2024 CVEs (page 265)
Page 265 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4332 | | 2024-06-03 | An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use L… | |
CVE-2024-37019 | Critical | 9.8 | 2024-06-03 | Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication. |
CVE-2024-4540 | High | 7.5 | 2024-06-03 | A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RES… |
CVE-2024-36674 | Medium | 6.1 | 2024-06-03 | LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php. |
CVE-2024-32983 | High | 8.2 | 2024-06-03 | Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed Activit… |
CVE-2024-36128 | High | 7.5 | 2024-06-03 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string ge… |
CVE-2024-36127 | High | 7.5 | 2024-06-03 | apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed… |
CVE-2024-36124 | Medium | 5.3 | 2024-06-03 | iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because… |
CVE-2024-36123 | Medium | 6.5 | 2024-06-03 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML… |
CVE-2024-5197 | Critical | 9.1 | 2024-06-03 | There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may resul… |
CVE-2024-36729 | Medium | 6.3 | 2024-06-03 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbit… |
CVE-2024-36728 | High | 8.1 | 2024-06-03 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbit… |
CVE-2024-36569 | High | 8.1 | 2024-06-03 | Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php. |
CVE-2024-36568 | Critical | 9.8 | 2024-06-03 | Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=. |
CVE-2024-0336 | | 2024-06-03 | Missing Authentication for Critical Function vulnerability in EMTA Grup PDKS allows Exploiting Incorrectly Configured Access Control Security Levels. This iss… | |
CVE-2024-35632 | Medium | 4.3 | 2024-06-03 | Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks. Integration for Contact Form 7 and Constant Contact.This issue affects Integration for Contact Fo… |
CVE-2024-34770 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Popup Maker Popup Maker WP popup-maker-wp allows Stored X… |
CVE-2024-34769 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in cyclonetheme Elegant Blocks allows Stored XSS.This… |
CVE-2024-34767 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes ShopLentor allows Stored XSS.This issue… |
CVE-2024-34766 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic ChaosTheory allows Stored XSS.This issu… |
CVE-2024-34385 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Wishlist yith-woocommerce-wishl… |
CVE-2024-35631 | High | 7.1 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Foliovision FV Flowplayer Video Player allows Refl… |
CVE-2024-35630 | High | 7.6 | 2024-06-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LJ Apps WP TripAdvisor Review Slider allows Blind SQL Inj… |
CVE-2024-34803 | Medium | 4.3 | 2024-06-03 | Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25. |
CVE-2024-34801 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mervin Praison Praison SEO WordPress seo-wordpress allows… |
CVE-2024-34798 | Medium | 5.3 | 2024-06-03 | Insertion of Sensitive Information into Log File vulnerability in Lukman Nakib Debug Log – Manger Tool.This issue affects Debug Log – Manger Tool: from n/a thr… |
CVE-2024-34797 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Benoit Mercusot Simple Popup Manager allows Stored… |
CVE-2024-34796 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue… |
CVE-2024-34795 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: f… |
CVE-2024-34794 | High | 7.1 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: f… |
CVE-2024-34793 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kharim Tomlinson WP Next Post Navi allows Stored X… |
CVE-2024-34791 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpbean WPB Elementor Addons allows Stored XSS.This… |
CVE-2024-34790 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hans van Eijsden,niwreg ImageMagick Sharpen Resize… |
CVE-2024-34789 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Hait Post Grid Elementor Addon allows Stored XS… |
CVE-2024-34754 | Medium | 5.3 | 2024-06-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Contact Form Widget.This issue affects Contact Form Widget: from n/a thro… |
CVE-2024-3829 | Critical | 9.1 | 2024-06-03 | qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability b… |
CVE-2024-35635 | Medium | 4.4 | 2024-06-03 | Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9. |
CVE-2024-35633 | Medium | 4.4 | 2024-06-03 | Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through… |
CVE-2024-23670 | High | 7.8 | 2024-06-03 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-23668 | High | 8.8 | 2024-06-03 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-23667 | High | 7.8 | 2024-06-03 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-23665 | Medium | 5.9 | 2024-06-03 | Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3… |
CVE-2024-23664 | Medium | 6.1 | 2024-06-03 | A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow… |
CVE-2024-23363 | High | 7.5 | 2024-06-03 | Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame. |
CVE-2024-23360 | High | 8.4 | 2024-06-03 | Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers. |
CVE-2024-21478 | Medium | 6.2 | 2024-06-03 | transient DOS when setting up a fence callback to free a KGSL memory entry object during DMA. |
CVE-2024-5404 | Critical | 9.8 | 2024-06-03 | An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism. |
CVE-2024-35639 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webliberty Simple Spoiler simple-spoiler.This issue affec… |
CVE-2024-35638 | Medium | 4.3 | 2024-06-03 | Cross-Site Request Forgery (CSRF) vulnerability in JumpDEMAND Inc. ActiveDEMAND.This issue affects ActiveDEMAND: from n/a through 0.2.43. |
CVE-2024-35637 | Medium | 4.4 | 2024-06-03 | Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6. |
CVE-2024-36964 | High | 8.8 | 2024-06-03 | In the Linux kernel, the following vulnerability has been resolved: fs/9p: only translate RWX permissions for plain 9P2000 Garbage in plain 9P2000's perm bit… |
CVE-2024-36963 | High | 7.8 | 2024-06-03 | In the Linux kernel, the following vulnerability has been resolved: tracefs: Reset permissions on remount if permissions are options There's an inconsistency… |
CVE-2024-36962 | High | 7.5 | 2024-06-03 | In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs Currently the drive… |
CVE-2024-36961 | High | 7.8 | 2024-06-03 | In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Fix two locking issues with thermal zone debug With the current thermal… |
CVE-2024-36960 | High | 7.1 | 2024-06-03 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix invalid reads in fence signaled events Correctly set the length of the dr… |
CVE-2024-35640 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tomas Cordero Safety Exit allows Stored XSS.This i… |
CVE-2024-31493 | Medium | 6.5 | 2024-06-03 | An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7… |
CVE-2024-23107 | Medium | 5.5 | 2024-06-03 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and bel… |
CVE-2024-5311 | Critical | 9.8 | 2024-06-03 | DigiWin EasyFlow .NET lacks validation for certain input parameters. An unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and… |
CVE-2024-35643 | Medium | 5.9 | 2024-06-03 | Cross Site Scripting (XSS) vulnerability in Xabier Miranda WP Back Button allows Stored XSS.This issue affects WP Back Button: from n/a through 1.1.3. |
CVE-2024-35642 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bryan Hadaway Site Favicon allows Stored XSS.This… |
CVE-2024-35641 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GregRoss Just Writing Statistics allows Stored XSS… |
CVE-2024-37031 | Medium | 6.1 | 2024-06-03 | The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be late… |
CVE-2024-36042 | Critical | 9.8 | 2024-06-03 | Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with supe… |
CVE-2024-20075 | Medium | 6.7 | 2024-06-03 | In eemgpu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2024-20074 | Medium | 6.6 | 2024-06-03 | In dmc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2024-20073 | Medium | 6.6 | 2024-06-03 | In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System executi… |
CVE-2024-20072 | Medium | 6.6 | 2024-06-03 | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System executio… |
CVE-2024-20071 | Medium | 4.4 | 2024-06-03 | In wlan driver, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution… |
CVE-2024-20070 | Medium | 5.1 | 2024-06-03 | In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation. This could lead to… |
CVE-2024-20069 | Medium | 6.5 | 2024-06-03 | In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check. This could lead to remote informati… |
CVE-2024-20068 | Medium | 5.9 | 2024-06-03 | In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privilege… |
CVE-2024-20067 | Critical | 9.8 | 2024-06-03 | In modem, there is a possible out of bounds write due to improper input invalidation. This could lead to remote denial of service with no additional execution… |
CVE-2024-20066 | High | 7.5 | 2024-06-03 | In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote denial of service with no additional execution pr… |
CVE-2024-20065 | Medium | 4.0 | 2024-06-03 | In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional… |
CVE-2024-5590 | Medium | 6.3 | 2024-06-03 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. This vulnerability affects unknown code of th… |
CVE-2024-5589 | Medium | 6.3 | 2024-06-03 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /a… |
CVE-2024-5588 | Medium | 6.3 | 2024-06-02 | A vulnerability was found in itsourcecode Learning Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-36392 | Medium | 6.1 | 2024-06-02 | MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2024-36391 | Critical | 9.1 | 2024-06-02 | MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic |
CVE-2024-36390 | High | 7.5 | 2024-06-02 | MileSight DeviceHub - CWE-20 Improper Input Validation may allow Denial of Service |
CVE-2024-36389 | Critical | 9.8 | 2024-06-02 | MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass |
CVE-2024-36388 | Critical | 10.0 | 2024-06-02 | MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function |
CVE-2024-27776 | Critical | 9.8 | 2024-06-02 | MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') may allow Unauthenticated RCE |
CVE-2024-2178 | High | 7.5 | 2024-06-02 | A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copy_to_custom_personas' endpoint in the 'lollms_personalities_inf… |
CVE-2024-5587 | Medium | 5.3 | 2024-06-02 | A vulnerability was found in Casdoor up to 1.335.0. It has been classified as problematic. Affected is an unknown function of the file /conf/app.conf of the co… |
CVE-2024-4344 | Medium | 4.3 | 2024-06-02 | The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… |
CVE-2024-35647 | Medium | 5.9 | 2024-06-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Notification Bar allows Stored XSS.This iss… |
CVE-2024-35646 | Medium | 5.9 | 2024-06-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnenschein Smartarget Message Bar smartarget… |
CVE-2024-35645 | Medium | 5.9 | 2024-06-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Random Banner random-banner allows DOM-B… |
CVE-2024-4148 | High | 7.5 | 2024-06-01 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerabi… |
CVE-2024-5348 | High | 8.8 | 2024-06-01 | The Elements For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.1 via the 'beforeafter_layout' at… |
CVE-2024-3821 | High | 7.3 | 2024-06-01 | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capabi… |
CVE-2024-3820 | Critical | 10.0 | 2024-06-01 | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to SQL Injection via the 'id_key' parameter of… |
CVE-2024-3200 | Critical | 9.9 | 2024-06-01 | The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode in all versions up to, and including, 2… |
CVE-2024-35636 | Medium | 4.3 | 2024-06-01 | Cross-Site Request Forgery (CSRF) vulnerability in Uploadcare Uploadcare File Uploader and Adaptive Delivery (beta) uploadcare.This issue affects Uploadcare Fi… |
CVE-2024-4958 | High | 7.1 | 2024-06-01 | The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-2295 | Medium | 6.4 | 2024-06-01 | The Contact Form Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [xyz-cfm-form] shortcode in all versions up to, and… |
CVE-2024-2506 | Medium | 6.4 | 2024-06-01 | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custo… |
CVE-2024-1324 | Medium | 5.3 | 2024-06-01 | The QQWorld Auto Save Images plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the save_remote_images_get_… |