2024 CVEs (page 280)
Page 280 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4974 | Low | 3.5 | 2024-05-16 | A vulnerability, which was classified as problematic, was found in code-projects Simple Chat System 1.0. Affected is an unknown function of the file /register… |
CVE-2024-4973 | Medium | 6.3 | 2024-05-16 | A vulnerability classified as critical was found in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the file /register.php. Th… |
CVE-2024-4352 | High | 8.8 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on th… |
CVE-2024-4351 | High | 8.8 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on th… |
CVE-2024-4222 | High | 7.3 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on mu… |
CVE-2024-4972 | Medium | 6.3 | 2024-05-16 | A vulnerability classified as critical has been found in code-projects Simple Chat System 1.0. This affects an unknown part of the file /login.php. The manipul… |
CVE-2024-4968 | Low | 3.5 | 2024-05-16 | A vulnerability was found in SourceCodester Interactive Map with Marker 1.0. It has been rated as problematic. Affected by this issue is some unknown functiona… |
CVE-2024-4967 | Medium | 6.3 | 2024-05-16 | A vulnerability was found in SourceCodester Interactive Map with Marker 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2024-4391 | Medium | 6.4 | 2024-05-16 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Event Calendar widget in all versions up to… |
CVE-2024-4326 | Critical | 9.8 | 2024-05-16 | A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protec… |
CVE-2024-4322 | High | 7.5 | 2024-05-16 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `ca… |
CVE-2024-4321 | High | 7.5 | 2024-05-16 | A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat histo… |
CVE-2024-4263 | Medium | 5.4 | 2024-05-16 | A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can… |
CVE-2024-4223 | Critical | 9.8 | 2024-05-16 | The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multip… |
CVE-2024-4181 | High | 8.8 | 2024-05-16 | A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect… |
CVE-2024-4078 | Critical | 9.8 | 2024-05-16 | A vulnerability in the parisneo/lollms, specifically in the `/unInstall_binding` endpoint, allows for arbitrary code execution due to insufficient sanitization… |
CVE-2024-3887 | Medium | 5.4 | 2024-05-16 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Form Builder widget in all versions up to, a… |
CVE-2024-3851 | Medium | 5.4 | 2024-05-16 | A stored Cross-Site Scripting (XSS) vulnerability exists in the 'imartinez/privategpt' repository due to improper validation of file uploads. Attackers can exp… |
CVE-2024-3848 | High | 7.5 | 2024-05-16 | A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability ari… |
CVE-2024-3435 | High | 8.4 | 2024-05-16 | A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release bef… |
CVE-2024-3403 | High | 7.5 | 2024-05-16 | imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem. By… |
CVE-2024-3126 | High | 8.4 | 2024-05-16 | A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.p… |
CVE-2024-30309 | Medium | 5.5 | 2024-05-16 | Substance3D - Painter versions 9.1.2 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory… |
CVE-2024-30308 | Medium | 5.5 | 2024-05-16 | Substance3D - Painter versions 9.1.2 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory… |
CVE-2024-30307 | High | 7.8 | 2024-05-16 | Substance3D - Painter versions 9.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2024-30298 | Medium | 5.5 | 2024-05-16 | Animate versions 24.0.2, 23.0.5 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An a… |
CVE-2024-30297 | High | 7.8 | 2024-05-16 | Animate versions 24.0.2, 23.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context o… |
CVE-2024-30296 | High | 7.8 | 2024-05-16 | Animate versions 24.0.2, 23.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context o… |
CVE-2024-30295 | High | 7.8 | 2024-05-16 | Animate versions 24.0.2, 23.0.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in arbitrary code execution in the conte… |
CVE-2024-30294 | High | 7.8 | 2024-05-16 | Animate versions 24.0.2, 23.0.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the con… |
CVE-2024-30293 | High | 7.8 | 2024-05-16 | Animate versions 24.0.2, 23.0.5 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the co… |
CVE-2024-30282 | High | 7.8 | 2024-05-16 | Animate versions 24.0.2, 23.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context o… |
CVE-2024-30281 | Medium | 5.5 | 2024-05-16 | Substance3D - Designer versions 13.1.1 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memor… |
CVE-2024-30275 | High | 7.8 | 2024-05-16 | Adobe Aero Desktop versions 23.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the… |
CVE-2024-30274 | High | 7.8 | 2024-05-16 | Substance3D - Painter versions 9.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2024-2366 | Critical | 9.0 | 2024-05-16 | A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstall_binding functionality in lollms_core/l… |
CVE-2024-2361 | Critical | 9.6 | 2024-05-16 | A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, t… |
CVE-2024-2358 | Critical | 9.8 | 2024-05-16 | A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises… |
CVE-2024-20793 | Medium | 5.5 | 2024-05-16 | Illustrator versions 28.4, 27.9.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacke… |
CVE-2024-20792 | High | 7.8 | 2024-05-16 | Illustrator versions 28.4, 27.9.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2024-20791 | High | 7.8 | 2024-05-16 | Illustrator versions 28.4, 27.9.3 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read pas… |
CVE-2024-4966 | High | 7.3 | 2024-05-16 | A vulnerability was found in SourceCodester SchoolWebTech 1.0. It has been classified as critical. Affected is an unknown function of the file /improve/home.ph… |
CVE-2024-4965 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000-40 V31R02B1413C and classified as critical. This issue affects some unknown proces… |
CVE-2024-4964 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000-40 V31R02B1413C and classified as critical. This vulnerability affects unknow… |
CVE-2024-4546 | Medium | 6.4 | 2024-05-16 | The Custom Post Type Attachment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pdf_attachment' shortcode in all versions u… |
CVE-2024-4478 | Medium | 6.4 | 2024-05-16 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group widget in all versions up to, and in… |
CVE-2024-4963 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000-40 V31R02B1413C. This affects an unknown part o… |
CVE-2024-4962 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000-40 V31R02B1413C. Affected by this issue is… |
CVE-2024-4844 | High | 7.5 | 2024-05-16 | Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privil… |
CVE-2024-4961 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-7000-40 V31R02B1413C. Affected by this vulnerability is an unkno… |
CVE-2024-4960 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000-40 V31R02B1413C. Affected is an unknown function of th… |
CVE-2024-4946 | Medium | 6.3 | 2024-05-16 | A vulnerability was found in SourceCodester Online Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an un… |
CVE-2024-4843 | Medium | 4.3 | 2024-05-16 | ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a least privileged user to manipulate… |
CVE-2024-4635 | Medium | 6.4 | 2024-05-16 | The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘add_mime_type’ function in versions up to, and including… |
CVE-2024-4318 | High | 8.8 | 2024-05-16 | The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to ins… |
CVE-2024-4279 | Medium | 6.5 | 2024-05-16 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in ver… |
CVE-2024-3644 | Medium | 4.8 | 2024-05-16 | The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-3643 | High | 8.8 | 2024-05-16 | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform suc… |
CVE-2024-3642 | Medium | 6.9 | 2024-05-16 | The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perfo… |
CVE-2024-3641 | Medium | 6.1 | 2024-05-16 | The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Sit… |
CVE-2024-4945 | Medium | 4.3 | 2024-05-16 | A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as problematic. Affected is an unknown function of the f… |
CVE-2024-4933 | Medium | 6.3 | 2024-05-16 | A vulnerability has been found in SourceCodester Simple Online Bidding System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-4932 | Medium | 6.3 | 2024-05-16 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Online Bidding System 1.0. Affected is an unknown function of the file /s… |
CVE-2024-4931 | Medium | 6.3 | 2024-05-16 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Online Bidding System 1.0. This issue affects some unknown processin… |
CVE-2024-4930 | Medium | 6.3 | 2024-05-16 | A vulnerability classified as critical was found in SourceCodester Simple Online Bidding System 1.0. This vulnerability affects unknown code of the file /simpl… |
CVE-2024-4929 | Medium | 4.3 | 2024-05-16 | A vulnerability classified as problematic has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file /simple-o… |
CVE-2024-4928 | Medium | 6.3 | 2024-05-16 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionali… |
CVE-2024-4927 | High | 7.3 | 2024-05-16 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fu… |
CVE-2024-3750 | High | 8.8 | 2024-05-16 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing… |
CVE-2024-4984 | Medium | 6.4 | 2024-05-16 | The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ author meta in all versions up to, and including, 22.6 d… |
CVE-2024-4926 | Medium | 6.3 | 2024-05-16 | A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0. It has been classified as critical. Affected is an unk… |
CVE-2024-4925 | Medium | 6.3 | 2024-05-16 | A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0 and classified as critical. This issue affects some unk… |
CVE-2024-4923 | Medium | 6.3 | 2024-05-16 | A vulnerability has been found in Codezips E-Commerce Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/addproduct… |
CVE-2024-4922 | Low | 3.5 | 2024-05-16 | A vulnerability, which was classified as problematic, was found in SourceCodester Simple Image Stack Website 1.0. This affects an unknown part. The manipulatio… |
CVE-2024-4921 | Medium | 6.3 | 2024-05-16 | A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of t… |
CVE-2024-4920 | High | 7.3 | 2024-05-16 | A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2024-4919 | Medium | 6.3 | 2024-05-16 | A vulnerability was found in Campcodes Online Examination System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /ad… |
CVE-2024-4918 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Online Examination System 1.0. It has been classified as critical. This affects an unknown part of the file updateQuesti… |
CVE-2024-4917 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Online Examination System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2024-4916 | Medium | 6.3 | 2024-05-15 | A vulnerability has been found in Campcodes Online Examination System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-4915 | Medium | 6.3 | 2024-05-15 | A vulnerability, which was classified as critical, was found in Campcodes Online Examination System 1.0. Affected is an unknown function of the file result.php… |
CVE-2024-4914 | Medium | 6.3 | 2024-05-15 | A vulnerability, which was classified as critical, has been found in Campcodes Online Examination System 1.0. This issue affects some unknown processing of the… |
CVE-2024-35184 | Medium | 5.5 | 2024-05-15 | Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to versi… |
CVE-2024-35183 | Medium | 4.4 | 2024-05-15 | wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent t… |
CVE-2024-4976 | Medium | 5.5 | 2024-05-15 | Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference. |
CVE-2024-4950 | Medium | 6.5 | 2024-05-15 | Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2024-4949 | Medium | 6.5 | 2024-05-15 | Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-4948 | Medium | 6.5 | 2024-05-15 | Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2024-4947 | Critical | 9.6 | 2024-05-15 | Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2024-4913 | Medium | 6.3 | 2024-05-15 | A vulnerability classified as critical was found in Campcodes Online Examination System 1.0. This vulnerability affects unknown code of the file exam.php. The… |
CVE-2024-4912 | Medium | 6.3 | 2024-05-15 | A vulnerability classified as critical has been found in Campcodes Online Examination System 1.0. This affects an unknown part of the file addExamExe.php. The… |
CVE-2024-4911 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. Affected by this issue is some unknown f… |
CVE-2024-27244 | Medium | 6.7 | 2024-05-15 | Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalatio… |
CVE-2024-27243 | Medium | 6.5 | 2024-05-15 | Buffer overflow in some Zoom Workplace Apps and SDK’s may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-4910 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. Affected by this vulnerability is an… |
CVE-2024-4904 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Byzoro Smart S200 Management Platform up to 20240507. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2024-34913 | Medium | 5.4 | 2024-05-15 | An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-34909 | Medium | 5.4 | 2024-05-15 | An arbitrary file upload vulnerability in KYKMS v1.0.1 and below allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-34906 | Medium | 5.4 | 2024-05-15 | An arbitrary file upload vulnerability in dootask v0.30.13 allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-34025 | Critical | 9.8 | 2024-05-15 | CyberPower PowerPanel business application code contains a hard-coded set of authentication credentials. This could result in an attacker bypassing authentica… |