2024 CVEs (page 293)
Page 293 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-33829 | Medium | 5.4 | 2024-05-06 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=updateWebCache. |
CVE-2024-33788 | High | 8.0 | 2024-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint. |
CVE-2024-33749 | Critical | 9.1 | 2024-05-06 | DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php. |
CVE-2024-3576 | High | 8.3 | 2024-05-06 | The NPort 5100A Series firmware version v1.6 and prior versions are affected by web server XSS vulnerability. The vulnerability is caused by not correctly neut… |
CVE-2024-33753 | High | 8.2 | 2024-05-06 | Section Camera V2.5.5.3116-S50-SMA-B20160811 and earlier versions allow the accounts and passwords of administrators and users to be changed without authorizat… |
CVE-2024-4528 | Low | 2.4 | 2024-05-06 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2024-23193 | Medium | 5.3 | 2024-05-06 | E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node… |
CVE-2024-23188 | Medium | 6.5 | 2024-05-06 | Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interacti… |
CVE-2024-23187 | Medium | 6.5 | 2024-05-06 | Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perfor… |
CVE-2024-23186 | Medium | 6.5 | 2024-05-06 | E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform mal… |
CVE-2024-4527 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is an unknown function… |
CVE-2024-4526 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This issue affects some unknown processin… |
CVE-2024-4525 | Low | 3.5 | 2024-05-06 | A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This vulnerability affects unknown c… |
CVE-2024-4524 | Low | 3.5 | 2024-05-06 | A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of t… |
CVE-2024-3756 | High | 7.5 | 2024-05-06 | The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and abo… |
CVE-2024-3755 | Medium | 5.4 | 2024-05-06 | The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to… |
CVE-2024-3752 | Medium | 5.4 | 2024-05-06 | The Crelly Slider WordPress plugin through 1.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-0904 | Medium | 5.9 | 2024-05-06 | The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-4523 | Low | 3.5 | 2024-05-06 | A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. Affected by this issue is so… |
CVE-2024-4522 | Low | 3.5 | 2024-05-06 | A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerability is an unknown… |
CVE-2024-4521 | Low | 3.5 | 2024-05-06 | A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the f… |
CVE-2024-4519 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. This issue affects some unknown proce… |
CVE-2024-4518 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. This vulnerability affects unknown… |
CVE-2024-4517 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. This affects an unknown part of… |
CVE-2024-4516 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. Affected by this issue is some unknown fu… |
CVE-2024-34538 | High | 7.5 | 2024-05-06 | Mateso PasswordSafe through 8.13.9.26689 has Weak Cryptography. |
CVE-2024-20064 | High | 7.8 | 2024-05-06 | In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional… |
CVE-2024-20060 | Medium | 5.9 | 2024-05-06 | In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege with System execution pri… |
CVE-2024-20059 | Medium | 6.7 | 2024-05-06 | In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege with System execution pri… |
CVE-2024-20058 | Medium | 4.4 | 2024-05-06 | In keyInstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2024-20057 | High | 7.2 | 2024-05-06 | In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2024-20056 | Medium | 6.7 | 2024-05-06 | In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege with System execut… |
CVE-2024-20021 | Medium | 6.7 | 2024-05-06 | In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error. This could lead to local escalation of privilege with Syst… |
CVE-2024-4515 | Low | 3.5 | 2024-05-06 | A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. Affected by this vulnerability is an… |
CVE-2024-4514 | Low | 3.5 | 2024-05-06 | A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function o… |
CVE-2024-4513 | Low | 3.5 | 2024-05-06 | A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. This issue affects some unkn… |
CVE-2024-4512 | Low | 3.5 | 2024-05-06 | A vulnerability classified as problematic was found in SourceCodester Prison Management System 1.0. This vulnerability affects unknown code of the file /Employ… |
CVE-2024-4511 | Medium | 6.3 | 2024-05-06 | A vulnerability classified as critical has been found in Shanghai Sunfull Automation BACnet Server HMI1002-ARM 2.0.4. This affects an unknown part of the compo… |
CVE-2024-4510 | Medium | 4.7 | 2024-05-06 | A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been rated as critical. Affected by this issue is some unknown functionality of the file /vie… |
CVE-2024-4509 | Medium | 4.7 | 2024-05-06 | A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-4508 | Medium | 4.7 | 2024-05-06 | A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been classified as critical. Affected is an unknown function of the file /view/IPV6/ipv6Stati… |
CVE-2024-4507 | Medium | 4.7 | 2024-05-06 | A vulnerability was found in Ruijie RG-UAC up to 20240428 and classified as critical. This issue affects some unknown processing of the file /view/IPV6/ipv6Sta… |
CVE-2024-34529 | Medium | 4.8 | 2024-05-06 | Nebari through 2024.4.1 prints the temporary Keycloak root password. |
CVE-2024-34528 | High | 7.7 | 2024-05-06 | WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creatio… |
CVE-2024-34527 | High | 7.5 | 2024-05-06 | spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key. The printed string might be logged. |
CVE-2024-34525 | Medium | 5.3 | 2024-05-06 | FileCodeBox 2.0 stores a OneDrive password and AWS key in a cleartext env file. |
CVE-2024-34524 | Critical | 9.1 | 2024-05-06 | In XLANG OpenAgents through fe73ac4, the allowed_file protection mechanism can be bypassed by using an incorrect file extension for the nature of the file cont… |
CVE-2024-4506 | Medium | 4.7 | 2024-05-05 | A vulnerability has been found in Ruijie RG-UAC up to 20240428 and classified as critical. This vulnerability affects unknown code of the file /view/IPV6/ipv6A… |
CVE-2024-4505 | Medium | 4.7 | 2024-05-05 | A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240428. This affects an unknown part of the file /view/IPV6/ipv6Addr/ip_a… |
CVE-2024-4504 | Medium | 4.7 | 2024-05-05 | A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428. Affected by this issue is some unknown functionality of the… |
CVE-2024-4503 | Medium | 4.7 | 2024-05-05 | A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240428. Affected by this vulnerability is an unknown functionality of the file /view/… |
CVE-2024-4502 | Medium | 4.7 | 2024-05-05 | A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240428. Affected is an unknown function of the file /view/dhcp/dhcpClient/dhcp_c… |
CVE-2024-34519 | Medium | 6.8 | 2024-05-05 | Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367. If a user can create a dashboard with an auto-l… |
CVE-2024-34515 | High | 8.8 | 2024-05-05 | image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists(). |
CVE-2024-4501 | Medium | 4.7 | 2024-05-05 | A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been rated as critical. This issue affects some unknown processing of the file /view/bugSolve… |
CVE-2024-34510 | High | 7.5 | 2024-05-05 | Gradio before 4.20 allows credential leakage on Windows. |
CVE-2024-34509 | Medium | 5.3 | 2024-05-05 | dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. |
CVE-2024-34508 | Medium | 4.3 | 2024-05-05 | dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. |
CVE-2024-34507 | High | 7.4 | 2024-05-05 | An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occu… |
CVE-2024-34506 | High | 7.5 | 2024-05-05 | An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the… |
CVE-2024-34502 | Critical | 9.8 | 2024-05-05 | An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attemp… |
CVE-2024-34500 | Medium | 6.1 | 2024-05-05 | An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an… |
CVE-2024-4500 | Medium | 6.3 | 2024-05-05 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2024-34474 | High | 7.8 | 2024-05-05 | Clario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there as SYSTEM. |
CVE-2024-4497 | High | 8.8 | 2024-05-05 | A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been declared as critical. This vulnerability affects the function formexeCommand. The manipulati… |
CVE-2024-4496 | High | 8.8 | 2024-05-05 | A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been classified as critical. This affects the function formWifiMacFilterSet. The manipulation of… |
CVE-2024-4495 | High | 8.8 | 2024-05-05 | A vulnerability was found in Tenda i21 1.0.0.14(4656) and classified as critical. Affected by this issue is the function formWifiMacFilterGet. The manipulation… |
CVE-2024-4494 | High | 8.8 | 2024-05-05 | A vulnerability has been found in Tenda i21 1.0.0.14(4656) and classified as critical. Affected by this vulnerability is the function formSetUplinkInfo of the… |
CVE-2024-4493 | High | 8.8 | 2024-05-05 | A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656). Affected is the function formSetAutoPing. The manipulation of the arg… |
CVE-2024-34490 | Medium | 5.1 | 2024-05-05 | In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controlled by a local attac… |
CVE-2024-34489 | High | 7.5 | 2024-05-05 | OFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0. |
CVE-2024-34488 | High | 7.5 | 2024-05-05 | OFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0. |
CVE-2024-34487 | High | 7.5 | 2024-05-05 | OFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0. |
CVE-2024-34486 | High | 7.5 | 2024-05-05 | OFPPacketQueue in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPQueueProp.len=0. |
CVE-2024-34484 | Medium | 5.3 | 2024-05-05 | OFPBucket in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via action.len=0. |
CVE-2024-34483 | High | 7.5 | 2024-05-05 | OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPBucket.len=0. |
CVE-2024-4492 | High | 8.8 | 2024-05-05 | A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). This issue affects the function formOfflineSet of the file /gofo… |
CVE-2024-34478 | High | 7.5 | 2024-05-05 | btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically… |
CVE-2024-4491 | High | 8.8 | 2024-05-05 | A vulnerability classified as critical was found in Tenda i21 1.0.0.14(4656). This vulnerability affects the function formGetDiagnoseInfo. The manipulation of… |
CVE-2024-34476 | Medium | 5.3 | 2024-05-05 | Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs_nas_encrypt in lib/nas/common/security… |
CVE-2024-34475 | High | 7.5 | 2024-05-05 | Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm_state_authentication in amf/gmm-sm.c fo… |
CVE-2024-34473 | Medium | 5.3 | 2024-05-04 | An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. An attacker could register an unintended RMR message type during xApp registration to disrupt… |
CVE-2024-34469 | High | 7.1 | 2024-05-04 | Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save. |
CVE-2024-34468 | Medium | 6.1 | 2024-05-04 | Rukovoditel before 3.5.3 allows XSS via user_photo to My Page. |
CVE-2024-34467 | Medium | 6.1 | 2024-05-04 | ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl. |
CVE-2024-34462 | Medium | 6.1 | 2024-05-04 | Alinto SOGo through 5.10.0 allows XSS during attachment preview. |
CVE-2024-1050 | Medium | 4.3 | 2024-05-04 | The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax… |
CVE-2024-34461 | Critical | 9.8 | 2024-05-04 | Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a des… |
CVE-2024-34460 | Medium | 6.5 | 2024-05-04 | The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.) |
CVE-2024-3240 | High | 8.8 | 2024-05-04 | The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input… |
CVE-2024-3237 | Medium | 5.4 | 2024-05-04 | The ConvertPlug plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cp_dismiss_notice() function i… |
CVE-2024-3868 | Medium | 5.4 | 2024-05-04 | The Folders Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's First Name and Last Name in all versions up to, and including, 3… |
CVE-2024-34455 | High | 7.5 | 2024-05-03 | Buildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. A fix was released in 2024.02.2. |
CVE-2024-34453 | Medium | 4.3 | 2024-05-03 | TwoNav 2.1.13 contains an SSRF vulnerability via the url paramater to index.php?c=api&method=read_data&type=connectivity_test (which reaches /system/api.php). |
CVE-2024-34075 | Medium | 6.2 | 2024-05-03 | kurwov is a fast, dependency-free library for creating Markov Chains. An unsafe sanitization of dataset contents on the `MarkovData#getNext` method used in `Ma… |
CVE-2024-34068 | Medium | 6.4 | 2024-05-03 | Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously imp… |
CVE-2024-34067 | Medium | 6.1 | 2024-05-03 | Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance co… |
CVE-2024-34066 | High | 8.4 | 2024-05-03 | Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accide… |
CVE-2024-31673 | Critical | 9.8 | 2024-05-03 | Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in load_data.php via the userid parameter. |
CVE-2024-27453 | High | 8.6 | 2024-05-03 | In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machin… |