2024 CVEs (page 290)
Page 290 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-28889 | Medium | 5.9 | 2024-05-08 | When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the atta… |
CVE-2024-28883 | High | 7.4 | 2024-05-08 | An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to by… |
CVE-2024-28132 | Medium | 4.4 | 2024-05-08 | Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive in… |
CVE-2024-27202 | Medium | 4.7 | 2024-05-08 | A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScri… |
CVE-2024-26579 | Critical | 9.8 | 2024-05-08 | Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, the attackers can bypass using… |
CVE-2024-26026 | High | 7.5 | 2024-05-08 | An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS)… |
CVE-2024-25560 | High | 7.5 | 2024-05-08 | When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software vers… |
CVE-2024-25526 | High | 8.1 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project_id parameter at /ProjectManage/pm_gatt_inc.aspx. |
CVE-2024-25525 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload.aspx. |
CVE-2024-25524 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPlan/WorkPlanAttachDownLoad.asp… |
CVE-2024-25523 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /filemanage/file_memo.aspx. |
CVE-2024-25522 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter at /WorkFlow/wf_work_form_save.aspx. |
CVE-2024-25521 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_company.aspx. |
CVE-2024-25520 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtemplate_new.aspx. |
CVE-2024-25519 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wf_work_print.aspx. |
CVE-2024-25518 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /WorkFlow/wf_get_fields_approve.aspx. |
CVE-2024-25517 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx. |
CVE-2024-25515 | High | 7.3 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_work_finish_file_down.a… |
CVE-2024-21793 | High | 7.5 | 2024-05-08 | An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoT… |
CVE-2024-4652 | Low | 3.5 | 2024-05-08 | A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function o… |
CVE-2024-4651 | Low | 3.5 | 2024-05-08 | A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. This issue affects some unkn… |
CVE-2024-4650 | Low | 3.5 | 2024-05-08 | A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. This vulnerability affects unknown code of th… |
CVE-2024-4649 | Low | 3.5 | 2024-05-08 | A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file… |
CVE-2024-4233 | Medium | 4.3 | 2024-05-08 | Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arco… |
CVE-2024-33574 | Medium | 4.3 | 2024-05-08 | Missing Authorization vulnerability in appsbd Vitepos.This issue affects Vitepos: from n/a through 3.0.1. |
CVE-2024-33573 | Medium | 4.3 | 2024-05-08 | Missing Authorization vulnerability in EPROLO EPROLO Dropshipping.This issue affects EPROLO Dropshipping: from n/a through 1.7.1. |
CVE-2024-32886 | Medium | 4.9 | 2024-05-08 | Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop th… |
CVE-2024-31270 | High | 7.6 | 2024-05-08 | Missing Authorization vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1. |
CVE-2024-30459 | Medium | 5.3 | 2024-05-08 | Missing Authorization vulnerability in AIpost AI WP Writer.This issue affects AI WP Writer: from n/a through 3.6.5. |
CVE-2024-24833 | Medium | 4.3 | 2024-05-08 | Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons.This issue affects Happy Addons for Elementor: from n/a t… |
CVE-2024-4648 | Low | 3.5 | 2024-05-08 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. Affected by this issue is some unknow… |
CVE-2024-4647 | Low | 3.5 | 2024-05-08 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. Affected by this vulnerability is… |
CVE-2024-4646 | Low | 3.5 | 2024-05-08 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is an unknown function… |
CVE-2024-4645 | Low | 3.5 | 2024-05-08 | A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file… |
CVE-2024-34255 | Medium | 6.1 | 2024-05-08 | jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function. |
CVE-2024-1438 | High | 7.7 | 2024-05-08 | Missing Authorization vulnerability in PressFore Rolo Slider.This issue affects Rolo Slider: from n/a through 1.0.9. |
CVE-2024-4644 | Low | 3.5 | 2024-05-08 | A vulnerability has been found in SourceCodester Prison Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the fil… |
CVE-2024-34561 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF E… |
CVE-2024-34560 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GOMO gee Search Plus allows Stored XSS.This issue affects… |
CVE-2024-34558 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF allows Stored XSS.This issue affects WOLF… |
CVE-2024-34553 | High | 7.1 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core allows Reflected XSS.This is… |
CVE-2024-34548 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affect… |
CVE-2024-34547 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor alam Magical Addons For Elementor allows Stored XSS… |
CVE-2024-34546 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Sticky Social Link sticky-social-link allo… |
CVE-2024-34414 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nobita allows Stored XSS.This issue affects raindrops: fr… |
CVE-2024-3507 | High | 7.7 | 2024-05-08 | Improper privilege management vulnerability in Lunar software that affects versions 6.0.2 through 6.6.0. This vulnerability allows an attacker to perform a sec… |
CVE-2024-34570 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This issue a… |
CVE-2024-34569 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from… |
CVE-2024-34568 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeqx LetterPress allows Stored XSS.This issue affects… |
CVE-2024-34566 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) al… |
CVE-2024-34565 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debug Info allows Stored XSS.This issue affects Debug Inf… |
CVE-2024-34564 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt Inc. Counter Up allows Stored XSS.This issue af… |
CVE-2024-34563 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoldAddons Gold Addons for Elementor allows Stored XSS.Th… |
CVE-2024-34562 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moveaddons Move Addons for Elementor allows Stored XSS.Th… |
CVE-2024-4281 | Medium | 6.4 | 2024-05-08 | The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' shortcode in all versions up to, and includi… |
CVE-2024-4135 | Medium | 5.4 | 2024-05-08 | The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin… |
CVE-2024-34572 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePrix Fancy Elementor Flipbox fancy-elementor-flipbox… |
CVE-2024-34571 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects… |
CVE-2024-4438 | High | 7.5 | 2024-05-08 | The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occu… |
CVE-2024-4437 | High | 7.5 | 2024-05-08 | The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Re… |
CVE-2024-4436 | High | 7.5 | 2024-05-08 | The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2022-41723. This issue occurs because the etcd package in the Re… |
CVE-2024-34574 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpsoul Table Maker allows Stored XSS.This issue affects T… |
CVE-2024-34573 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pootlepress Pootle Pagebuilder – WordPress Page builder a… |
CVE-2024-3494 | Medium | 6.4 | 2024-05-08 | The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerize_contact_form' shortcode in all versions u… |
CVE-2024-1076 | Medium | 6.5 | 2024-05-08 | The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to… |
CVE-2024-32674 | Medium | 5.4 | 2024-05-08 | Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be ex… |
CVE-2024-22266 | Medium | 6.5 | 2024-05-08 | VMware Avi Load Balancer contains an information disclosure vulnerability. A malicious actor with access to the system logs can view cloud connection credenti… |
CVE-2024-22264 | High | 7.2 | 2024-05-08 | VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious actor with admin privileges on VMware Avi Load Balancer can create, modify… |
CVE-2024-4418 | Medium | 6.2 | 2024-05-08 | A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` point… |
CVE-2024-4393 | Critical | 9.8 | 2024-05-08 | The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification… |
CVE-2024-4162 | Medium | 4.4 | 2024-05-08 | A buffer error in Panasonic KW Watcher versions 1.00 through 2.83 may allow attackers malicious read access to memory. |
CVE-2024-2860 | High | 7.8 | 2024-05-08 | The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM wh… |
CVE-2024-2746 | High | 8.8 | 2024-05-08 | Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged u… |
CVE-2024-1930 | Medium | 6.5 | 2024-05-08 | No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Lim… |
CVE-2024-1929 | High | 7.5 | 2024-05-08 | Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configu… |
CVE-2024-4456 | Medium | 4.1 | 2024-05-08 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page. |
CVE-2024-23551 | Medium | 6.5 | 2024-05-07 | Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a… |
CVE-2024-4030 | High | 7.1 | 2024-05-07 | On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other… |
CVE-2024-34346 | High | 8.4 | 2024-05-07 | Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write acces… |
CVE-2024-27273 | High | 8.1 | 2024-05-07 | IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could potentially expose applications using Unix domain datagram so… |
CVE-2024-23713 | High | 7.8 | 2024-05-07 | In migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications settings due to improper input validation… |
CVE-2024-23712 | Medium | 5.5 | 2024-05-07 | In multiple functions of AppOpsService.java, there is a possible way to saturate the content of /data/system/appops_accesses.xml due to resource exhaustion. Th… |
CVE-2024-23710 | High | 7.8 | 2024-05-07 | In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a privileged app due to a log… |
CVE-2024-23709 | Medium | 6.5 | 2024-05-07 | In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no addition… |
CVE-2024-23708 | High | 7.8 | 2024-05-07 | In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed. This… |
CVE-2024-23707 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additi… |
CVE-2024-23706 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. This could lead to local escalation of privil… |
CVE-2024-23705 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escalatio… |
CVE-2024-23704 | High | 7.8 | 2024-05-07 | In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check. This coul… |
CVE-2024-0043 | High | 7.8 | 2024-05-07 | In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the code. This could lead… |
CVE-2024-0042 | High | 7.8 | 2024-05-07 | In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead to local bypass of DRM content protecti… |
CVE-2024-0027 | Medium | 5.5 | 2024-05-07 | In multiple functions of SnoozeHelper.java, there is a possible way to cause a boot loop due to resource exhaustion. This could lead to local denial of service… |
CVE-2024-0026 | Medium | 5.5 | 2024-05-07 | In multiple functions of SnoozeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of ser… |
CVE-2024-0025 | High | 7.8 | 2024-05-07 | In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. This could lead to local escalation of… |
CVE-2024-0024 | High | 7.8 | 2024-05-07 | In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due to improper input validation. This coul… |
CVE-2024-0022 | Medium | 5.5 | 2024-05-07 | In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another user profile due to i… |
CVE-2024-4559 | Medium | 6.5 | 2024-05-07 | Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2024-4558 | Critical | 9.6 | 2024-05-07 | Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2024-34315 | High | 7.5 | 2024-05-07 | CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action method of /admin/templa… |
CVE-2024-34314 | Medium | 4.9 | 2024-05-07 | CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template… |