2024 CVEs (page 292)
Page 292 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20859 | Medium | 5.5 | 2024-05-07 | Improper access control vulnerability in FactoryCamera prior to SMR May-2024 Release 1 allows local attackers to take pictures without privilege. |
CVE-2024-20858 | Medium | 4.0 | 2024-05-07 | Improper access control vulnerability in setCocktailHostCallbacks of CocktailBarService prior to SMR May-2024 Release 1 allows local attackers to access inform… |
CVE-2024-20857 | Medium | 4.0 | 2024-05-07 | Improper access control vulnerability in startListening of CocktailBarService prior to SMR May-2024 Release 1 allows local attackers to access information of c… |
CVE-2024-20856 | Medium | 4.3 | 2024-05-07 | Improper Authentication vulnerability in Secure Folder prior to SMR May-2024 Release 1 allows physical attackers to access Secure Folder without proper authent… |
CVE-2024-20855 | Low | 2.4 | 2024-05-07 | Improper access control vulnerability in multitasking framework prior to SMR May-2024 Release 1 allows physical attackers to access unlocked screen for a while. |
CVE-2024-20821 | Medium | 4.4 | 2024-05-07 | A vulnerability possible to reconfigure OTP allows local attackers to transit RMA(Return Merchandise Authorization) mode, which disables security features. Thi… |
CVE-2024-2913 | Medium | 6.5 | 2024-05-07 | A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can explo… |
CVE-2024-29941 | High | 8.0 | 2024-05-06 | Insecure storage of the ICT MIFARE and DESFire encryption keys in the firmware binary allows malicious actors to create credentials for any site code and card… |
CVE-2024-30973 | High | 8.8 | 2024-05-06 | An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitive information via c… |
CVE-2024-34534 | High | 7.3 | 2024-05-06 | A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote attacker to gain priv… |
CVE-2024-34533 | High | 7.3 | 2024-05-06 | A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows a remote attacker to… |
CVE-2024-34532 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in Yvan Dotet PostgreSQL Query Deluxe module (aka query_deluxe) 17.x before 17.0.0.4 allows a remote attacker to gain privileges… |
CVE-2024-34413 | Medium | 5.9 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SliceWP allows Stored XSS.This issue affects SliceWP: fro… |
CVE-2024-28725 | High | 7.1 | 2024-05-06 | Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings. |
CVE-2024-1695 | Medium | 5.7 | 2024-05-06 | A potential security vulnerability has been identified in the HP Application Enabling Software Driver for certain HP PC products, which might allow escalation… |
CVE-2024-4568 | Low | 2.9 | 2024-05-06 | In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow. |
CVE-2024-33908 | Medium | 5.3 | 2024-05-06 | Missing Authorization vulnerability in Themesgrove WidgetKit.This issue affects WidgetKit: from n/a through 2.5.0. |
CVE-2024-33907 | Medium | 5.3 | 2024-05-06 | Missing Authorization vulnerability in Michael Nelson Print My Blog print-my-blog.This issue affects Print My Blog: from n/a through <= 3.26.2. |
CVE-2024-33602 | High | 7.4 | 2024-05-06 | nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callbac… |
CVE-2024-33601 | High | 7.3 | 2024-05-06 | nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and thes… |
CVE-2024-33600 | Medium | 5.9 | 2024-05-06 | nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, th… |
CVE-2024-33599 | High | 8.1 | 2024-05-06 | nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subseque… |
CVE-2024-33576 | Medium | 6.5 | 2024-05-06 | Missing Authorization vulnerability in Ollybach WPPizza.This issue affects WPPizza: from n/a through 3.18.10. |
CVE-2024-33570 | Medium | 4.3 | 2024-05-06 | Missing Authorization vulnerability in Roxnor Metform metform.This issue affects Metform: from n/a through <= 3.8.3. |
CVE-2024-33121 | Medium | 6.3 | 2024-05-06 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function. |
CVE-2024-33118 | High | 7.5 | 2024-05-06 | LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonControl… |
CVE-2024-33117 | Medium | 5.3 | 2024-05-06 | crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController. |
CVE-2024-3661 | High | 7.6 | 2024-05-06 | DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traff… |
CVE-2024-34412 | High | 8.5 | 2024-05-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Parcel Panel ParcelPanel.This issue affects ParcelPanel… |
CVE-2024-34390 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Stored XSS.This issue… |
CVE-2024-34389 | Medium | 4.3 | 2024-05-06 | Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4. |
CVE-2024-34387 | Medium | 4.3 | 2024-05-06 | Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4. |
CVE-2024-34386 | High | 7.6 | 2024-05-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lucian Apostol Auto Affiliate Links.This issue affects Au… |
CVE-2024-34381 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects Propert… |
CVE-2024-34380 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Stor… |
CVE-2024-34379 | Medium | 4.3 | 2024-05-06 | Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Restaurant and Cafe.This issue affects Restaurant and Cafe: from n/a through 1.2.1. |
CVE-2024-34378 | High | 8.6 | 2024-05-06 | Missing Authorization vulnerability in LeadConnector.This issue affects LeadConnector: from n/a through 1.7. |
CVE-2024-34377 | Medium | 4.3 | 2024-05-06 | Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery – Api Gallery, Y… |
CVE-2024-34376 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Edge allows Stored XSS.This issue affects E… |
CVE-2024-34375 | Medium | 5.9 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Sheets To WP Table Live Sync allows Stored XSS.Thi… |
CVE-2024-34374 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuomodoSoft ElementsReady Addons for Elementor allows Sto… |
CVE-2024-34373 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite… |
CVE-2024-34372 | Medium | 5.3 | 2024-05-06 | Missing Authorization vulnerability in AddonMaster Post Grid Master.This issue affects Post Grid Master: from n/a through 3.4.7. |
CVE-2024-34371 | Medium | 4.3 | 2024-05-06 | Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a throug… |
CVE-2024-34369 | High | 7.1 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webpushr Web Push Notifications Webpushr allows Reflected… |
CVE-2024-34368 | Medium | 5.3 | 2024-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mooberry Dreams Mooberry Book Manager.This issue affects Mooberry Book Manager: fro… |
CVE-2024-34367 | High | 7.1 | 2024-05-06 | Cross-Site Request Forgery (CSRF) vulnerability in Popup Box Team Popup box allows Cross-Site Scripting (XSS).This issue affects Popup box: from n/a through 4… |
CVE-2024-34366 | Medium | 5.9 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AltText.Ai Download Alt Text AI allows Stored XSS.This is… |
CVE-2024-33912 | High | 7.1 | 2024-05-06 | Missing Authorization vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 1.9.16. |
CVE-2024-33910 | Medium | 5.3 | 2024-05-06 | Missing Authorization vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7. |
CVE-2024-34388 | High | 7.5 | 2024-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Scribit GDPR Compliance.This issue affects GDPR Compliance: from n/a through 1.2.5. |
CVE-2024-34383 | Medium | 5.3 | 2024-05-06 | Authorization Bypass Through User-Controlled Key vulnerability in The SEO Guys at SEOPress SEOPress.This issue affects SEOPress: from n/a through 7.7.1. |
CVE-2024-34382 | Medium | 5.3 | 2024-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in RoboSoft Robo Gallery.This issue affects Robo Gallery: from n/a through 3.2.18. |
CVE-2024-33411 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_admin_profile.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary… |
CVE-2024-33410 | High | 8.1 | 2024-05-06 | SQL injection vulnerability in /model/delete_range_grade.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary… |
CVE-2024-33409 | Critical | 9.8 | 2024-05-06 | SQL injection vulnerability in index.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the… |
CVE-2024-33408 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_classroom.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL… |
CVE-2024-33407 | Medium | 5.9 | 2024-05-06 | SQL injection vulnerability in /model/delete_record.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL c… |
CVE-2024-33406 | High | 7.3 | 2024-05-06 | SQL injection vulnerability in /model/delete_student_grade_subject.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute… |
CVE-2024-33405 | High | 8.6 | 2024-05-06 | SQL injection vulnerability in add_friends.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands v… |
CVE-2024-33404 | High | 8.3 | 2024-05-06 | A SQL injection vulnerability in /model/add_student_first_payment.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute a… |
CVE-2024-33403 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_events.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL co… |
CVE-2024-32807 | High | 8.5 | 2024-05-06 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brevo Sendinblue for WooCommerce allows Relative Path Traversal… |
CVE-2024-34471 | Medium | 5.4 | 2024-05-06 | An issue was discovered in HSC Mailinspector 5.2.17-3. A Path Traversal vulnerability (resulting in file deletion) exists in the mliRealtimeEmails.php file. Th… |
CVE-2024-34251 | High | 7.5 | 2024-05-06 | An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of ser… |
CVE-2024-34250 | Medium | 6.2 | 2024-05-06 | A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of… |
CVE-2024-34246 | High | 7.5 | 2024-05-06 | wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platforms/app/main.c. |
CVE-2024-34093 | Medium | 5.3 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.03. There is an X-Forwarded-For Header Bypass vulnerability. An unauthenticated attacker could potenti… |
CVE-2024-34092 | High | 8.8 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing session. 6.14 P3 (6.14.0… |
CVE-2024-34091 | High | 7.3 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Arche… |
CVE-2024-34090 | High | 7.3 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. The login banner in the Archer Control… |
CVE-2024-34089 | High | 7.3 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Arche… |
CVE-2024-26312 | Medium | 4.3 | 2024-05-06 | Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensit… |
CVE-2024-34472 | Medium | 5.5 | 2024-05-06 | An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An authenticated blind SQL injection vulnerability exists in the mliRealtimeEmails.php… |
CVE-2024-34470 | High | 8.6 | 2024-05-06 | An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file… |
CVE-2024-34252 | High | 7.5 | 2024-05-06 | wasm3 v0.5.0 was discovered to contain a global buffer overflow which leads to segmentation fault via the function "PreserveRegisterIfOccupied" in wasm3/source… |
CVE-2024-34249 | Critical | 9.8 | 2024-05-06 | wasm3 v0.5.0 was discovered to contain a heap buffer overflow which leads to segmentation fault via the function "DeallocateSlot" in wasm3/source/m3_compile.c. |
CVE-2024-34078 | Medium | 6.1 | 2024-05-06 | html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the… |
CVE-2024-34069 | High | 7.5 | 2024-05-06 | Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's… |
CVE-2024-34064 | Medium | 5.4 | 2024-05-06 | Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attribu… |
CVE-2024-33294 | Critical | 9.1 | 2024-05-06 | An issue in Library System using PHP/MySQli with Source Code V1.0 allows a remote attacker to execute arbitrary code via the _FAILE variable in the student_edi… |
CVE-2024-33113 | Medium | 5.3 | 2024-05-06 | D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php. |
CVE-2024-33112 | High | 7.5 | 2024-05-06 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func. |
CVE-2024-33111 | Medium | 5.4 | 2024-05-06 | D-Link DIR-845L router <=v1.01KRb03 is vulnerable to Cross Site Scripting (XSS) via /htdocs/webinc/js/bsc_sms_inbox.php. |
CVE-2024-33110 | Critical | 9.1 | 2024-05-06 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Permission Bypass via the getcfg.php component. |
CVE-2024-32982 | High | 8.2 | 2024-05-06 | Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerabilit… |
CVE-2024-32972 | High | 7.5 | 2024-05-06 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large a… |
CVE-2024-23354 | High | 8.4 | 2024-05-06 | Memory corruption when the IOCTL call is interrupted by a signal. |
CVE-2024-23351 | High | 8.4 | 2024-05-06 | Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions. |
CVE-2024-21480 | High | 7.3 | 2024-05-06 | Memory corruption while playing audio file having large-sized input buffer. |
CVE-2024-21477 | High | 7.5 | 2024-05-06 | Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame. |
CVE-2024-21476 | High | 7.8 | 2024-05-06 | Memory corruption when the channel ID passed by user is not validated and further used. |
CVE-2024-21475 | High | 7.8 | 2024-05-06 | Memory corruption when the payload received from firmware is not as per the expected protocol size. |
CVE-2024-21474 | High | 8.4 | 2024-05-06 | Memory corruption when size of buffer from previous call is used without validation or re-initialization. |
CVE-2024-21471 | High | 8.4 | 2024-05-06 | Memory corruption when IOMMU unmap of a GPU buffer fails in Linux. |
CVE-2024-4549 | High | 7.5 | 2024-05-06 | A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts t… |
CVE-2024-4548 | Critical | 9.8 | 2024-05-06 | An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into… |
CVE-2024-4547 | Critical | 9.8 | 2024-05-06 | A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted int… |
CVE-2024-33752 | Medium | 6.3 | 2024-05-06 | An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit… |
CVE-2024-33830 | High | 8.1 | 2024-05-06 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=clearWebCache. |