2024 CVEs (page 292)
Page 292 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4599 | High | 7.5 | 2024-05-07 | Remote denial of service vulnerability in LAN Messenger affecting version 3.4.0. This vulnerability allows an attacker to crash the LAN Messenger service by se… |
CVE-2024-4583 | Medium | 5.3 | 2024-05-07 | A vulnerability classified as problematic was found in Faraday GM8181 and GM828x up to 20240429. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-4582 | High | 7.3 | 2024-05-07 | A vulnerability classified as critical has been found in Faraday GM8181 and GM828x up to 20240429. Affected is an unknown function of the component NTP Service… |
CVE-2024-4346 | Critical | 9.1 | 2024-05-07 | The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the p… |
CVE-2024-4345 | Critical | 9.8 | 2024-05-07 | The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process' function… |
CVE-2024-3759 | Medium | 6.5 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through use after free. |
CVE-2024-3758 | Medium | 6.5 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through heap buffer overflow. |
CVE-2024-3757 | Low | 3.3 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause service crash through integer overflow. |
CVE-2024-31078 | Low | 3.3 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause service crash through NULL pointer dereference. |
CVE-2024-27217 | Medium | 6.5 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. |
CVE-2024-23808 | Medium | 5.2 | 2024-05-07 | in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free or cause DOS through NULL… |
CVE-2024-4186 | Critical | 9.8 | 2024-05-07 | The Edwiser Bridge plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.5. This is due to the 'eb_user_email_verif… |
CVE-2024-3628 | Low | 3.8 | 2024-05-07 | The EasyEvent WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-22472 | High | 8.1 | 2024-05-07 | A buffer Overflow vulnerability in Silicon Labs 500 Series Z-Wave devices may allow Denial of Service, and potential Remote Code execution This issue affects… |
CVE-2024-20872 | Medium | 6.2 | 2024-05-07 | Improper handling of insufficient privileges vulnerability in TalkbackSE prior to version Android 14 allows local attackers to modify setting value of Talkback… |
CVE-2024-20871 | Medium | 4.9 | 2024-05-07 | Improper authorization vulnerability in Samsung Keyboard prior to version One UI 5.1.1 allows physical attackers to partially bypass the factory reset protecti… |
CVE-2024-20870 | Medium | 5.1 | 2024-05-07 | Improper verification of intent by broadcast receiver vulnerability in Galaxy Store prior to version 4.5.71.8 allows local attackers to write arbitrary files w… |
CVE-2024-20869 | Medium | 5.5 | 2024-05-07 | Improper privilege management vulnerability in Samsung Internet prior to version 25.0.0.41 allows local attackers to bypass protection for cookies. |
CVE-2024-20868 | Medium | 4.4 | 2024-05-07 | Improper input validation in Samsung Notes prior to version 4.4.15 allows local attackers to delete files with Samsung Notes privilege under certain conditions. |
CVE-2024-20867 | Medium | 5.5 | 2024-05-07 | Improper privilege management vulnerability in Samsung Email prior to version 6.1.91.14 allows local attackers to access sensitive information. |
CVE-2024-20866 | Medium | 5.7 | 2024-05-07 | Authentication bypass vulnerability in Setupwizard prior to SMR May-2024 Release 1 allows physical attackers to skip activation step. |
CVE-2024-20865 | Medium | 6.6 | 2024-05-07 | Authentication bypass in bootloader prior to SMR May-2024 Release 1 allows physical attackers to flash arbitrary images. |
CVE-2024-20864 | Medium | 5.5 | 2024-05-07 | Improper access control vulnerability in DarManagerService prior to SMR May-2024 Release 1 allows local attackers to monitor system resources. |
CVE-2024-20863 | Medium | 6.7 | 2024-05-07 | Out of bounds write vulnerability in SNAP in HAL prior to SMR May-2024 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2024-20862 | Medium | 6.0 | 2024-05-07 | Out-of-bounds write in SveService prior to SMR May-2024 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2024-20861 | Medium | 6.0 | 2024-05-07 | Use after free vulnerability in SveService prior to SMR May-2024 Release 1 allows local privileged attackers to cause memory corruption. |
CVE-2024-20860 | Medium | 4.0 | 2024-05-07 | Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to reboot the device with… |
CVE-2024-20859 | Medium | 5.5 | 2024-05-07 | Improper access control vulnerability in FactoryCamera prior to SMR May-2024 Release 1 allows local attackers to take pictures without privilege. |
CVE-2024-20858 | Medium | 4.0 | 2024-05-07 | Improper access control vulnerability in setCocktailHostCallbacks of CocktailBarService prior to SMR May-2024 Release 1 allows local attackers to access inform… |
CVE-2024-20857 | Medium | 4.0 | 2024-05-07 | Improper access control vulnerability in startListening of CocktailBarService prior to SMR May-2024 Release 1 allows local attackers to access information of c… |
CVE-2024-20856 | Medium | 4.3 | 2024-05-07 | Improper Authentication vulnerability in Secure Folder prior to SMR May-2024 Release 1 allows physical attackers to access Secure Folder without proper authent… |
CVE-2024-20855 | Low | 2.4 | 2024-05-07 | Improper access control vulnerability in multitasking framework prior to SMR May-2024 Release 1 allows physical attackers to access unlocked screen for a while. |
CVE-2024-20821 | Medium | 4.4 | 2024-05-07 | A vulnerability possible to reconfigure OTP allows local attackers to transit RMA(Return Merchandise Authorization) mode, which disables security features. Thi… |
CVE-2024-2913 | Medium | 6.5 | 2024-05-07 | A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can explo… |
CVE-2024-29941 | High | 8.0 | 2024-05-06 | Insecure storage of the ICT MIFARE and DESFire encryption keys in the firmware binary allows malicious actors to create credentials for any site code and card… |
CVE-2024-30973 | High | 8.8 | 2024-05-06 | An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitive information via c… |
CVE-2024-34534 | High | 7.3 | 2024-05-06 | A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote attacker to gain priv… |
CVE-2024-34533 | High | 7.3 | 2024-05-06 | A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows a remote attacker to… |
CVE-2024-34532 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in Yvan Dotet PostgreSQL Query Deluxe module (aka query_deluxe) 17.x before 17.0.0.4 allows a remote attacker to gain privileges… |
CVE-2024-34413 | Medium | 5.9 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SliceWP allows Stored XSS.This issue affects SliceWP: fro… |
CVE-2024-28725 | High | 7.1 | 2024-05-06 | Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings. |
CVE-2024-1695 | Medium | 5.7 | 2024-05-06 | A potential security vulnerability has been identified in the HP Application Enabling Software Driver for certain HP PC products, which might allow escalation… |
CVE-2024-4568 | Low | 2.9 | 2024-05-06 | In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow. |
CVE-2024-33908 | Medium | 5.3 | 2024-05-06 | Missing Authorization vulnerability in Themesgrove WidgetKit.This issue affects WidgetKit: from n/a through 2.5.0. |
CVE-2024-33907 | Medium | 5.3 | 2024-05-06 | Missing Authorization vulnerability in Michael Nelson Print My Blog print-my-blog.This issue affects Print My Blog: from n/a through <= 3.26.2. |
CVE-2024-33602 | High | 7.4 | 2024-05-06 | nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callbac… |
CVE-2024-33601 | High | 7.3 | 2024-05-06 | nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and thes… |
CVE-2024-33600 | Medium | 5.9 | 2024-05-06 | nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, th… |
CVE-2024-33599 | High | 8.1 | 2024-05-06 | nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subseque… |
CVE-2024-33576 | Medium | 6.5 | 2024-05-06 | Missing Authorization vulnerability in Ollybach WPPizza.This issue affects WPPizza: from n/a through 3.18.10. |
CVE-2024-33570 | Medium | 4.3 | 2024-05-06 | Missing Authorization vulnerability in Roxnor Metform metform.This issue affects Metform: from n/a through <= 3.8.3. |
CVE-2024-33121 | Medium | 6.3 | 2024-05-06 | Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function. |
CVE-2024-33118 | High | 7.5 | 2024-05-06 | LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonControl… |
CVE-2024-33117 | Medium | 5.3 | 2024-05-06 | crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController. |
CVE-2024-3661 | High | 7.6 | 2024-05-06 | DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traff… |
CVE-2024-34412 | High | 8.5 | 2024-05-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Parcel Panel ParcelPanel.This issue affects ParcelPanel… |
CVE-2024-34390 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Stored XSS.This issue… |
CVE-2024-34389 | Medium | 4.3 | 2024-05-06 | Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4. |
CVE-2024-34387 | Medium | 4.3 | 2024-05-06 | Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4. |
CVE-2024-34386 | High | 7.6 | 2024-05-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lucian Apostol Auto Affiliate Links.This issue affects Au… |
CVE-2024-34381 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects Propert… |
CVE-2024-34380 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Stor… |
CVE-2024-34379 | Medium | 4.3 | 2024-05-06 | Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Restaurant and Cafe.This issue affects Restaurant and Cafe: from n/a through 1.2.1. |
CVE-2024-34378 | High | 8.6 | 2024-05-06 | Missing Authorization vulnerability in LeadConnector.This issue affects LeadConnector: from n/a through 1.7. |
CVE-2024-34377 | Medium | 4.3 | 2024-05-06 | Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery – Api Gallery, Y… |
CVE-2024-34376 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Edge allows Stored XSS.This issue affects E… |
CVE-2024-34375 | Medium | 5.9 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Sheets To WP Table Live Sync allows Stored XSS.Thi… |
CVE-2024-34374 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuomodoSoft ElementsReady Addons for Elementor allows Sto… |
CVE-2024-34373 | Medium | 6.5 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite… |
CVE-2024-34372 | Medium | 5.3 | 2024-05-06 | Missing Authorization vulnerability in AddonMaster Post Grid Master.This issue affects Post Grid Master: from n/a through 3.4.7. |
CVE-2024-34371 | Medium | 4.3 | 2024-05-06 | Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a throug… |
CVE-2024-34369 | High | 7.1 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webpushr Web Push Notifications Webpushr allows Reflected… |
CVE-2024-34368 | Medium | 5.3 | 2024-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mooberry Dreams Mooberry Book Manager.This issue affects Mooberry Book Manager: fro… |
CVE-2024-34367 | High | 7.1 | 2024-05-06 | Cross-Site Request Forgery (CSRF) vulnerability in Popup Box Team Popup box allows Cross-Site Scripting (XSS).This issue affects Popup box: from n/a through 4… |
CVE-2024-34366 | Medium | 5.9 | 2024-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AltText.Ai Download Alt Text AI allows Stored XSS.This is… |
CVE-2024-33912 | High | 7.1 | 2024-05-06 | Missing Authorization vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 1.9.16. |
CVE-2024-33910 | Medium | 5.3 | 2024-05-06 | Missing Authorization vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7. |
CVE-2024-34388 | High | 7.5 | 2024-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Scribit GDPR Compliance.This issue affects GDPR Compliance: from n/a through 1.2.5. |
CVE-2024-34383 | Medium | 5.3 | 2024-05-06 | Authorization Bypass Through User-Controlled Key vulnerability in The SEO Guys at SEOPress SEOPress.This issue affects SEOPress: from n/a through 7.7.1. |
CVE-2024-34382 | Medium | 5.3 | 2024-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in RoboSoft Robo Gallery.This issue affects Robo Gallery: from n/a through 3.2.18. |
CVE-2024-33411 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_admin_profile.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary… |
CVE-2024-33410 | High | 8.1 | 2024-05-06 | SQL injection vulnerability in /model/delete_range_grade.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary… |
CVE-2024-33409 | Critical | 9.8 | 2024-05-06 | SQL injection vulnerability in index.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the… |
CVE-2024-33408 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_classroom.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL… |
CVE-2024-33407 | Medium | 5.9 | 2024-05-06 | SQL injection vulnerability in /model/delete_record.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL c… |
CVE-2024-33406 | High | 7.3 | 2024-05-06 | SQL injection vulnerability in /model/delete_student_grade_subject.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute… |
CVE-2024-33405 | High | 8.6 | 2024-05-06 | SQL injection vulnerability in add_friends.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands v… |
CVE-2024-33404 | High | 8.3 | 2024-05-06 | A SQL injection vulnerability in /model/add_student_first_payment.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute a… |
CVE-2024-33403 | Critical | 9.8 | 2024-05-06 | A SQL injection vulnerability in /model/get_events.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL co… |
CVE-2024-32807 | High | 8.5 | 2024-05-06 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brevo Sendinblue for WooCommerce allows Relative Path Traversal… |
CVE-2024-34471 | Medium | 5.4 | 2024-05-06 | An issue was discovered in HSC Mailinspector 5.2.17-3. A Path Traversal vulnerability (resulting in file deletion) exists in the mliRealtimeEmails.php file. Th… |
CVE-2024-34251 | High | 7.5 | 2024-05-06 | An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of ser… |
CVE-2024-34250 | Medium | 6.2 | 2024-05-06 | A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of… |
CVE-2024-34246 | High | 7.5 | 2024-05-06 | wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platforms/app/main.c. |
CVE-2024-34093 | Medium | 5.3 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.03. There is an X-Forwarded-For Header Bypass vulnerability. An unauthenticated attacker could potenti… |
CVE-2024-34092 | High | 8.8 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing session. 6.14 P3 (6.14.0… |
CVE-2024-34091 | High | 7.3 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Arche… |
CVE-2024-34090 | High | 7.3 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. The login banner in the Archer Control… |
CVE-2024-34089 | High | 7.3 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Arche… |
CVE-2024-26312 | Medium | 4.3 | 2024-05-06 | Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensit… |