2024 CVEs (page 281)
Page 281 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4922 | Low | 3.5 | 2024-05-16 | A vulnerability, which was classified as problematic, was found in SourceCodester Simple Image Stack Website 1.0. This affects an unknown part. The manipulatio… |
CVE-2024-4921 | Medium | 6.3 | 2024-05-16 | A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of t… |
CVE-2024-4920 | High | 7.3 | 2024-05-16 | A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2024-4919 | Medium | 6.3 | 2024-05-16 | A vulnerability was found in Campcodes Online Examination System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /ad… |
CVE-2024-4918 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Online Examination System 1.0. It has been classified as critical. This affects an unknown part of the file updateQuesti… |
CVE-2024-4917 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Online Examination System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2024-4916 | Medium | 6.3 | 2024-05-15 | A vulnerability has been found in Campcodes Online Examination System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-4915 | Medium | 6.3 | 2024-05-15 | A vulnerability, which was classified as critical, was found in Campcodes Online Examination System 1.0. Affected is an unknown function of the file result.php… |
CVE-2024-4914 | Medium | 6.3 | 2024-05-15 | A vulnerability, which was classified as critical, has been found in Campcodes Online Examination System 1.0. This issue affects some unknown processing of the… |
CVE-2024-35184 | Medium | 5.5 | 2024-05-15 | Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to versi… |
CVE-2024-35183 | Medium | 4.4 | 2024-05-15 | wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent t… |
CVE-2024-4976 | Medium | 5.5 | 2024-05-15 | Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference. |
CVE-2024-4950 | Medium | 6.5 | 2024-05-15 | Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2024-4949 | Medium | 6.5 | 2024-05-15 | Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-4948 | Medium | 6.5 | 2024-05-15 | Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2024-4947 | Critical | 9.6 | 2024-05-15 | Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2024-4913 | Medium | 6.3 | 2024-05-15 | A vulnerability classified as critical was found in Campcodes Online Examination System 1.0. This vulnerability affects unknown code of the file exam.php. The… |
CVE-2024-4912 | Medium | 6.3 | 2024-05-15 | A vulnerability classified as critical has been found in Campcodes Online Examination System 1.0. This affects an unknown part of the file addExamExe.php. The… |
CVE-2024-4911 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. Affected by this issue is some unknown f… |
CVE-2024-27244 | Medium | 6.7 | 2024-05-15 | Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalatio… |
CVE-2024-27243 | Medium | 6.5 | 2024-05-15 | Buffer overflow in some Zoom Workplace Apps and SDK’s may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-4910 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. Affected by this vulnerability is an… |
CVE-2024-4904 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Byzoro Smart S200 Management Platform up to 20240507. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2024-34913 | Medium | 5.4 | 2024-05-15 | An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-34909 | Medium | 5.4 | 2024-05-15 | An arbitrary file upload vulnerability in KYKMS v1.0.1 and below allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-34906 | Medium | 5.4 | 2024-05-15 | An arbitrary file upload vulnerability in dootask v0.30.13 allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-34025 | Critical | 9.8 | 2024-05-15 | CyberPower PowerPanel business application code contains a hard-coded set of authentication credentials. This could result in an attacker bypassing authentica… |
CVE-2024-33625 | Critical | 9.8 | 2024-05-15 | CyberPower PowerPanel business application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokens to bypass authenti… |
CVE-2024-33615 | High | 8.8 | 2024-05-15 | A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel server, which allows file writing to the ser… |
CVE-2024-32053 | Critical | 9.8 | 2024-05-15 | Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. This could result in… |
CVE-2024-32047 | Critical | 9.8 | 2024-05-15 | Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gaining access to the… |
CVE-2024-32042 | Medium | 4.9 | 2024-05-15 | The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered. |
CVE-2024-31856 | High | 8.8 | 2024-05-15 | An attacker with certain MQTT permissions can create malicious messages to all CyberPower PowerPanel devices. This could result in an attacker injecting SQL… |
CVE-2024-31410 | High | 7.7 | 2024-05-15 | The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate… |
CVE-2024-31409 | Medium | 6.5 | 2024-05-15 | Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after… |
CVE-2024-4909 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. Affected is an unknown function of… |
CVE-2024-4908 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This issue affects some unknown processing o… |
CVE-2024-4907 | Medium | 6.3 | 2024-05-15 | A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This vulnerability affects unknown code… |
CVE-2024-4906 | Medium | 6.3 | 2024-05-15 | A vulnerability, which was classified as critical, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the… |
CVE-2024-35102 | High | 8.8 | 2024-05-15 | Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a crafted script. |
CVE-2024-4905 | Medium | 6.3 | 2024-05-15 | A vulnerability classified as critical has been found in Kashipara College Management System 1.0. Affected is an unknown function of the file view_students_eac… |
CVE-2024-3182 | Medium | 6.5 | 2024-05-15 | Install-type password disclosure vulnerability in Universal Installer including the Silent Installer in TIBCO Hawk versions 6.2.0, 6.2.1, 6.2.2 and 6.2.3 allow… |
CVE-2024-25743 | High | 7.1 | 2024-05-15 | In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIGFPE signal handler… |
CVE-2024-20394 | Medium | 5.5 | 2024-05-15 | A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service (DoS) condition on an… |
CVE-2024-20392 | Medium | 6.1 | 2024-05-15 | A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to con… |
CVE-2024-20391 | Medium | 6.8 | 2024-05-15 | A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected d… |
CVE-2024-20383 | Medium | 4.8 | 2024-05-15 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote att… |
CVE-2024-20369 | Medium | 4.7 | 2024-05-15 | A vulnerability in the web-based management interface of Cisco Crosswork Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to… |
CVE-2024-20366 | High | 7.8 | 2024-05-15 | A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow a… |
CVE-2024-20258 | Medium | 6.1 | 2024-05-15 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an… |
CVE-2024-20257 | Medium | 4.8 | 2024-05-15 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated, remote attacker to… |
CVE-2024-20256 | Medium | 4.8 | 2024-05-15 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an… |
CVE-2024-4837 | Medium | 5.3 | 2024-05-15 | In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restr… |
CVE-2024-4622 | | 2024-05-15 | If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not chang… | |
CVE-2024-4357 | Medium | 6.5 | 2024-05-15 | An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to re… |
CVE-2024-4202 | High | 7.7 | 2024-05-15 | In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability. |
CVE-2024-4200 | High | 7.7 | 2024-05-15 | In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.2.514), a code execution attack is possible by a local threat actor through an insecure dese… |
CVE-2024-3970 | Medium | 5.3 | 2024-05-15 | Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure by directory… |
CVE-2024-3968 | High | 7.8 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution using custom file upload task. |
CVE-2024-3967 | High | 7.6 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution unisng unsafe java object deser… |
CVE-2024-3892 | High | 7.2 | 2024-05-15 | A local code execution vulnerability is possible in Telerik UI for WinForms beginning in v2021.1.122 but prior to v2024.2.514. This vulnerability could allow a… |
CVE-2024-3488 | Medium | 5.6 | 2024-05-15 | File Upload vulnerability in unauthenticated session found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file withou… |
CVE-2024-3487 | Low | 3.5 | 2024-05-15 | Broken Authentication vulnerability discovered in OpenText™ iManager 3.2.6.0200. This vulnerability allows an attacker to manipulate certain parameters to bypa… |
CVE-2024-3486 | High | 7.8 | 2024-05-15 | XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution. |
CVE-2024-3485 | Medium | 5.3 | 2024-05-15 | Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure. |
CVE-2024-3484 | Medium | 5.7 | 2024-05-15 | Path Traversal found in OpenText™ iManager 3.2.6.0200. This can lead to privilege escalation or file disclosure. |
CVE-2024-3483 | High | 7.8 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues… |
CVE-2024-34082 | High | 8.5 | 2024-05-15 | Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax… |
CVE-2024-28087 | Medium | 6.5 | 2024-05-15 | In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition an… |
CVE-2024-28042 | High | 8.4 | 2024-05-15 | SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center. |
CVE-2024-27593 | Medium | 5.4 | 2024-05-15 | A stored cross-site scripting (XSS) vulnerability in the Filter function of Eramba Version 3.22.3 Community Edition allows authenticated attackers to execute a… |
CVE-2024-4903 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Tongda OA 2017. It has been declared as critical. This vulnerability affects unknown code of the file /general/meeting/manage/dele… |
CVE-2024-3319 | Critical | 9.1 | 2024-05-15 | An issue was identified in the Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administ… |
CVE-2024-3318 | Medium | 4.2 | 2024-05-15 | A file path traversal vulnerability was identified in the DelimitedFileConnector Cloud Connector that allowed an authenticated administrator to set arbitrary c… |
CVE-2024-3317 | Medium | 6.5 | 2024-05-15 | An improper access control was identified in the Identity Security Cloud (ISC) message server API that allowed an authenticated user to exfiltrate job processi… |
CVE-2024-35179 | Medium | 6.8 | 2024-05-15 | Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using `RUN_AS_USER`, the specified user (and therefore, web interface admins)… |
CVE-2024-31216 | Medium | 5.1 | 2024-05-15 | The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatibl… |
CVE-2024-34955 | Critical | 9.8 | 2024-05-15 | Code-projects Budget Management 1.0 is vulnerable to SQL Injection via the delete parameter. |
CVE-2024-34954 | Medium | 6.1 | 2024-05-15 | Code-projects Budget Management 1.0 is vulnerable to Cross Site Scripting (XSS) via the budget parameter. |
CVE-2024-27353 | High | 7.4 | 2024-05-15 | A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46… |
CVE-2024-25079 | High | 7.4 | 2024-05-15 | A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel… |
CVE-2024-25078 | High | 7.4 | 2024-05-15 | A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB19130163 in 05.38.0… |
CVE-2024-4670 | High | 8.8 | 2024-05-15 | The All-in-One Video Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.5 via the aiovg_search_form s… |
CVE-2024-2248 | Medium | 6.4 | 2024-05-15 | A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end us… |
CVE-2024-4702 | Medium | 6.4 | 2024-05-15 | The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 1.2.1… |
CVE-2024-34101 | Medium | 5.5 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sen… |
CVE-2024-34100 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-34099 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code exe… |
CVE-2024-34098 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code e… |
CVE-2024-34097 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-34096 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-34095 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-34094 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-30312 | Medium | 5.5 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sen… |
CVE-2024-30311 | Medium | 5.5 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sen… |
CVE-2024-30310 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code executi… |
CVE-2024-30284 | High | 7.8 | 2024-05-15 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-4010 | High | 8.8 | 2024-05-15 | The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a mis… |
CVE-2024-4636 | Medium | 6.4 | 2024-05-15 | The Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘allow_meme_… |
CVE-2024-3824 | Medium | 5.5 | 2024-05-15 | The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a… |