2024 CVEs (page 266)
Page 266 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20066 | High | 7.5 | 2024-06-03 | In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote denial of service with no additional execution pr… |
CVE-2024-20065 | Medium | 4.0 | 2024-06-03 | In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional… |
CVE-2024-5590 | Medium | 6.3 | 2024-06-03 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. This vulnerability affects unknown code of th… |
CVE-2024-5589 | Medium | 6.3 | 2024-06-03 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /a… |
CVE-2024-5588 | Medium | 6.3 | 2024-06-02 | A vulnerability was found in itsourcecode Learning Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-36392 | Medium | 6.1 | 2024-06-02 | MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2024-36391 | Critical | 9.1 | 2024-06-02 | MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic |
CVE-2024-36390 | High | 7.5 | 2024-06-02 | MileSight DeviceHub - CWE-20 Improper Input Validation may allow Denial of Service |
CVE-2024-36389 | Critical | 9.8 | 2024-06-02 | MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass |
CVE-2024-36388 | Critical | 10.0 | 2024-06-02 | MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function |
CVE-2024-27776 | Critical | 9.8 | 2024-06-02 | MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') may allow Unauthenticated RCE |
CVE-2024-2178 | High | 7.5 | 2024-06-02 | A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copy_to_custom_personas' endpoint in the 'lollms_personalities_inf… |
CVE-2024-5587 | Medium | 5.3 | 2024-06-02 | A vulnerability was found in Casdoor up to 1.335.0. It has been classified as problematic. Affected is an unknown function of the file /conf/app.conf of the co… |
CVE-2024-4344 | Medium | 4.3 | 2024-06-02 | The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… |
CVE-2024-35647 | Medium | 5.9 | 2024-06-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Notification Bar allows Stored XSS.This iss… |
CVE-2024-35646 | Medium | 5.9 | 2024-06-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnenschein Smartarget Message Bar smartarget… |
CVE-2024-35645 | Medium | 5.9 | 2024-06-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Random Banner random-banner allows DOM-B… |
CVE-2024-4148 | High | 7.5 | 2024-06-01 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerabi… |
CVE-2024-5348 | High | 8.8 | 2024-06-01 | The Elements For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.1 via the 'beforeafter_layout' at… |
CVE-2024-3821 | High | 7.3 | 2024-06-01 | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capabi… |
CVE-2024-3820 | Critical | 10.0 | 2024-06-01 | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to SQL Injection via the 'id_key' parameter of… |
CVE-2024-3200 | Critical | 9.9 | 2024-06-01 | The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode in all versions up to, and including, 2… |
CVE-2024-35636 | Medium | 4.3 | 2024-06-01 | Cross-Site Request Forgery (CSRF) vulnerability in Uploadcare Uploadcare File Uploader and Adaptive Delivery (beta) uploadcare.This issue affects Uploadcare Fi… |
CVE-2024-4958 | High | 7.1 | 2024-06-01 | The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-2295 | Medium | 6.4 | 2024-06-01 | The Contact Form Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [xyz-cfm-form] shortcode in all versions up to, and… |
CVE-2024-2506 | Medium | 6.4 | 2024-06-01 | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custo… |
CVE-2024-1324 | Medium | 5.3 | 2024-06-01 | The QQWorld Auto Save Images plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the save_remote_images_get_… |
CVE-2024-5501 | Medium | 6.4 | 2024-06-01 | The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_one_id’ p… |
CVE-2024-4342 | Medium | 6.4 | 2024-06-01 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, image accordion, off… |
CVE-2024-4087 | Medium | 6.4 | 2024-06-01 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Back to Top widget in all versions… |
CVE-2024-3565 | Medium | 6.4 | 2024-06-01 | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_block' shortcode in all ver… |
CVE-2024-3564 | High | 8.8 | 2024-06-01 | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the plugin's… |
CVE-2024-4711 | Medium | 6.4 | 2024-06-01 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajax_load_more shortcode in versions u… |
CVE-2024-2933 | Medium | 6.4 | 2024-06-01 | The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Social Profiles widget in all versions u… |
CVE-2024-5138 | High | 8.1 | 2024-05-31 | The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was fo… |
CVE-2024-34009 | High | 7.5 | 2024-05-31 | Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is u… |
CVE-2024-34008 | High | 8.8 | 2024-05-31 | Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk. |
CVE-2024-34007 | High | 8.8 | 2024-05-31 | The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF. |
CVE-2024-34006 | Medium | 4.3 | 2024-05-31 | The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered. |
CVE-2024-34005 | Medium | 6.5 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activit… |
CVE-2024-34004 | Medium | 6.5 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and… |
CVE-2024-34003 | Medium | 5.9 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules… |
CVE-2024-34002 | Medium | 6.5 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules… |
CVE-2024-36845 | Medium | 4.3 | 2024-05-31 | An invalid pointer in the modbus_receive() function of libmodbus v3.1.6 allows attackers to cause a Denial of Service (DoS) via a crafted message sent to the u… |
CVE-2024-36844 | High | 7.5 | 2024-05-31 | libmodbus v3.1.6 was discovered to contain a use-after-free via the ctx->backend pointer. This vulnerability allows attackers to cause a Denial of Service (DoS… |
CVE-2024-36843 | High | 7.5 | 2024-05-31 | libmodbus v3.1.6 was discovered to contain a heap overflow via the modbus_mapping_free() function. |
CVE-2024-34001 | High | 8.4 | 2024-05-31 | Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk. |
CVE-2024-34000 | Medium | 4.3 | 2024-05-31 | ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk. |
CVE-2024-33999 | Critical | 9.8 | 2024-05-31 | The referrer URL used by MFA required additional sanitizing, rather than being used directly. |
CVE-2024-33998 | Medium | 5.4 | 2024-05-31 | Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features. |
CVE-2024-33997 | Medium | 6.1 | 2024-05-31 | Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation. |
CVE-2024-33996 | Medium | 6.2 | 2024-05-31 | Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have p… |
CVE-2024-5564 | High | 8.1 | 2024-05-31 | A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv… |
CVE-2024-23316 | | 2024-05-31 | HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header reque… | |
CVE-2024-5176 | | 2024-05-31 | Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This issue affect… | |
CVE-2024-35196 | Low | 2.0 | 2024-05-31 | Sentry is a developer-first error tracking and performance monitoring platform. Sentry's Slack integration incorrectly records the incoming request body in log… |
CVE-2024-31030 | Critical | 9.1 | 2024-05-31 | An issue in coap_msg.c in Keith Cullen's FreeCoAP v.0.7 allows remote attackers to cause a Denial of Service or potentially disclose information via a speciall… |
CVE-2024-29848 | High | 7.2 | 2024-05-31 | An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary comma… |
CVE-2024-29846 | High | 8.0 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute… |
CVE-2024-29830 | High | 8.0 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute… |
CVE-2024-29829 | High | 8.0 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute… |
CVE-2024-29828 | High | 8.0 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute… |
CVE-2024-29827 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-29826 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-29825 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-29824 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-29823 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-29822 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-22060 | Medium | 4.9 | 2024-05-31 | An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user to write arbitrary f… |
CVE-2024-22059 | High | 8.8 | 2024-05-31 | A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete information in the underlyin… |
CVE-2024-22058 | High | 7.8 | 2024-05-31 | A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in Ivan… |
CVE-2024-1275 | | 2024-05-31 | Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects We… | |
CVE-2024-36120 | High | 8.1 | 2024-05-31 | javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to… |
CVE-2024-35142 | High | 8.4 | 2024-05-31 | IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges. IBM… |
CVE-2024-35140 | High | 7.7 | 2024-05-31 | IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to improper certificate validation. IBM X-Fo… |
CVE-2024-28736 | High | 7.1 | 2024-05-31 | An issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page function. |
CVE-2024-5565 | High | 8.1 | 2024-05-31 | The Vanna library uses a prompt function to present the user with visualized results, it is possible to alter the prompt using prompt injection and run arbitra… |
CVE-2024-36108 | Critical | 9.8 | 2024-05-31 | casgate is an Open Source Identity and Access Management system. In affected versions `casgate` allows remote unauthenticated attacker to obtain sensitive info… |
CVE-2024-31908 | Medium | 6.4 | 2024-05-31 | IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2024-31907 | Medium | 5.4 | 2024-05-31 | IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2024-31889 | Medium | 5.4 | 2024-05-31 | IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2024-22338 | Medium | 4.0 | 2024-05-31 | IBM Security Verify Access OIDC Provider 22.09 through 23.03 could disclose sensitive information to a local user due to hazardous input validation. IBM X-For… |
CVE-2024-5347 | Medium | 6.4 | 2024-05-31 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'arrow' attribute within the plugin's Post Navigation… |
CVE-2024-5041 | Medium | 6.4 | 2024-05-31 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ha-ia-content-button’ parameter in all versions up to… |
CVE-2024-4160 | Medium | 6.4 | 2024-05-31 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all versions up to, an… |
CVE-2024-23692 | Critical | 9.8 | 2024-05-31 | Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenti… |
CVE-2024-5436 | Critical | 9.8 | 2024-05-31 | Type confusion in Snapchat LensCore could lead to denial of service or arbitrary code execution prior to version 12.88. We recommend upgrading to version 12.88… |
CVE-2024-5525 | High | 8.3 | 2024-05-31 | Improper privilege management vulnerability in Astrotalks affecting version 10/03/2023. This vulnerability allows a local user to access the application as an… |
CVE-2024-5524 | Medium | 5.3 | 2024-05-31 | Information exposure vulnerability in Astrotalks affecting version 10/03/2023. This vulnerability allows unregistered users to access all internal links of the… |
CVE-2024-5523 | High | 8.8 | 2024-05-31 | SQL injection vulnerability in Astrotalks affecting version 10/03/2023. This vulnerability could allow an authenticated local user to send a specially crafted… |
CVE-2024-5427 | Medium | 6.4 | 2024-05-31 | The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2024-4469 | High | 7.5 | 2024-05-31 | The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks… |
CVE-2024-4379 | Medium | 5.4 | 2024-05-31 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in all versions up to… |
CVE-2024-4376 | Medium | 6.4 | 2024-05-31 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, an… |
CVE-2024-4205 | Medium | 4.3 | 2024-05-31 | The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_template_conten… |
CVE-2024-36246 | Critical | 9.8 | 2024-05-31 | Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem pri… |
CVE-2024-23847 | Medium | 5.9 | 2024-05-31 | Incorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem pri… |
CVE-2024-2793 | High | 7.2 | 2024-05-31 | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comments in all… |
CVE-2024-37032 | High | 8.8 | 2024-05-31 | Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPa… |
CVE-2024-5418 | Medium | 6.4 | 2024-05-31 | The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slitems' attribute within the plugin's De Product Tab &… |