
CVE-2024-5526 | High | 7.7 | 2024-06-05 | Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tai… |
CVE-2024-1662 | High | 7.5 | 2024-06-05 | Missing Authentication for Critical Function, Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application allo… |
CVE-2024-4001 | Medium | 6.4 | 2024-06-05 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in all versions up to… |
CVE-2024-5536 | Medium | 6.4 | 2024-06-05 | The GamiPress – Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gamipress_link shortcode in all versions up to, and inc… |
CVE-2024-5571 | Medium | 6.4 | 2024-06-05 | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress… |
CVE-2024-4821 | Medium | 6.4 | 2024-06-05 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all… |
CVE-2024-4743 | High | 8.8 | 2024-06-05 | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlms_favorites sho… |
CVE-2024-1272 | High | 7.5 | 2024-06-05 | Inclusion of Sensitive Information in Source Code vulnerability in TNB Mobile Solutions Cockpit Software allows Retrieve Embedded Sensitive Data. This issue a… |
CVE-2024-5453 | Medium | 4.3 | 2024-06-05 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2024-5439 | Medium | 6.4 | 2024-06-05 | The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and including, 2.0.50 due t… |
CVE-2024-5006 | Medium | 6.4 | 2024-06-05 | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up… |
CVE-2024-4939 | Medium | 6.4 | 2024-06-05 | The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all versions up to, and inc… |
CVE-2024-23669 | Medium | 6.5 | 2024-06-05 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-5222 | Medium | 6.4 | 2024-06-05 | The Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. plugin for WordPress is vulnerable to Stored Cross-S… |
CVE-2024-4088 | Medium | 4.3 | 2024-06-05 | The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-2368 | Medium | 4.3 | 2024-06-05 | The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due to missing or incor… |
CVE-2024-1164 | Medium | 6.4 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error message and redirect URL… |
CVE-2024-4886 | Medium | 4.3 | 2024-06-05 | The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request |
CVE-2024-4295 | Critical | 9.8 | 2024-06-05 | The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, and including, 5.7… |
CVE-2024-3667 | High | 7.4 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in all versions up to, a… |
CVE-2024-2087 | High | 7.2 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form name values in all versions up to, and including, 2.4.4… |
CVE-2024-1940 | High | 7.1 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content in all versions up to, and including, 2.4.41 due to… |
CVE-2024-1161 | Medium | 6.4 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes for blocks in all versions up to… |
CVE-2024-5149 | Medium | 6.5 | 2024-06-05 | The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently ran… |
CVE-2024-34055 | Medium | 6.5 | 2024-06-05 | Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single c… |
CVE-2024-5262 | Critical | 9.8 | 2024-06-05 | Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files… |
CVE-2024-5483 | Medium | 5.3 | 2024-06-05 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to… |
CVE-2024-5317 | Medium | 6.4 | 2024-06-05 | The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions up to, and including, 8.3.4 due to ins… |
CVE-2024-5636 | Medium | 6.3 | 2024-06-05 | A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2024-4084 | High | 7.5 | 2024-06-05 | A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix in… |
CVE-2024-5635 | Medium | 6.3 | 2024-06-04 | A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2024-36675 | Critical | 9.1 | 2024-06-04 | LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function. |
CVE-2024-36121 | Medium | 5.9 | 2024-06-04 | netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this s… |
CVE-2024-30889 | Medium | 5.4 | 2024-06-04 | Cross Site Scripting vulnerability in audimex audimexEE v.15.1.2 and fixed in 15.1.3.9 allows a remote attacker to execute arbitrary code via the service, meth… |
CVE-2024-4220 | Medium | 4.3 | 2024-06-04 | Prior to 23.1, an information disclosure vulnerability exists within BeyondInsight which can allow an attacker to enumerate usernames. |
CVE-2024-4219 | Medium | 4.8 | 2024-06-04 | Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a server-side request forg… |
CVE-2024-34364 | Medium | 5.7 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will… |
CVE-2024-34363 | High | 7.5 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception… |
CVE-2024-34362 | Medium | 5.9 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in `HttpConnectionManager` (HCM) with `EnvoyQuicServerStream` that can c… |
CVE-2024-32976 | High | 7.5 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data w… |
CVE-2024-32975 | Medium | 5.9 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. There is a crash at `QuicheDataReader::PeekVarInt62Length()`. It is caused by integer underflow in… |
CVE-2024-32974 | Medium | 5.9 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call st… |
CVE-2024-23326 | Medium | 5.9 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into… |
CVE-2024-4520 | High | 7.5 | 2024-06-04 | An improper access control vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically in version 20240410. This vulnerability allows any… |
CVE-2024-32464 | Medium | 6.1 | 2024-06-04 | Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could po… |
CVE-2024-30528 | Medium | 5.4 | 2024-06-04 | Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10. |
CVE-2024-30525 | Medium | 5.3 | 2024-06-04 | Missing Authorization vulnerability in moveaddons Move Addons for Elementor.This issue affects Move Addons for Elementor: from n/a through 1.2.9. |
CVE-2024-28103 | Medium | 5.4 | 2024-06-04 | Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on response… |
CVE-2024-37273 | Critical | 9.8 | 2024-06-04 | An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2024-36858 | Critical | 9.8 | 2024-06-04 | An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2024-36857 | High | 7.5 | 2024-06-04 | Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface. |
CVE-2024-36604 | Critical | 9.8 | 2024-06-04 | Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerability allows attackers… |
CVE-2024-35672 | High | 7.5 | 2024-06-04 | Missing Authorization vulnerability in Netgsm.This issue affects Netgsm: from n/a through 2.9.19. |
CVE-2024-35670 | Medium | 5.3 | 2024-06-04 | Broken Authentication vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.93. |
CVE-2024-34759 | Medium | 6.5 | 2024-06-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VideoWhisper Picture Gallery allows Stored XSS.Thi… |
CVE-2024-30484 | Medium | 4.3 | 2024-06-04 | Missing Authorization vulnerability in RT Easy Builder – Advanced addons for Elementor.This issue affects RT Easy Builder – Advanced addons for Elementor: from… |
CVE-2024-29152 | Medium | 5.9 | 2024-06-04 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280… |
CVE-2024-25095 | High | 7.5 | 2024-06-04 | Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a t… |
CVE-2024-36550 | High | 8.8 | 2024-06-04 | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=add&nohrefStr=close |
CVE-2024-36549 | High | 8.8 | 2024-06-04 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=rev&nohrefStr=close |
CVE-2024-36548 | High | 8.8 | 2024-06-04 | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/vpsCompany_deal.php?mudi=del |
CVE-2024-36547 | High | 8.8 | 2024-06-04 | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=add |
CVE-2024-36400 | Critical | 9.4 | 2024-06-04 | nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_i… |
CVE-2024-35653 | Medium | 6.5 | 2024-06-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcom… |
CVE-2024-35652 | High | 7.1 | 2024-06-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saso Nikolov Event Tickets with Ticket Scanner all… |
CVE-2024-35651 | Medium | 6.5 | 2024-06-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus allows Stored XSS.This… |
CVE-2024-35649 | Medium | 6.5 | 2024-06-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Sto… |
CVE-2024-32871 | High | 7.5 | 2024-06-04 | Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing… |
CVE-2024-29004 | High | 7.1 | 2024-06-04 | The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user… |