2024 CVEs (page 268)
Page 268 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35354 | Critical | 9.8 | 2024-05-30 | A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Maste… |
CVE-2024-35345 | Medium | 5.4 | 2024-05-30 | A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts unidentified code within the file /classes/Users.ph… |
CVE-2024-5517 | High | 7.3 | 2024-05-30 | A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functi… |
CVE-2024-4330 | Low | 3.3 | 2024-05-30 | A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to imprope… |
CVE-2024-3924 | Medium | 4.4 | 2024-05-30 | A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the `autodocs.yml` workflow file. The vulner… |
CVE-2024-36026 | Medium | 5.5 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 While doing multiple S4 stress t… |
CVE-2024-36025 | Medium | 5.5 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() The app_reply->elem[] array is a… |
CVE-2024-36024 | Medium | 4.7 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Disable idle reallow as part of command/gpint execution [Why] Workaroud… |
CVE-2024-36023 | Medium | 5.5 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: Julia Lawall reported this null pointer dereference, this should fix it. |
CVE-2024-36021 | Medium | 5.5 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when devlink reload during pf initialization The devlink relo… |
CVE-2024-36020 | High | 7.8 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression int… |
CVE-2024-36019 | High | 7.8 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: regmap: maple: Fix cache corruption in regcache_maple_drop() When keeping the upper end o… |
CVE-2024-36018 | High | 7.8 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: nouveau/uvmm: fix addr/range calcs for remap operations dEQP-VK.sparse_resources.image_re… |
CVE-2024-35504 | Medium | 5.4 | 2024-05-30 | A cross-site scripting (XSS) vulnerability in the login page of FineSoft v8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload i… |
CVE-2024-5516 | Medium | 6.3 | 2024-05-30 | A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unkno… |
CVE-2024-5515 | Medium | 6.3 | 2024-05-30 | A vulnerability was found in SourceCodester Stock Management System 1.0. It has been classified as critical. Affected is an unknown function of the file create… |
CVE-2024-3584 | High | 7.5 | 2024-05-30 | qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By man… |
CVE-2024-36017 | Medium | 5.5 | 2024-05-30 | In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a… |
CVE-2024-5521 | Medium | 6.4 | 2024-05-30 | Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user having the roles of gallery e… |
CVE-2024-5520 | Medium | 6.4 | 2024-05-30 | Two Cross-Site Scripting vulnerabilities have been discovered in Alkacon's OpenCMS affecting version 16, which could allow a user with sufficient privileges to… |
CVE-2024-1100 | Critical | 9.8 | 2024-05-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vadi Corporate Information Systems DIGIKENT GIS allows SQ… |
CVE-2024-5326 | High | 8.8 | 2024-05-30 | The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capab… |
CVE-2024-3583 | Medium | 6.4 | 2024-05-30 | The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and includin… |
CVE-2024-4668 | Medium | 6.4 | 2024-05-30 | The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Price Table and Post Slider widgets in all versions up to, an… |
CVE-2024-4427 | Medium | 4.3 | 2024-05-30 | The Comparison Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all… |
CVE-2024-4426 | Medium | 4.3 | 2024-05-30 | The Comparison Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or i… |
CVE-2024-4422 | Medium | 6.4 | 2024-05-30 | The Comparison Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider title parameter in all versions up to, and including, 1… |
CVE-2024-4355 | Medium | 4.3 | 2024-05-30 | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to a m… |
CVE-2024-2657 | Medium | 4.4 | 2024-05-30 | The Font Farsi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.6 due to insuffic… |
CVE-2024-2089 | Medium | 5.4 | 2024-05-30 | The Remote Content Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'remote_content' shortcode in all versions up to, and in… |
CVE-2024-5327 | Medium | 6.4 | 2024-05-30 | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the… |
CVE-2024-5073 | Medium | 6.4 | 2024-05-30 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-5341 | Medium | 6.4 | 2024-05-30 | The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' attribute of the Heading Title… |
CVE-2024-5207 | High | 7.2 | 2024-05-30 | The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQ… |
CVE-2024-36267 | High | 8.1 | 2024-05-30 | Path traversal vulnerability exists in Redmine DMSF Plugin versions prior to 3.1.4. If this vulnerability is exploited, a logged-in user may obtain or delete a… |
CVE-2024-4356 | Medium | 6.4 | 2024-05-30 | The List categories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'categories' shortcode in all versions up to, and includ… |
CVE-2024-4218 | Medium | 6.5 | 2024-05-30 | The AffiEasy plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This is due to plugin improperly rel… |
CVE-2024-3947 | Medium | 4.3 | 2024-05-30 | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect… |
CVE-2024-3946 | Medium | 4.4 | 2024-05-30 | The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.0 due to insufficie… |
CVE-2024-3945 | Medium | 4.3 | 2024-05-30 | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect… |
CVE-2024-3943 | Medium | 4.3 | 2024-05-30 | The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect… |
CVE-2024-3277 | Medium | 5.0 | 2024-05-30 | The Yumpu ePaper publishing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler funct… |
CVE-2024-5223 | Medium | 6.4 | 2024-05-30 | The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload… |
CVE-2024-3269 | Medium | 5.4 | 2024-05-30 | The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin f… |
CVE-2024-3190 | Medium | 5.4 | 2024-05-30 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's text… |
CVE-2024-3063 | Medium | 6.4 | 2024-05-30 | The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the output of 'tags' added to widgets in all versions up to, and… |
CVE-2024-2253 | Medium | 6.4 | 2024-05-30 | The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL values the plugin's carousel widgets in all ve… |
CVE-2024-5514 | Critical | 9.8 | 2024-05-30 | MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management… |
CVE-2024-3726 | Medium | 6.4 | 2024-05-30 | The Login Logout Register Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'llrmloginlogout' shortcode in all versions u… |
CVE-2024-36114 | High | 8.6 | 2024-05-29 | Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. All decompressor implementations of Aircompressor… |
CVE-2024-35221 | Medium | 4.3 | 2024-05-29 | Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manif… |
CVE-2024-35492 | High | 7.5 | 2024-05-29 | Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. This vulnerability allows attackers to… |
CVE-2024-36016 | High | 7.8 | 2024-05-29 | In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A… |
CVE-2024-35434 | High | 7.5 | 2024-05-29 | Irontec Sngrep v1.8.1 was discovered to contain a heap buffer overflow via the function rtp_check_packet at /sngrep/src/rtp.c. This vulnerability allows attack… |
CVE-2024-35512 | Medium | 5.3 | 2024-05-29 | hmq v1.5.5 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception. A remote attacker can trigger a broker crash by sending a specially crafte… |
CVE-2024-34715 | Low | 2.3 | 2024-05-29 | Fides is an open-source privacy engineering platform. The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of appli… |
CVE-2024-36427 | High | 8.1 | 2024-05-29 | The file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to read or write to se… |
CVE-2024-35333 | High | 8.4 | 2024-05-29 | A stack-buffer-overflow vulnerability exists in the read_charset_decl function of html2xhtml 1.3. This vulnerability occurs due to improper bounds checking whe… |
CVE-2024-35311 | Low | 3.3 | 2024-05-29 | Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access… |
CVE-2024-35284 | Medium | 5.4 | 2024-05-29 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected… |
CVE-2024-35283 | Medium | 6.1 | 2024-05-29 | A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-s… |
CVE-2024-35200 | Medium | 5.3 | 2024-05-29 | When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate. |
CVE-2024-34161 | Medium | 5.3 | 2024-05-29 | When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or… |
CVE-2024-32760 | Medium | 6.5 | 2024-05-29 | When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminat… |
CVE-2024-31079 | Medium | 4.8 | 2024-05-29 | When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause o… |
CVE-2024-28974 | High | 7.6 | 2024-05-29 | Dell Data Protection Advisor, version(s) 19.9, contain(s) an Inadequate Encryption Strength vulnerability. A low privileged attacker with remote access could p… |
CVE-2024-4358 | Critical | 9.8 | 2024-05-29 | In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restr… |
CVE-2024-36470 | High | 8.1 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases |
CVE-2024-36378 | Medium | 5.9 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens |
CVE-2024-36377 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions |
CVE-2024-36376 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions |
CVE-2024-36375 | Medium | 5.3 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed |
CVE-2024-36374 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible |
CVE-2024-36373 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible |
CVE-2024-36372 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible |
CVE-2024-36371 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible |
CVE-2024-36370 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible |
CVE-2024-36369 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible |
CVE-2024-36368 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible |
CVE-2024-36367 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible |
CVE-2024-36366 | Medium | 5.4 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations |
CVE-2024-36365 | Medium | 6.8 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent |
CVE-2024-36364 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was… |
CVE-2024-36363 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible |
CVE-2024-36362 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible |
CVE-2024-25975 | Medium | 6.5 | 2024-05-29 | The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an… |
CVE-2024-5185 | High | 7.3 | 2024-05-29 | The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks. This weakness could result in the application becoming compromise… |
CVE-2024-5039 | Medium | 6.4 | 2024-05-29 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all… |
CVE-2024-25977 | High | 7.3 | 2024-05-29 | The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e… |
CVE-2024-25976 | Medium | 6.1 | 2024-05-29 | When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs… |
CVE-2024-27313 | Medium | 6.3 | 2024-05-29 | Zoho ManageEngine PAM360 is vulnerable to Stored XSS vulnerability. This vulnerability is applicable only in the version 6610. |
CVE-2024-28826 | High | 8.8 | 2024-05-29 | Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attacker… |
CVE-2024-3412 | Critical | 9.1 | 2024-05-29 | The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validat… |
CVE-2024-5086 | Medium | 6.4 | 2024-05-29 | The Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-36015 | High | 7.8 | 2024-05-29 | In the Linux kernel, the following vulnerability has been resolved: ppdev: Add an error check in register_device In register_device, the return value of ida_… |
CVE-2024-36014 | Medium | 5.5 | 2024-05-29 | In the Linux kernel, the following vulnerability has been resolved: drm/arm/malidp: fix a possible null pointer dereference In malidp_mw_connector_reset, new… |
CVE-2024-4419 | Medium | 4.4 | 2024-05-29 | The Fetch JFT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.3 due to insuffici… |
CVE-2024-3937 | Medium | 4.8 | 2024-05-29 | The Playlist for Youtube WordPress plugin through 1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-3921 | Medium | 4.8 | 2024-05-29 | The Gianism WordPress plugin through 5.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2024-3050 | Critical | 9.1 | 2024-05-29 | The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value… |