2024 CVEs (page 270)
Page 270 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5410 | Medium | 5.4 | 2024-05-28 | Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below. |
CVE-2024-32944 | Low | 3.3 | 2024-05-28 | Path traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer (.uar file, .zip fi… |
CVE-2024-28886 | High | 8.4 | 2024-05-28 | OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.ust file), an arbitra… |
CVE-2024-29078 | High | 7.5 | 2024-05-28 | Incorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unauthenticated attacker w… |
CVE-2024-28880 | Medium | 6.5 | 2024-05-28 | Path traversal vulnerability in MosP kintai kanri V4.6.6 and earlier allows a remote attacker who can log in to the product to obtain sensitive information of… |
CVE-2024-36428 | High | 8.1 | 2024-05-27 | OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection. |
CVE-2024-36426 | High | 7.5 | 2024-05-27 | In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session. |
CVE-2024-34923 | Medium | 6.1 | 2024-05-27 | In Avocent DSR2030 Appliance firmware 03.04.00.07 before 03.07.01.23, and SVIP1020 Appliance firmware 01.06.00.03 before 01.07.00.00, there is reflected cross-… |
CVE-2024-29415 | High | 8.1 | 2024-05-27 | The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0… |
CVE-2024-35182 | Medium | 5.9 | 2024-05-27 | Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vul… |
CVE-2024-35181 | Medium | 5.9 | 2024-05-27 | Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vul… |
CVE-2024-36105 | Medium | 5.3 | 2024-05-27 | dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1… |
CVE-2024-36037 | Medium | 5.5 | 2024-05-27 | Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings. |
CVE-2024-36036 | Medium | 4.2 | 2024-05-27 | Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and modifying the agent co… |
CVE-2024-35238 | Medium | 5.3 | 2024-05-27 | Minder by Stacklok is an open source software supply chain security platform. Minder prior to version 0.0.51 is vulnerable to a denial-of-service (DoS) attack… |
CVE-2024-27310 | Medium | 5.3 | 2024-05-27 | Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input. |
CVE-2024-35237 | High | 7.5 | 2024-05-27 | MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Discord server, and sto… |
CVE-2024-35236 | Medium | 4.8 | 2024-05-27 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution i… |
CVE-2024-35231 | High | 8.6 | 2024-05-27 | rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable t… |
CVE-2024-35229 | Medium | 5.3 | 2024-05-27 | ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern `f(a(),b()); check_… |
CVE-2024-35219 | High | 8.3 | 2024-05-27 | OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec… |
CVE-2024-32978 | Medium | 6.6 | 2024-05-27 | Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions has been identified… |
CVE-2024-0851 | | 2024-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Grup Arge Energy and Control Systems Smartpower allows SQ… | |
CVE-2024-34477 | High | 7.8 | 2024-05-27 | configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash… |
CVE-2024-5409 | High | 7.1 | 2024-05-27 | RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php. An attacker could create a malicious URL and send it to… |
CVE-2024-5408 | High | 7.1 | 2024-05-27 | Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm. This vulnerability could allow a remote attacker to… |
CVE-2024-5407 | Critical | 10.0 | 2024-05-27 | A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm. This vulnerability could allow a remote… |
CVE-2024-5406 | Medium | 6.3 | 2024-05-27 | A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via index page in from, subject, text and hash parameters. This vulnerability c… |
CVE-2024-5405 | Medium | 6.3 | 2024-05-27 | A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via /tools/redis.php page in the k, hash, key and p parameters. This vulnerabil… |
CVE-2024-36383 | Medium | 5.3 | 2024-05-27 | An issue was discovered in Logpoint SAML Authentication before 6.0.3. An attacker can place a crafted filename in the state field of a SAML SSO-URL response, a… |
CVE-2024-5035 | | 2024-05-27 | The affected device expose a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/8889, and TCP/8890… | |
CVE-2024-5403 | High | 7.2 | 2024-05-27 | ASKEY 5G NR Small Cell fails to properly filter user input for certain functionality, allowing remote attackers with administrator privilege to execute arbitra… |
CVE-2024-27314 | Low | 2.4 | 2024-05-27 | Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in th… |
CVE-2024-26289 | Critical | 9.8 | 2024-05-27 | Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1… |
CVE-2024-5400 | High | 8.8 | 2024-05-27 | Openfind Mail2000 does not properly filter parameters of specific CGI. Remote attackers with regular privileges can exploit this vulnerability to execute arbit… |
CVE-2024-4535 | High | 8.8 | 2024-05-27 | The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform… |
CVE-2024-4534 | Medium | 6.1 | 2024-05-27 | The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could… |
CVE-2024-4533 | Medium | 6.5 | 2024-05-27 | The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin users to… |
CVE-2024-4532 | Medium | 6.4 | 2024-05-27 | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted… |
CVE-2024-4531 | High | 7.1 | 2024-05-27 | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted… |
CVE-2024-4530 | Medium | 6.3 | 2024-05-27 | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted… |
CVE-2024-4529 | Medium | 5.0 | 2024-05-27 | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted… |
CVE-2024-3939 | Medium | 5.4 | 2024-05-27 | The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-3933 | Medium | 5.3 | 2024-05-27 | In Eclipse OpenJ9 release versions prior to 0.44.0 and after 0.13.0, when running with JVM option -Xgc:concurrentScavenge, the sequence generated for System.ar… |
CVE-2024-35297 | Medium | 4.7 | 2024-05-27 | Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5. If this vulnerability is exploited, an arbitrary script may be executed on the… |
CVE-2024-35291 | Medium | 6.1 | 2024-05-27 | Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitrary script may be ex… |
CVE-2024-5399 | High | 7.2 | 2024-05-27 | Openfind Mail2000 does not properly filter parameters of specific API. Remote attackers with administrative privileges can exploit this vulnerability to execut… |
CVE-2024-36384 | Medium | 6.1 | 2024-05-27 | Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages. |
CVE-2024-5397 | Medium | 6.3 | 2024-05-27 | A vulnerability classified as critical was found in itsourcecode Online Student Enrollment System 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2024-5396 | Medium | 6.3 | 2024-05-27 | A vulnerability classified as critical has been found in itsourcecode Online Student Enrollment System 1.0. Affected is an unknown function of the file newfacu… |
CVE-2024-5395 | Medium | 6.3 | 2024-05-27 | A vulnerability was found in itsourcecode Online Student Enrollment System 1.0. It has been rated as critical. This issue affects some unknown processing of th… |
CVE-2024-5394 | Medium | 6.3 | 2024-05-27 | A vulnerability was found in itsourcecode Online Student Enrollment System 1.0. It has been declared as critical. This vulnerability affects unknown code of th… |
CVE-2024-5393 | Medium | 6.3 | 2024-05-27 | A vulnerability was found in itsourcecode Online Student Enrollment System 1.0. It has been classified as critical. This affects an unknown part of the file li… |
CVE-2024-5392 | Medium | 6.3 | 2024-05-27 | A vulnerability was found in itsourcecode Online Student Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2024-5391 | Medium | 6.3 | 2024-05-27 | A vulnerability has been found in itsourcecode Online Student Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2024-5390 | Medium | 6.3 | 2024-05-27 | A vulnerability, which was classified as critical, was found in itsourcecode Online Student Enrollment System 1.0. Affected is an unknown function of the file… |
CVE-2024-5385 | Low | 2.4 | 2024-05-27 | A vulnerability, which was classified as problematic, has been found in oretnom23 Online Car Wash Booking System 1.0. This issue affects some unknown processin… |
CVE-2024-5384 | High | 7.3 | 2024-05-27 | A vulnerability classified as critical was found in SourceCodester Facebook News Feed Like 1.0. This vulnerability affects unknown code of the file index.php… |
CVE-2024-5383 | Low | 3.5 | 2024-05-26 | A vulnerability classified as problematic has been found in lakernote EasyAdmin up to 20240324. This affects an unknown part of the file /sys/file/upload. The… |
CVE-2024-5381 | Medium | 6.3 | 2024-05-26 | A vulnerability classified as critical was found in itsourcecode Student Information Management System 1.0. Affected by this vulnerability is an unknown functi… |
CVE-2024-5380 | Low | 3.5 | 2024-05-26 | A vulnerability classified as problematic has been found in jsy-1 short-url 1.0.0. Affected is an unknown function of the file admin.php. The manipulation of t… |
CVE-2024-4286 | Medium | 4.9 | 2024-05-26 | Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statement, identified in th… |
CVE-2024-36056 | Medium | 5.4 | 2024-05-26 | Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory via IOCTL 0x9c406490 (for IoAllocateMd… |
CVE-2024-36055 | Medium | 5.5 | 2024-05-26 | Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory with read/write access via the MmMapIo… |
CVE-2024-36054 | High | 7.4 | 2024-05-26 | Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily read kernel memory (and consequently gain all privileges)… |
CVE-2024-5379 | Low | 3.5 | 2024-05-26 | A vulnerability was found in JFinalCMS up to 20240111. It has been rated as problematic. This issue affects some unknown processing of the file /admin/template… |
CVE-2024-5378 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0. It has been declared as critical. This vulnerability a… |
CVE-2024-34454 | High | 7.4 | 2024-05-26 | Nintendo Wii U OS 5.5.5 allows man-in-the-middle attackers to forge SSL certificates as though they came from a Root CA, because there is a secondary verificat… |
CVE-2024-5377 | High | 7.3 | 2024-05-26 | A vulnerability was found in SourceCodester Vehicle Management System 1.0. It has been classified as critical. This affects an unknown part of the file /newveh… |
CVE-2024-5376 | Low | 3.5 | 2024-05-26 | A vulnerability was found in Kashipara College Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2024-5375 | Low | 3.5 | 2024-05-26 | A vulnerability has been found in Kashipara College Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functiona… |
CVE-2024-5374 | Low | 3.5 | 2024-05-26 | A vulnerability, which was classified as problematic, was found in Kashipara College Management System 1.0. Affected is an unknown function of the file submit_… |
CVE-2024-5373 | Low | 3.5 | 2024-05-26 | A vulnerability, which was classified as problematic, has been found in Kashipara College Management System 1.0. This issue affects some unknown processing of… |
CVE-2024-5372 | Low | 3.5 | 2024-05-26 | A vulnerability classified as problematic was found in Kashipara College Management System 1.0. This vulnerability affects unknown code of the file submit_extr… |
CVE-2024-5371 | Low | 3.5 | 2024-05-26 | A vulnerability classified as problematic has been found in Kashipara College Management System 1.0. This affects an unknown part of the file submit_enroll_stu… |
CVE-2024-5370 | Low | 3.5 | 2024-05-26 | A vulnerability was found in Kashipara College Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2024-5369 | Low | 3.5 | 2024-05-26 | A vulnerability was found in Kashipara College Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functio… |
CVE-2024-5368 | Low | 3.5 | 2024-05-26 | A vulnerability was found in Kashipara College Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file delete… |
CVE-2024-5367 | Low | 3.5 | 2024-05-26 | A vulnerability was found in Kashipara College Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file each… |
CVE-2024-5366 | Medium | 6.3 | 2024-05-26 | A vulnerability has been found in SourceCodester Best House Rental Management System up to 1.0 and classified as critical. This vulnerability affects unknown c… |
CVE-2024-5272 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to restrict the audience of the "custom_playbooks_playbook_run_updated" webhook event… |
CVE-2024-5270 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a… |
CVE-2024-36255 | Medium | 5.7 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run… |
CVE-2024-36241 | Low | 3.1 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents… |
CVE-2024-34152 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a publ… |
CVE-2024-34029 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1 and 8.1.x <= 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/<group-id>/channels/<… |
CVE-2024-32045 | Medium | 5.9 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playb… |
CVE-2024-31859 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in… |
CVE-2024-29215 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash co… |
CVE-2024-5365 | Medium | 6.3 | 2024-05-26 | A vulnerability, which was classified as critical, was found in SourceCodester Best House Rental Management System up to 1.0. This affects an unknown part of t… |
CVE-2024-5364 | Medium | 6.3 | 2024-05-26 | A vulnerability, which was classified as critical, has been found in SourceCodester Best House Rental Management System up to 1.0. Affected by this issue is so… |
CVE-2024-5363 | Medium | 6.3 | 2024-05-26 | A vulnerability classified as critical was found in SourceCodester Best House Rental Management System up to 1.0. Affected by this vulnerability is an unknown… |
CVE-2024-5362 | High | 7.3 | 2024-05-26 | A vulnerability classified as critical has been found in SourceCodester Online Hospital Management System 1.0. Affected is an unknown function of the file depa… |
CVE-2024-5361 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /admin… |
CVE-2024-5360 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin… |
CVE-2024-5359 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been classified as critical. This affects an unknown part of the file /admin/foreigne… |
CVE-2024-5358 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in PHPGurukul Zoo Management System 2.1 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-5357 | High | 7.3 | 2024-05-26 | A vulnerability has been found in PHPGurukul Zoo Management System 2.1 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-5356 | Medium | 6.3 | 2024-05-26 | A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTrans… |
CVE-2024-5355 | Medium | 6.3 | 2024-05-26 | A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1. This issue affects the function IGroovyHandler. The manip… |