2024 CVEs (page 271)
Page 271 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5372 | Low | 3.5 | 2024-05-26 | A vulnerability classified as problematic was found in Kashipara College Management System 1.0. This vulnerability affects unknown code of the file submit_extr… |
CVE-2024-5371 | Low | 3.5 | 2024-05-26 | A vulnerability classified as problematic has been found in Kashipara College Management System 1.0. This affects an unknown part of the file submit_enroll_stu… |
CVE-2024-5370 | Low | 3.5 | 2024-05-26 | A vulnerability was found in Kashipara College Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2024-5369 | Low | 3.5 | 2024-05-26 | A vulnerability was found in Kashipara College Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functio… |
CVE-2024-5368 | Low | 3.5 | 2024-05-26 | A vulnerability was found in Kashipara College Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file delete… |
CVE-2024-5367 | Low | 3.5 | 2024-05-26 | A vulnerability was found in Kashipara College Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file each… |
CVE-2024-5366 | Medium | 6.3 | 2024-05-26 | A vulnerability has been found in SourceCodester Best House Rental Management System up to 1.0 and classified as critical. This vulnerability affects unknown c… |
CVE-2024-5272 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to restrict the audience of the "custom_playbooks_playbook_run_updated" webhook event… |
CVE-2024-5270 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a… |
CVE-2024-36255 | Medium | 5.7 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run… |
CVE-2024-36241 | Low | 3.1 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents… |
CVE-2024-34152 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a publ… |
CVE-2024-34029 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1 and 8.1.x <= 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/<group-id>/channels/<… |
CVE-2024-32045 | Medium | 5.9 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playb… |
CVE-2024-31859 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in… |
CVE-2024-29215 | Medium | 4.3 | 2024-05-26 | Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash co… |
CVE-2024-5365 | Medium | 6.3 | 2024-05-26 | A vulnerability, which was classified as critical, was found in SourceCodester Best House Rental Management System up to 1.0. This affects an unknown part of t… |
CVE-2024-5364 | Medium | 6.3 | 2024-05-26 | A vulnerability, which was classified as critical, has been found in SourceCodester Best House Rental Management System up to 1.0. Affected by this issue is so… |
CVE-2024-5363 | Medium | 6.3 | 2024-05-26 | A vulnerability classified as critical was found in SourceCodester Best House Rental Management System up to 1.0. Affected by this vulnerability is an unknown… |
CVE-2024-5362 | High | 7.3 | 2024-05-26 | A vulnerability classified as critical has been found in SourceCodester Online Hospital Management System 1.0. Affected is an unknown function of the file depa… |
CVE-2024-5361 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /admin… |
CVE-2024-5360 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin… |
CVE-2024-5359 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been classified as critical. This affects an unknown part of the file /admin/foreigne… |
CVE-2024-5358 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in PHPGurukul Zoo Management System 2.1 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-5357 | High | 7.3 | 2024-05-26 | A vulnerability has been found in PHPGurukul Zoo Management System 2.1 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-5356 | Medium | 6.3 | 2024-05-26 | A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTrans… |
CVE-2024-5355 | Medium | 6.3 | 2024-05-26 | A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1. This issue affects the function IGroovyHandler. The manip… |
CVE-2024-5354 | Medium | 4.3 | 2024-05-26 | A vulnerability classified as problematic was found in anji-plus AJ-Report up to 1.4.1. This vulnerability affects unknown code of the file /reportShare/detail… |
CVE-2024-5353 | Medium | 6.3 | 2024-05-26 | A vulnerability classified as critical has been found in anji-plus AJ-Report up to 1.4.1. This affects the function decompress of the component ZIP File Handle… |
CVE-2024-5352 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been rated as critical. Affected by this issue is the function validationRules of the comp… |
CVE-2024-5351 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been declared as critical. Affected by this vulnerability is the function getValueFromJs o… |
CVE-2024-5350 | Medium | 6.3 | 2024-05-25 | A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been classified as critical. Affected is the function pageList of the file /pageList. The… |
CVE-2024-5340 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been rated as critical. Affected by this issue is some unknown functionality of the file /vie… |
CVE-2024-30056 | High | 7.1 | 2024-05-25 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-5339 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-5338 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been classified as critical. Affected is an unknown function of the file /view/vpn/autovpn/on… |
CVE-2024-5337 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516 and classified as critical. This issue affects some unknown processing of the file /view/systemConfig… |
CVE-2024-5336 | Medium | 4.7 | 2024-05-25 | A vulnerability has been found in Ruijie RG-UAC up to 20240516 and classified as critical. This vulnerability affects the function addVlan of the file /view/ne… |
CVE-2024-4045 | Medium | 6.4 | 2024-05-25 | The Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-5218 | Medium | 6.4 | 2024-05-25 | The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions… |
CVE-2024-5229 | Medium | 6.4 | 2024-05-25 | The Primary Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to… |
CVE-2024-4858 | Medium | 5.3 | 2024-05-25 | The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_t… |
CVE-2024-5220 | Medium | 6.4 | 2024-05-25 | The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 d… |
CVE-2024-36079 | Medium | 6.5 | 2024-05-24 | An issue was discovered in Vaultize 21.07.27. When uploading files, there is no check that the filename parameter is correct. As a result, a temporary file wil… |
CVE-2024-35374 | Critical | 9.8 | 2024-05-24 | Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary c… |
CVE-2024-35373 | Critical | 9.8 | 2024-05-24 | Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php. |
CVE-2024-35232 | Low | 3.7 | 2024-05-24 | github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be ex… |
CVE-2024-35388 | High | 8.8 | 2024-05-24 | TOTOLINK NR1800X v9.1.0u.6681_B20230703 was discovered to contain a stack overflow via the password parameter in the function urldecode |
CVE-2024-33471 | High | 7.2 | 2024-05-24 | An issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request. NOT… |
CVE-2024-35387 | Critical | 9.8 | 2024-05-24 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth. |
CVE-2024-36049 | Medium | 6.5 | 2024-05-24 | Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and passwords from the dat… |
CVE-2024-35396 | Critical | 9.8 | 2024-05-24 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to lo… |
CVE-2024-35395 | High | 8.8 | 2024-05-24 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as… |
CVE-2024-34995 | Medium | 4.3 | 2024-05-24 | svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserController#importOve… |
CVE-2024-35618 | High | 7.5 | 2024-05-24 | PingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer. |
CVE-2024-35340 | High | 8.6 | 2024-05-24 | Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeCommand. |
CVE-2024-35339 | Critical | 9.8 | 2024-05-24 | Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac. |
CVE-2024-33809 | Medium | 6.5 | 2024-05-24 | PingCAP TiDB v7.5.1 was discovered to contain a buffer overflow vulnerability, which could lead to database crashes and denial of service attacks. |
CVE-2024-33470 | Medium | 4.9 | 2024-05-24 | An issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in plaintext via a passback attack. NOTE: Thi… |
CVE-2024-31510 | Critical | 9.8 | 2024-05-24 | An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /pqcrystals-dilithiu… |
CVE-2024-22588 | Medium | 6.5 | 2024-05-24 | Kwik commit 745fd4e2 does not discard unused encryption keys. |
CVE-2024-5273 | Medium | 4.3 | 2024-05-24 | Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item… |
CVE-2024-35595 | Medium | 6.1 | 2024-05-24 | An arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary code via uploading a cr… |
CVE-2024-35593 | Medium | 5.5 | 2024-05-24 | An arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uploading a crafted PDF… |
CVE-2024-35592 | Critical | 9.6 | 2024-05-24 | An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-35591 | Medium | 5.4 | 2024-05-24 | An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-5318 | Medium | 4.0 | 2024-05-24 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.11 prior to 16.10.6, starting from 16.11 prior to 16.11.3, and starting fr… |
CVE-2024-5312 | Medium | 6.3 | 2024-05-24 | PHP Server Monitor, version 3.2.0, is vulnerable to an XSS via the /phpservermon-3.2.0/vendor/phpmailer/phpmailer/test_script/index.php page in all visible par… |
CVE-2024-4455 | High | 7.2 | 2024-05-24 | The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2… |
CVE-2024-5315 | Critical | 9.1 | 2024-05-24 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a speciall… |
CVE-2024-5314 | Critical | 9.1 | 2024-05-24 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a speciall… |
CVE-2024-5310 | Low | 2.4 | 2024-05-24 | A vulnerability classified as problematic has been found in JFinalCMS up to 20221020. This affects an unknown part of the file /admin/content. The manipulation… |
CVE-2024-4037 | Medium | 6.5 | 2024-05-24 | The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to th… |
CVE-2024-4366 | Medium | 6.4 | 2024-05-24 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘block_id’ parameter in versions up to, and… |
CVE-2024-5060 | Medium | 6.4 | 2024-05-24 | The LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to… |
CVE-2024-4485 | Medium | 6.4 | 2024-05-24 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-4484 | Medium | 6.4 | 2024-05-24 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-1376 | Medium | 4.3 | 2024-05-24 | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all… |
CVE-2024-1332 | Medium | 6.4 | 2024-05-24 | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and inc… |
CVE-2024-0893 | Medium | 4.3 | 2024-05-24 | The Schema App Structured Data plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the MarkupUpdate fu… |
CVE-2024-5142 | Medium | 5.4 | 2024-05-24 | Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other use… |
CVE-2024-3718 | Medium | 6.4 | 2024-05-24 | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets all versions up to, and… |
CVE-2024-36361 | Medium | 6.8 | 2024-05-24 | Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or co… |
CVE-2024-1134 | Medium | 6.4 | 2024-05-24 | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and description parameters as well as others in… |
CVE-2024-0867 | High | 8.1 | 2024-05-24 | The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. Th… |
CVE-2024-3557 | Medium | 6.4 | 2024-05-24 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpgmza shortcode in all versions up… |
CVE-2024-2784 | Medium | 6.4 | 2024-05-24 | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Hover Card widget in all versions up to, and includ… |
CVE-2024-2618 | Medium | 6.4 | 2024-05-24 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versions up to, and inclu… |
CVE-2024-4544 | Critical | 9.8 | 2024-05-24 | The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due… |
CVE-2024-5205 | Medium | 6.4 | 2024-05-24 | The Videojs HTML5 Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videojs_video shortcode in all versions up to, and… |
CVE-2024-4409 | Medium | 4.3 | 2024-05-24 | The WP-ViperGB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrec… |
CVE-2024-5279 | Low | 3.5 | 2024-05-23 | A vulnerability was found in Qiwen Netdisk up to 1.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-5299 | High | 8.8 | 2024-05-23 | D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2024-5298 | High | 8.8 | 2024-05-23 | D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2024-5297 | High | 8.8 | 2024-05-23 | D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2024-5296 | Critical | 9.8 | 2024-05-23 | D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on a… |
CVE-2024-5295 | High | 8.8 | 2024-05-23 | D-Link G416 flupl self Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2024-5294 | Medium | 6.5 | 2024-05-23 | D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a deni… |
CVE-2024-5293 | High | 8.8 | 2024-05-23 | D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute a… |
CVE-2024-5292 | High | 7.8 | 2024-05-23 | D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privi… |