2024 CVEs (page 281)
Page 281 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-33625 | Critical | 9.8 | 2024-05-15 | CyberPower PowerPanel business application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokens to bypass authenti… |
CVE-2024-33615 | High | 8.8 | 2024-05-15 | A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel server, which allows file writing to the ser… |
CVE-2024-32053 | Critical | 9.8 | 2024-05-15 | Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. This could result in… |
CVE-2024-32047 | Critical | 9.8 | 2024-05-15 | Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gaining access to the… |
CVE-2024-32042 | Medium | 4.9 | 2024-05-15 | The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered. |
CVE-2024-31856 | High | 8.8 | 2024-05-15 | An attacker with certain MQTT permissions can create malicious messages to all CyberPower PowerPanel devices. This could result in an attacker injecting SQL… |
CVE-2024-31410 | High | 7.7 | 2024-05-15 | The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate… |
CVE-2024-31409 | Medium | 6.5 | 2024-05-15 | Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after… |
CVE-2024-4909 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. Affected is an unknown function of… |
CVE-2024-4908 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This issue affects some unknown processing o… |
CVE-2024-4907 | Medium | 6.3 | 2024-05-15 | A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This vulnerability affects unknown code… |
CVE-2024-4906 | Medium | 6.3 | 2024-05-15 | A vulnerability, which was classified as critical, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the… |
CVE-2024-35102 | High | 8.8 | 2024-05-15 | Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a crafted script. |
CVE-2024-4905 | Medium | 6.3 | 2024-05-15 | A vulnerability classified as critical has been found in Kashipara College Management System 1.0. Affected is an unknown function of the file view_students_eac… |
CVE-2024-3182 | Medium | 6.5 | 2024-05-15 | Install-type password disclosure vulnerability in Universal Installer including the Silent Installer in TIBCO Hawk versions 6.2.0, 6.2.1, 6.2.2 and 6.2.3 allow… |
CVE-2024-25743 | High | 7.1 | 2024-05-15 | In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIGFPE signal handler… |
CVE-2024-20394 | Medium | 5.5 | 2024-05-15 | A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service (DoS) condition on an… |
CVE-2024-20392 | Medium | 6.1 | 2024-05-15 | A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to con… |
CVE-2024-20391 | Medium | 6.8 | 2024-05-15 | A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected d… |
CVE-2024-20383 | Medium | 4.8 | 2024-05-15 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote att… |
CVE-2024-20369 | Medium | 4.7 | 2024-05-15 | A vulnerability in the web-based management interface of Cisco Crosswork Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to… |
CVE-2024-20366 | High | 7.8 | 2024-05-15 | A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow a… |
CVE-2024-20258 | Medium | 6.1 | 2024-05-15 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an… |
CVE-2024-20257 | Medium | 4.8 | 2024-05-15 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated, remote attacker to… |
CVE-2024-20256 | Medium | 4.8 | 2024-05-15 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an… |
CVE-2024-4837 | Medium | 5.3 | 2024-05-15 | In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restr… |
CVE-2024-4622 | | 2024-05-15 | If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not chang… | |
CVE-2024-4357 | Medium | 6.5 | 2024-05-15 | An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to re… |
CVE-2024-4202 | High | 7.7 | 2024-05-15 | In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability. |
CVE-2024-4200 | High | 7.7 | 2024-05-15 | In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible by a local threat actor through an insecure dese… |
CVE-2024-3970 | Medium | 5.3 | 2024-05-15 | Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure by directory… |
CVE-2024-3968 | High | 7.8 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution using custom file upload task. |
CVE-2024-3967 | High | 7.6 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution unisng unsafe java object deser… |
CVE-2024-3892 | High | 7.2 | 2024-05-15 | A local code execution vulnerability is possible in Telerik UI for WinForms beginning in v2021.1.122 but prior to v2024.2.514. This vulnerability could allow a… |
CVE-2024-3488 | Medium | 5.6 | 2024-05-15 | File Upload vulnerability in unauthenticated session found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file withou… |
CVE-2024-3487 | Low | 3.5 | 2024-05-15 | Broken Authentication vulnerability discovered in OpenText™ iManager 3.2.6.0200. This vulnerability allows an attacker to manipulate certain parameters to bypa… |
CVE-2024-3486 | High | 7.8 | 2024-05-15 | XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution. |
CVE-2024-3485 | Medium | 5.3 | 2024-05-15 | Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure. |
CVE-2024-3484 | Medium | 5.7 | 2024-05-15 | Path Traversal found in OpenText™ iManager 3.2.6.0200. This can lead to privilege escalation or file disclosure. |
CVE-2024-3483 | High | 7.8 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues… |
CVE-2024-34082 | High | 8.5 | 2024-05-15 | Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax… |
CVE-2024-28087 | Medium | 6.5 | 2024-05-15 | In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition an… |
CVE-2024-28042 | High | 8.4 | 2024-05-15 | SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center. |
CVE-2024-27593 | Medium | 5.4 | 2024-05-15 | A stored cross-site scripting (XSS) vulnerability in the Filter function of Eramba Version 3.22.3 Community Edition allows authenticated attackers to execute a… |
CVE-2024-4903 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Tongda OA 2017. It has been declared as critical. This vulnerability affects unknown code of the file /general/meeting/manage/dele… |
CVE-2024-3319 | Critical | 9.1 | 2024-05-15 | An issue was identified in the Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administ… |
CVE-2024-3318 | Medium | 4.2 | 2024-05-15 | A file path traversal vulnerability was identified in the DelimitedFileConnector Cloud Connector that allowed an authenticated administrator to set arbitrary c… |
CVE-2024-3317 | Medium | 6.5 | 2024-05-15 | An improper access control was identified in the Identity Security Cloud (ISC) message server API that allowed an authenticated user to exfiltrate job processi… |
CVE-2024-35179 | Medium | 6.8 | 2024-05-15 | Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using `RUN_AS_USER`, the specified user (and therefore, web interface admins)… |
CVE-2024-31216 | Medium | 5.1 | 2024-05-15 | The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatibl… |
CVE-2024-34955 | Critical | 9.8 | 2024-05-15 | Code-projects Budget Management 1.0 is vulnerable to SQL Injection via the delete parameter. |
CVE-2024-34954 | Medium | 6.1 | 2024-05-15 | Code-projects Budget Management 1.0 is vulnerable to Cross Site Scripting (XSS) via the budget parameter. |
CVE-2024-27353 | High | 7.4 | 2024-05-15 | A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46… |
CVE-2024-25079 | High | 7.4 | 2024-05-15 | A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel… |
CVE-2024-25078 | High | 7.4 | 2024-05-15 | A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB19130163 in 05.38.0… |
CVE-2024-4670 | High | 8.8 | 2024-05-15 | The All-in-One Video Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.5 via the aiovg_search_form s… |
CVE-2024-2248 | Medium | 6.4 | 2024-05-15 | A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end us… |
CVE-2024-4702 | Medium | 6.4 | 2024-05-15 | The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 1.2.1… |
CVE-2024-34101 | Medium | 5.5 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sen… |
CVE-2024-34100 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-34099 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code exe… |
CVE-2024-34098 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code e… |
CVE-2024-34097 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-34096 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-34095 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-34094 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-30312 | Medium | 5.5 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sen… |
CVE-2024-30311 | Medium | 5.5 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sen… |
CVE-2024-30310 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code executi… |
CVE-2024-30284 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-4010 | High | 8.8 | 2024-05-15 | The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a mis… |
CVE-2024-4636 | Medium | 6.4 | 2024-05-15 | The Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘allow_meme_… |
CVE-2024-3824 | Medium | 5.5 | 2024-05-15 | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a… |
CVE-2024-3823 | Low | 2.4 | 2024-05-15 | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping… |
CVE-2024-3822 | Medium | 4.8 | 2024-05-15 | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflecte… |
CVE-2024-3749 | Medium | 6.5 | 2024-05-15 | The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belongin… |
CVE-2024-3748 | Medium | 6.5 | 2024-05-15 | The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to ma… |
CVE-2024-3634 | Medium | 4.8 | 2024-05-15 | The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2024-3631 | Medium | 4.3 | 2024-05-15 | The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admin… |
CVE-2024-3630 | Medium | 5.4 | 2024-05-15 | The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-3629 | Low | 2.4 | 2024-05-15 | The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2024-3548 | Medium | 6.1 | 2024-05-15 | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, le… |
CVE-2024-3407 | Medium | 5.3 | 2024-05-15 | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted act… |
CVE-2024-3406 | High | 8.8 | 2024-05-15 | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged i… |
CVE-2024-3405 | High | 7.6 | 2024-05-15 | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admi… |
CVE-2024-4894 | Medium | 5.3 | 2024-05-15 | ITPison OMICARD EDM fails to properly filter specific URL parameter, allowing unauthenticated remote attackers to modify the parameters and conduct Server-Sid… |
CVE-2024-4893 | Critical | 9.8 | 2024-05-15 | DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables una… |
CVE-2024-4208 | Medium | 6.4 | 2024-05-15 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the typer effect in th… |
CVE-2024-3189 | Medium | 5.4 | 2024-05-15 | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Testimonial'… |
CVE-2024-32888 | Critical | 10.0 | 2024-05-15 | The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs)… |
CVE-2024-4847 | High | 8.8 | 2024-05-15 | The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘last_pos… |
CVE-2024-4734 | Medium | 4.4 | 2024-05-15 | The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and inclu… |
CVE-2024-4656 | Medium | 4.4 | 2024-05-15 | The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in all versions up to, an… |
CVE-2024-4618 | Medium | 6.4 | 2024-05-15 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Member widget in all versions up to, and incl… |
CVE-2024-4373 | Medium | 6.4 | 2024-05-15 | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress i… |
CVE-2024-4199 | Medium | 4.3 | 2024-05-15 | The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the plugin… |
CVE-2024-35109 | Medium | 6.5 | 2024-05-15 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /homePro_deal.php?mudi=add&nohrefStr=close. |
CVE-2024-35108 | High | 8.8 | 2024-05-15 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/homePro_deal.php?mudi=del&dataType=&dataTypeCN. |
CVE-2024-3744 | Medium | 6.5 | 2024-05-15 | A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could… |
CVE-2024-4370 | Medium | 6.4 | 2024-05-15 | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget Image Box in all… |