2024 CVEs (page 291)
Page 291 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25514 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /SysManage/wf_template_child_field_list.aspx. |
CVE-2024-25513 | High | 7.8 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /CorporateCulture/kaizen_download.aspx. |
CVE-2024-25511 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_new.aspx. |
CVE-2024-25510 | Critical | 9.8 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_show.aspx. |
CVE-2024-25509 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_file_download.aspx. |
CVE-2024-34517 | Medium | 6.5 | 2024-05-07 | The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access. |
CVE-2024-34397 | Medium | 5.2 | 2024-05-07 | An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system… |
CVE-2024-25512 | High | 8.1 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attach_id parameter at /Bulletin/AttachDownLoad.aspx. |
CVE-2024-25508 | Critical | 9.8 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletin_template_show.aspx. |
CVE-2024-25507 | Critical | 9.4 | 2024-05-07 | RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email_attach_id parameter at /LHMail/AttachDown.aspx. |
CVE-2024-33860 | Medium | 6.5 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion (LFI) when an arbitrary File Path is used within the File System Collector. Th… |
CVE-2024-33859 | Medium | 6.1 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS. |
CVE-2024-33164 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function. |
CVE-2024-33161 | Medium | 5.3 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function. |
CVE-2024-33155 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function. |
CVE-2024-33153 | Critical | 9.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function. |
CVE-2024-33149 | High | 8.1 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function. |
CVE-2024-33148 | High | 7.3 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function. |
CVE-2024-33147 | High | 8.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function. |
CVE-2024-29210 | Low | 2.8 | 2024-05-07 | A local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifically within its configuration management… |
CVE-2024-29209 | Medium | 6.0 | 2024-05-07 | A medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an attacker to remotely ex… |
CVE-2024-29208 | Low | 2.2 | 2024-05-07 | An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password. … |
CVE-2024-29207 | High | 7.5 | 2024-05-07 | An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affected Products: Uni… |
CVE-2024-29206 | Low | 2.2 | 2024-05-07 | An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the syst… |
CVE-2024-29150 | High | 8.8 | 2024-05-07 | An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. Because o… |
CVE-2024-29149 | High | 7.4 | 2024-05-07 | An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. Because o… |
CVE-2024-27982 | Medium | 6.5 | 2024-05-07 | The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggl… |
CVE-2024-4596 | Low | 3.7 | 2024-05-07 | A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Ha… |
CVE-2024-34341 | Medium | 5.4 | 2024-05-07 | Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web o… |
CVE-2024-33858 | Medium | 5.3 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The source_name parameter could… |
CVE-2024-33857 | Critical | 9.6 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the sy… |
CVE-2024-33856 | Medium | 5.3 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password end… |
CVE-2024-33748 | Medium | 4.1 | 2024-05-07 | Cross-site scripting (XSS) vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier. |
CVE-2024-33146 | Critical | 9.1 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function. |
CVE-2024-33144 | High | 8.8 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml. |
CVE-2024-33139 | High | 7.5 | 2024-05-07 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function. |
CVE-2024-4595 | Medium | 6.3 | 2024-05-07 | A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is the function locate of the file function.php… |
CVE-2024-4594 | Medium | 4.3 | 2024-05-07 | A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. Affected is an unknown function of the file /src/dede/sys_safe.php. The manipul… |
CVE-2024-34523 | High | 7.5 | 2024-05-07 | AChecker 1.5 allows remote attackers to read the contents of arbitrary files via the download.php path parameter by using Unauthenticated Path Traversal. This… |
CVE-2024-34342 | High | 7.1 | 2024-05-07 | react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the d… |
CVE-2024-34084 | High | 7.5 | 2024-05-07 | Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before the request has bee… |
CVE-2024-33124 | Critical | 9.8 | 2024-05-07 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the nodeTitle parameter in the parentNode() function.. |
CVE-2024-33122 | Medium | 6.3 | 2024-05-07 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the topic parameter in the list() function. |
CVE-2024-33120 | Critical | 9.8 | 2024-05-07 | Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function. This vulnerability allows… |
CVE-2024-32867 | Medium | 5.3 | 2024-05-07 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, various proble… |
CVE-2024-32664 | Medium | 5.3 | 2024-05-07 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, specially craf… |
CVE-2024-32663 | High | 7.5 | 2024-05-07 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, a small amount… |
CVE-2024-32371 | High | 7.5 | 2024-05-07 | An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a regular user account to escalate their privileges and gain administrative acces… |
CVE-2024-32370 | Critical | 9.8 | 2024-05-07 | An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafted payload to the id… |
CVE-2024-32369 | Medium | 4.3 | 2024-05-07 | SQL Injection vulnerability in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafte… |
CVE-2024-4593 | Medium | 4.3 | 2024-05-07 | A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. This issue affects some unknown processing of the file /src/dede/sys_multi… |
CVE-2024-4592 | Medium | 4.3 | 2024-05-07 | A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/sys_group_edit.php. The manip… |
CVE-2024-4591 | Medium | 4.3 | 2024-05-07 | A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/sys_group_add.php. The manipulation… |
CVE-2024-4590 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /src/dede/sys_info… |
CVE-2024-33783 | Medium | 6.5 | 2024-05-07 | MP-SPDZ v0.3.8 was discovered to contain a segmentation violation via the function osuCrypto::SilentMultiPprfReceiver::expand in /Tools/SilentPprf.cpp. This vu… |
CVE-2024-33782 | High | 7.5 | 2024-05-07 | MP-SPDZ v0.3.8 was discovered to contain a stack overflow via the function OTExtensionWithMatrix::extend in /OT/OTExtensionWithMatrix.cpp. This vulnerability a… |
CVE-2024-33781 | High | 7.5 | 2024-05-07 | MP-SPDZ v0.3.8 was discovered to contain a stack overflow via the function octetStream::get_bytes in /Tools/octetStream.cpp. This vulnerability allows attacker… |
CVE-2024-33780 | Medium | 6.5 | 2024-05-07 | MP-SPDZ v0.3.8 was discovered to contain a segmentation violation via the function osuCrypto::copyOut at /Tools/SilentPprf.cpp. This vulnerability allows attac… |
CVE-2024-33434 | Critical | 9.8 | 2024-05-07 | An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to… |
CVE-2024-31456 | High | 7.7 | 2024-05-07 | GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. Thi… |
CVE-2024-29889 | High | 7.1 | 2024-05-07 | GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searche… |
CVE-2024-28148 | Medium | 4.3 | 2024-05-07 | An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue a… |
CVE-2024-4589 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede… |
CVE-2024-4588 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/mytag_add.php. The manip… |
CVE-2024-4587 | Medium | 4.3 | 2024-05-07 | A vulnerability was found in DedeCMS 5.7 and classified as problematic. This issue affects some unknown processing of the file /src/dede/tpl.php. The manipulat… |
CVE-2024-4586 | Medium | 4.3 | 2024-05-07 | A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/shops_delivery.php… |
CVE-2024-4536 | Medium | 6.8 | 2024-05-07 | In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obt… |
CVE-2024-4601 | Medium | 6.7 | 2024-05-07 | An incorrect authentication vulnerability has been found in Socomec Net Vision affecting version 7.20. This vulnerability allows an attacker to perform a brute… |
CVE-2024-4600 | High | 7.1 | 2024-05-07 | Cross-Site Request Forgery vulnerability in Socomec Net Vision, version 7.20. This vulnerability could allow an attacker to trick registered users into perform… |
CVE-2024-4585 | Medium | 4.3 | 2024-05-07 | A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/member_type.php. The manipul… |
CVE-2024-4584 | Medium | 5.3 | 2024-05-07 | A vulnerability, which was classified as problematic, has been found in Faraday GM8181 and GM828x up to 20240429. Affected by this issue is some unknown functi… |
CVE-2024-4538 | High | 7.5 | 2024-05-07 | IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain a user's event ticket by creati… |
CVE-2024-4537 | High | 7.5 | 2024-05-07 | IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain the download URL of another use… |
CVE-2024-4599 | High | 7.5 | 2024-05-07 | Remote denial of service vulnerability in LAN Messenger affecting version 3.4.0. This vulnerability allows an attacker to crash the LAN Messenger service by se… |
CVE-2024-4583 | Medium | 5.3 | 2024-05-07 | A vulnerability classified as problematic was found in Faraday GM8181 and GM828x up to 20240429. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-4582 | High | 7.3 | 2024-05-07 | A vulnerability classified as critical has been found in Faraday GM8181 and GM828x up to 20240429. Affected is an unknown function of the component NTP Service… |
CVE-2024-4346 | Critical | 9.1 | 2024-05-07 | The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the p… |
CVE-2024-4345 | Critical | 9.8 | 2024-05-07 | The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process' function… |
CVE-2024-3759 | Medium | 6.5 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through use after free. |
CVE-2024-3758 | Medium | 6.5 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through heap buffer overflow. |
CVE-2024-3757 | Low | 3.3 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause service crash through integer overflow. |
CVE-2024-31078 | Low | 3.3 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause service crash through NULL pointer dereference. |
CVE-2024-27217 | Medium | 6.5 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. |
CVE-2024-23808 | Medium | 5.2 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free or cause DOS through NULL… |
CVE-2024-4186 | Critical | 9.8 | 2024-05-07 | The Edwiser Bridge plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.5. This is due to the 'eb_user_email_verif… |
CVE-2024-3628 | Low | 3.8 | 2024-05-07 | The EasyEvent WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-22472 | High | 8.1 | 2024-05-07 | A buffer Overflow vulnerability in Silicon Labs 500 Series Z-Wave devices may allow Denial of Service, and potential Remote Code execution This issue affects… |
CVE-2024-20872 | Medium | 6.2 | 2024-05-07 | Improper handling of insufficient privileges vulnerability in TalkbackSE prior to version Android 14 allows local attackers to modify setting value of Talkback… |
CVE-2024-20871 | Medium | 4.9 | 2024-05-07 | Improper authorization vulnerability in Samsung Keyboard prior to version One UI 5.1.1 allows physical attackers to partially bypass the factory reset protecti… |
CVE-2024-20870 | Medium | 5.1 | 2024-05-07 | Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.71.8 allows local attackers to write arbitrary files w… |
CVE-2024-20869 | Medium | 5.5 | 2024-05-07 | Improper privilege management vulnerability in Samsung Internet prior to version 25.0.0.41 allows local attackers to bypass protection for cookies. |
CVE-2024-20868 | Medium | 4.4 | 2024-05-07 | Improper input validation in Samsung Notes prior to version 4.4.15 allows local attackers to delete files with Samsung Notes privilege under certain conditions. |
CVE-2024-20867 | Medium | 5.5 | 2024-05-07 | Improper privilege management vulnerability in Samsung Email prior to version 6.1.91.14 allows local attackers to access sensitive information. |
CVE-2024-20866 | Medium | 5.7 | 2024-05-07 | Authentication bypass vulnerability in Setupwizard prior to SMR May-2024 Release 1 allows physical attackers to skip activation step. |
CVE-2024-20865 | Medium | 6.6 | 2024-05-07 | Authentication bypass in bootloader prior to SMR May-2024 Release 1 allows physical attackers to flash arbitrary images. |
CVE-2024-20864 | Medium | 5.5 | 2024-05-07 | Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows local attackers to monitor system resources. |
CVE-2024-20863 | Medium | 6.7 | 2024-05-07 | Out of bounds write vulnerability in SNAP in HAL prior to SMR May-2024 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2024-20862 | Medium | 6.0 | 2024-05-07 | Out-of-bounds write in SveService prior to SMR May-2024 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2024-20861 | Medium | 6.0 | 2024-05-07 | Use after free vulnerability in SveService prior to SMR May-2024 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2024-20860 | Medium | 4.0 | 2024-05-07 | Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to reboot the device with… |