2024 CVEs (page 283)

Page 283 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.

All CVEs published in 2024 — newest first (page 283 of 385)
CVESeverityScorePublishedSummary
CVE-2024-30006High8.82024-05-14Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-30005Medium6.82024-05-14Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30004Medium6.82024-05-14Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30003Medium6.82024-05-14Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30002Medium6.82024-05-14Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30001Medium6.82024-05-14Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30000Medium6.82024-05-14Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-29999Medium6.82024-05-14Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-29998Medium6.82024-05-14Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-29997Medium6.82024-05-14Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-29996High7.82024-05-14Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2024-29994High7.82024-05-14Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability
CVE-2024-27109High7.62024-05-14Insufficiently protected credentials in GE HealthCare EchoPAC products
CVE-2024-27108Medium6.82024-05-14Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
CVE-2024-27107Critical9.62024-05-14Weak account password in GE HealthCare EchoPAC products
CVE-2024-27106Medium5.72024-05-14Vulnerable data in transit in GE HealthCare EchoPAC products
CVE-2024-26238High7.82024-05-14Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability
CVE-2024-26007Medium5.32024-05-14An improper check or handling of exceptional conditions vulnerability [CWE-703] in Fortinet FortiOS version 7.4.1 allows an unauthenticated attacker to provoke…
CVE-2024-23105High7.52024-05-14A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthentica…
CVE-2024-1630High7.72024-05-14Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component
CVE-2024-1629Medium6.22024-05-14Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component
CVE-2024-4871Medium6.82024-05-14A vulnerability was found in Satellite. When running a remote execution job on a host, the host's SSH key is not being checked. When the key changes, the Satel…
CVE-2024-4860Medium5.42024-05-14The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization o…
CVE-2024-4859Medium5.72024-05-14Solidus <= 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL.
CVE-2024-4761High8.82024-05-14Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page…
CVE-2024-4624Medium6.42024-05-14The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to Stored Cross-Site Sc…
CVE-2024-4473Medium6.42024-05-14The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including…
CVE-2024-4445Medium6.52024-05-14The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the…
CVE-2024-4440Medium6.42024-05-14The 140+ Widgets | Best Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions…
CVE-2024-4392Medium6.42024-05-14The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all…
CVE-2024-4333Medium6.42024-05-14The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress i…
CVE-2024-4144Medium6.52024-05-14The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502…
CVE-2024-4139Medium4.32024-05-14Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By e…
CVE-2024-4138Medium4.32024-05-14Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By e…
CVE-2024-3579Medium6.12024-05-14Open-source project Online Shopping System Advanced is vulnerable to Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafte…
CVE-2024-3374Medium5.32024-05-14An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exce…
CVE-2024-3372High7.52024-05-14Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause u…
CVE-2024-3241Medium5.42024-05-14The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the…
CVE-2024-35012Medium6.32024-05-14idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=add&nohrefStr=close.
CVE-2024-35011Medium5.42024-05-14idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=rev&nohrefStr=close.
CVE-2024-35010High8.82024-05-14idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/banner_deal.php?mudi=del&dataType=&dataTypeCN=%E5%9B%BE%E7%…
CVE-2024-35009High8.82024-05-14idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=&fieldName=state&fiel…
CVE-2024-34950High7.52024-05-14D-Link DIR-822+ v1.0.5 was discovered to contain a stack-based buffer overflow vulnerability in the SetNetworkTomographySettings module.
CVE-2024-34914Medium5.32024-05-14php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember_key value. This allows attackers to bruteforce to br…
CVE-2024-34773High7.82024-05-14A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2). The affected applications contain a stack overflow vulnerability while pars…
CVE-2024-34772High7.82024-05-14A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 4). The affected applications contain an out of bounds read past the end of an…
CVE-2024-34771High7.82024-05-14A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2). The affected application is vulnerable to heap-based buffer overflow while…
CVE-2024-34717Medium5.32024-05-14PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a…
CVE-2024-34716Critical9.62024-05-14PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature…
CVE-2024-34714High7.62024-05-14The Hoppscotch Browser Extension is a browser extension for Hoppscotch, a community-driven end-to-end open-source API development ecosystem. Due to an oversigh…
CVE-2024-34713Low3.52024-05-14sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authori…
CVE-2024-34712Medium6.52024-05-14Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBan` is not url-encod…
CVE-2024-34687Medium6.52024-05-14SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerab…
CVE-2024-34358Medium5.32024-05-14TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1…
CVE-2024-34357Medium5.42024-05-14TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1…
CVE-2024-34356Medium5.42024-05-14TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1…
CVE-2024-34355Low3.52024-05-14TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML inje…
CVE-2024-34256Critical9.82024-05-14OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.
CVE-2024-34243Medium5.42024-05-14Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter.
CVE-2024-34191Medium6.52024-05-14htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete_post() function at admin.php. This vulnerability allows attacker…
CVE-2024-34086High7.82024-05-14A vulnerability has been identified in JT2Go (All versions < V2312.0001), Teamcenter Visualization V14.1 (All versions < V14.1.0.13), Teamcenter Visualization…
CVE-2024-34085High7.82024-05-14A vulnerability has been identified in JT2Go (All versions < V2312.0001), Teamcenter Visualization V14.1 (All versions < V14.1.0.13), Teamcenter Visualization…
CVE-2024-33868Critical9.82024-05-14An issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection.
CVE-2024-33867Medium4.82024-05-14An issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt.
CVE-2024-33866Medium5.52024-05-14An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/DocumentTemplate/{GUID] XSS.
CVE-2024-33865High7.52024-05-14An issue was discovered in linqi before 1.4.0.1 on Windows. There is an NTLM hash leak via the /api/Cdn/GetFile and /api/DocumentTemplate/{GUID] endpoints.
CVE-2024-33864Medium5.92024-05-14An issue was discovered in linqi before 1.4.0.1 on Windows. There is SSRF via Document template generation; i.e., via remote images in process creation, file i…
CVE-2024-33863Critical9.82024-05-14An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/Cdn/GetFile local file inclusion.
CVE-2024-33647Medium6.52024-05-14A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper acc…
CVE-2024-33583Low3.32024-05-14A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (…
CVE-2024-33577High7.82024-05-14A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain a stack overflow vulnerability while parsing s…
CVE-2024-33499Critical9.12024-05-14A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (…
CVE-2024-33498Medium5.32024-05-14A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (…
CVE-2024-33497Medium6.32024-05-14A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (…
CVE-2024-33496Medium6.32024-05-14A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (…
CVE-2024-33495Medium6.52024-05-14A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (…
CVE-2024-33494Medium6.52024-05-14A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (…
CVE-2024-33493High7.82024-05-14A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an…
CVE-2024-33492High7.82024-05-14A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an…
CVE-2024-33491High7.82024-05-14A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an…
CVE-2024-33490High7.82024-05-14A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an…
CVE-2024-33489High7.82024-05-14A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow while…
CVE-2024-33009Medium4.22024-05-14SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database commands resulting…
CVE-2024-33008Medium4.92024-05-14SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD. This could result in crashing the Replication Server due to memor…
CVE-2024-33007Low3.52024-05-14PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded Java…
CVE-2024-33006Critical9.62024-05-14 An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system. 
CVE-2024-33004Medium4.32024-05-14SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On succes…
CVE-2024-33002Medium6.12024-05-14Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) v…
CVE-2024-33000Low3.52024-05-14SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a…
CVE-2024-32977High7.12024-05-14OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows a…
CVE-2024-32742High7.62024-05-14A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains an unrestricted USB port. An attacker with local acc…
CVE-2024-32741Critical10.02024-05-14A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains hard coded password which is used for the privileged…
CVE-2024-32740Critical9.82024-05-14A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains undocumented users and credentials. An attacker coul…
CVE-2024-32733Medium6.12024-05-14 Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attac…
CVE-2024-32731Medium5.52024-05-14 SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploit…
CVE-2024-32639High7.82024-05-14A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0011). The affected application contains an out of bounds write…
CVE-2024-32637Low3.32024-05-14A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization…
CVE-2024-32636High7.82024-05-14A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization…
CVE-2024-32635High7.82024-05-14A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization…
CVE-2024-32355High8.02024-05-14TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setSSServer function.