2024 CVEs (page 290)
Page 290 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34244 | High | 7.5 | 2024-05-08 | libmodbus v3.1.10 is vulnerable to Buffer Overflow via the modbus_write_bits function. This issue can be triggered when the function is fed with specially craf… |
CVE-2024-33382 | Medium | 5.3 | 2024-05-08 | An issue in Open5GS v.2.7.0 allows an attacker to cause a denial of service via the 64 unsuccessful UE/gnb registration |
CVE-2024-25533 | Critical | 9.4 | 2024-05-08 | Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.aspx). This vulnerability can a… |
CVE-2024-25532 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /include/get_dict.aspx. |
CVE-2024-25528 | Medium | 5.9 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx. |
CVE-2024-31961 | Critical | 9.8 | 2024-05-08 | A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands via the level2 parame… |
CVE-2024-28971 | Low | 3.5 | 2024-05-08 | Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker c… |
CVE-2024-25531 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCondiction.aspx. |
CVE-2024-25530 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get_find_condiction.aspx. |
CVE-2024-25529 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_office_file_history_show.aspx. |
CVE-2024-25527 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx. |
CVE-2024-24908 | Medium | 6.5 | 2024-05-08 | Dell PowerProtect DM5500 version 5.15.0.0 and prior contain an Arbitrary File Delete via Path Traversal vulnerability. A remote attacker with high privileges c… |
CVE-2024-24788 | Medium | 5.9 | 2024-05-08 | A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop. |
CVE-2024-24787 | Medium | 6.4 | 2024-05-08 | On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library fl… |
CVE-2024-22460 | Low | 2.2 | 2024-05-08 | Dell PowerProtect DM5500 version 5.15.0.0 and prior contains an insecure deserialization Vulnerability. A remote attacker with high privileges could potentiall… |
CVE-2024-4654 | Medium | 6.3 | 2024-05-08 | A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /x… |
CVE-2024-4653 | Medium | 6.3 | 2024-05-08 | A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2024-3951 | High | 7.1 | 2024-05-08 | PTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code. |
CVE-2024-34347 | High | 8.3 | 2024-05-08 | @hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox th… |
CVE-2024-33612 | Medium | 6.8 | 2024-05-08 | An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system. N… |
CVE-2024-33608 | High | 7.5 | 2024-05-08 | When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions w… |
CVE-2024-33604 | Medium | 6.1 | 2024-05-08 | A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript i… |
CVE-2024-32980 | Critical | 9.1 | 2024-05-08 | Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applicati… |
CVE-2024-32761 | Medium | 6.5 | 2024-05-08 | Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This le… |
CVE-2024-32113 | Critical | 9.8 | 2024-05-08 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. … |
CVE-2024-32049 | High | 7.4 | 2024-05-08 | BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials. Note: Software version… |
CVE-2024-31156 | High | 8.0 | 2024-05-08 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript… |
CVE-2024-28889 | Medium | 5.9 | 2024-05-08 | When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the atta… |
CVE-2024-28883 | High | 7.4 | 2024-05-08 | An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to by… |
CVE-2024-28132 | Medium | 4.4 | 2024-05-08 | Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive in… |
CVE-2024-27202 | Medium | 4.7 | 2024-05-08 | A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScri… |
CVE-2024-26579 | Critical | 9.8 | 2024-05-08 | Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, the attackers can bypass using… |
CVE-2024-26026 | High | 7.5 | 2024-05-08 | An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS)… |
CVE-2024-25560 | High | 7.5 | 2024-05-08 | When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software vers… |
CVE-2024-25526 | High | 8.1 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project_id parameter at /ProjectManage/pm_gatt_inc.aspx. |
CVE-2024-25525 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload.aspx. |
CVE-2024-25524 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPlan/WorkPlanAttachDownLoad.asp… |
CVE-2024-25523 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /filemanage/file_memo.aspx. |
CVE-2024-25522 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter at /WorkFlow/wf_work_form_save.aspx. |
CVE-2024-25521 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_company.aspx. |
CVE-2024-25520 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtemplate_new.aspx. |
CVE-2024-25519 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wf_work_print.aspx. |
CVE-2024-25518 | Critical | 9.4 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /WorkFlow/wf_get_fields_approve.aspx. |
CVE-2024-25517 | Critical | 9.8 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx. |
CVE-2024-25515 | High | 7.3 | 2024-05-08 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_work_finish_file_down.a… |
CVE-2024-21793 | High | 7.5 | 2024-05-08 | An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoT… |
CVE-2024-4652 | Low | 3.5 | 2024-05-08 | A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function o… |
CVE-2024-4651 | Low | 3.5 | 2024-05-08 | A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. This issue affects some unkn… |
CVE-2024-4650 | Low | 3.5 | 2024-05-08 | A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. This vulnerability affects unknown code of th… |
CVE-2024-4649 | Low | 3.5 | 2024-05-08 | A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file… |
CVE-2024-4233 | Medium | 4.3 | 2024-05-08 | Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arco… |
CVE-2024-33574 | Medium | 4.3 | 2024-05-08 | Missing Authorization vulnerability in appsbd Vitepos.This issue affects Vitepos: from n/a through 3.0.1. |
CVE-2024-33573 | Medium | 4.3 | 2024-05-08 | Missing Authorization vulnerability in EPROLO EPROLO Dropshipping.This issue affects EPROLO Dropshipping: from n/a through 1.7.1. |
CVE-2024-32886 | Medium | 4.9 | 2024-05-08 | Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop th… |
CVE-2024-31270 | High | 7.6 | 2024-05-08 | Missing Authorization vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1. |
CVE-2024-30459 | Medium | 5.3 | 2024-05-08 | Missing Authorization vulnerability in AIpost AI WP Writer.This issue affects AI WP Writer: from n/a through 3.6.5. |
CVE-2024-24833 | Medium | 4.3 | 2024-05-08 | Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons.This issue affects Happy Addons for Elementor: from n/a t… |
CVE-2024-4648 | Low | 3.5 | 2024-05-08 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. Affected by this issue is some unknow… |
CVE-2024-4647 | Low | 3.5 | 2024-05-08 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. Affected by this vulnerability is… |
CVE-2024-4646 | Low | 3.5 | 2024-05-08 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is an unknown function… |
CVE-2024-4645 | Low | 3.5 | 2024-05-08 | A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file… |
CVE-2024-34255 | Medium | 6.1 | 2024-05-08 | jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function. |
CVE-2024-1438 | High | 7.7 | 2024-05-08 | Missing Authorization vulnerability in PressFore Rolo Slider.This issue affects Rolo Slider: from n/a through 1.0.9. |
CVE-2024-4644 | Low | 3.5 | 2024-05-08 | A vulnerability has been found in SourceCodester Prison Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the fil… |
CVE-2024-34561 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF E… |
CVE-2024-34560 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GOMO gee Search Plus allows Stored XSS.This issue affects… |
CVE-2024-34558 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF allows Stored XSS.This issue affects WOLF… |
CVE-2024-34553 | High | 7.1 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core allows Reflected XSS.This is… |
CVE-2024-34548 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affect… |
CVE-2024-34547 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor alam Magical Addons For Elementor allows Stored XSS… |
CVE-2024-34546 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Sticky Social Link sticky-social-link allo… |
CVE-2024-34414 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nobita allows Stored XSS.This issue affects raindrops: fr… |
CVE-2024-3507 | High | 7.7 | 2024-05-08 | Improper privilege management vulnerability in Lunar software that affects versions 6.0.2 through 6.6.0. This vulnerability allows an attacker to perform a sec… |
CVE-2024-34570 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This issue a… |
CVE-2024-34569 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from… |
CVE-2024-34568 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeqx LetterPress allows Stored XSS.This issue affects… |
CVE-2024-34566 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) al… |
CVE-2024-34565 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debug Info allows Stored XSS.This issue affects Debug Inf… |
CVE-2024-34564 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt Inc. Counter Up allows Stored XSS.This issue af… |
CVE-2024-34563 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoldAddons Gold Addons for Elementor allows Stored XSS.Th… |
CVE-2024-34562 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moveaddons Move Addons for Elementor allows Stored XSS.Th… |
CVE-2024-4281 | Medium | 6.4 | 2024-05-08 | The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' shortcode in all versions up to, and includi… |
CVE-2024-4135 | Medium | 5.4 | 2024-05-08 | The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin… |
CVE-2024-34572 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePrix Fancy Elementor Flipbox fancy-elementor-flipbox… |
CVE-2024-34571 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects… |
CVE-2024-4438 | High | 7.5 | 2024-05-08 | The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occu… |
CVE-2024-4437 | High | 7.5 | 2024-05-08 | The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Re… |
CVE-2024-4436 | High | 7.5 | 2024-05-08 | The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2022-41723. This issue occurs because the etcd package in the Re… |
CVE-2024-34574 | Medium | 5.9 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpsoul Table Maker allows Stored XSS.This issue affects T… |
CVE-2024-34573 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pootlepress Pootle Pagebuilder – WordPress Page builder a… |
CVE-2024-3494 | Medium | 6.4 | 2024-05-08 | The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerize_contact_form' shortcode in all versions u… |
CVE-2024-1076 | Medium | 6.5 | 2024-05-08 | The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to… |
CVE-2024-32674 | Medium | 5.4 | 2024-05-08 | Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be ex… |
CVE-2024-22266 | Medium | 6.5 | 2024-05-08 | VMware Avi Load Balancer contains an information disclosure vulnerability. A malicious actor with access to the system logs can view cloud connection credenti… |
CVE-2024-22264 | High | 7.2 | 2024-05-08 | VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious actor with admin privileges on VMware Avi Load Balancer can create, modify… |
CVE-2024-4418 | Medium | 6.2 | 2024-05-08 | A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` point… |
CVE-2024-4393 | Critical | 9.8 | 2024-05-08 | The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification… |
CVE-2024-4162 | Medium | 4.4 | 2024-05-08 | A buffer error in Panasonic KW Watcher versions 1.00 through 2.83 may allow attackers malicious read access to memory. |
CVE-2024-2860 | High | 7.8 | 2024-05-08 | The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM wh… |
CVE-2024-2746 | High | 8.8 | 2024-05-08 | Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged u… |