2024 CVEs (page 293)
Page 293 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34472 | Medium | 5.5 | 2024-05-06 | An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An authenticated blind SQL injection vulnerability exists in the mliRealtimeEmails.php… |
CVE-2024-34470 | High | 8.6 | 2024-05-06 | An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file… |
CVE-2024-34252 | High | 7.5 | 2024-05-06 | wasm3 v0.5.0 was discovered to contain a global buffer overflow which leads to segmentation fault via the function "PreserveRegisterIfOccupied" in wasm3/source… |
CVE-2024-34249 | Critical | 9.8 | 2024-05-06 | wasm3 v0.5.0 was discovered to contain a heap buffer overflow which leads to segmentation fault via the function "DeallocateSlot" in wasm3/source/m3_compile.c. |
CVE-2024-34078 | Medium | 6.1 | 2024-05-06 | html-sanitizer is an allowlist-based HTML cleaner. If using `keep_typographic_whitespace=False` (which is the default), the sanitizer normalizes unicode to the… |
CVE-2024-34069 | High | 7.5 | 2024-05-06 | Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's… |
CVE-2024-34064 | Medium | 5.4 | 2024-05-06 | Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attribu… |
CVE-2024-33294 | Critical | 9.1 | 2024-05-06 | An issue in Library System using PHP/MySQli with Source Code V1.0 allows a remote attacker to execute arbitrary code via the _FAILE variable in the student_edi… |
CVE-2024-33113 | Medium | 5.3 | 2024-05-06 | D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php. |
CVE-2024-33112 | High | 7.5 | 2024-05-06 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func. |
CVE-2024-33111 | Medium | 5.4 | 2024-05-06 | D-Link DIR-845L router <=v1.01KRb03 is vulnerable to Cross Site Scripting (XSS) via /htdocs/webinc/js/bsc_sms_inbox.php. |
CVE-2024-33110 | Critical | 9.1 | 2024-05-06 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Permission Bypass via the getcfg.php component. |
CVE-2024-32982 | High | 8.2 | 2024-05-06 | Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerabilit… |
CVE-2024-32972 | High | 7.5 | 2024-05-06 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large a… |
CVE-2024-23354 | High | 8.4 | 2024-05-06 | Memory corruption when the IOCTL call is interrupted by a signal. |
CVE-2024-23351 | High | 8.4 | 2024-05-06 | Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions. |
CVE-2024-21480 | High | 7.3 | 2024-05-06 | Memory corruption while playing audio file having large-sized input buffer. |
CVE-2024-21477 | High | 7.5 | 2024-05-06 | Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame. |
CVE-2024-21476 | High | 7.8 | 2024-05-06 | Memory corruption when the channel ID passed by user is not validated and further used. |
CVE-2024-21475 | High | 7.8 | 2024-05-06 | Memory corruption when the payload received from firmware is not as per the expected protocol size. |
CVE-2024-21474 | High | 8.4 | 2024-05-06 | Memory corruption when size of buffer from previous call is used without validation or re-initialization. |
CVE-2024-21471 | High | 8.4 | 2024-05-06 | Memory corruption when IOMMU unmap of a GPU buffer fails in Linux. |
CVE-2024-4549 | High | 7.5 | 2024-05-06 | A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts t… |
CVE-2024-4548 | Critical | 9.8 | 2024-05-06 | An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into… |
CVE-2024-4547 | Critical | 9.8 | 2024-05-06 | A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted int… |
CVE-2024-33752 | Medium | 6.3 | 2024-05-06 | An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit… |
CVE-2024-33830 | High | 8.1 | 2024-05-06 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=clearWebCache. |
CVE-2024-33829 | Medium | 5.4 | 2024-05-06 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=updateWebCache. |
CVE-2024-33788 | High | 8.0 | 2024-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint. |
CVE-2024-33749 | Critical | 9.1 | 2024-05-06 | DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php. |
CVE-2024-3576 | High | 8.3 | 2024-05-06 | The NPort 5100A Series firmware version v1.6 and prior versions are affected by web server XSS vulnerability. The vulnerability is caused by not correctly neut… |
CVE-2024-33753 | High | 8.2 | 2024-05-06 | Section Camera V2.5.5.3116-S50-SMA-B20160811 and earlier versions allow the accounts and passwords of administrators and users to be changed without authorizat… |
CVE-2024-4528 | Low | 2.4 | 2024-05-06 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2024-23193 | Medium | 5.3 | 2024-05-06 | E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node… |
CVE-2024-23188 | Medium | 6.5 | 2024-05-06 | Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interacti… |
CVE-2024-23187 | Medium | 6.5 | 2024-05-06 | Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perfor… |
CVE-2024-23186 | Medium | 6.5 | 2024-05-06 | E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform mal… |
CVE-2024-4527 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is an unknown function… |
CVE-2024-4526 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This issue affects some unknown processin… |
CVE-2024-4525 | Low | 3.5 | 2024-05-06 | A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This vulnerability affects unknown c… |
CVE-2024-4524 | Low | 3.5 | 2024-05-06 | A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of t… |
CVE-2024-3756 | High | 7.5 | 2024-05-06 | The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and abo… |
CVE-2024-3755 | Medium | 5.4 | 2024-05-06 | The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to… |
CVE-2024-3752 | Medium | 5.4 | 2024-05-06 | The Crelly Slider WordPress plugin through 1.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-0904 | Medium | 5.9 | 2024-05-06 | The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-4523 | Low | 3.5 | 2024-05-06 | A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. Affected by this issue is so… |
CVE-2024-4522 | Low | 3.5 | 2024-05-06 | A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerability is an unknown… |
CVE-2024-4521 | Low | 3.5 | 2024-05-06 | A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the f… |
CVE-2024-4519 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. This issue affects some unknown proce… |
CVE-2024-4518 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. This vulnerability affects unknown… |
CVE-2024-4517 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. This affects an unknown part of… |
CVE-2024-4516 | Low | 3.5 | 2024-05-06 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. Affected by this issue is some unknown fu… |
CVE-2024-34538 | High | 7.5 | 2024-05-06 | Mateso PasswordSafe through 8.13.9.26689 has Weak Cryptography. |
CVE-2024-20064 | High | 7.8 | 2024-05-06 | In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional… |
CVE-2024-20060 | Medium | 5.9 | 2024-05-06 | In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege with System execution pri… |
CVE-2024-20059 | Medium | 6.7 | 2024-05-06 | In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege with System execution pri… |
CVE-2024-20058 | Medium | 4.4 | 2024-05-06 | In keyInstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2024-20057 | High | 7.2 | 2024-05-06 | In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2024-20056 | Medium | 6.7 | 2024-05-06 | In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege with System execut… |
CVE-2024-20021 | Medium | 6.7 | 2024-05-06 | In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error. This could lead to local escalation of privilege with Syst… |
CVE-2024-4515 | Low | 3.5 | 2024-05-06 | A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. Affected by this vulnerability is an… |
CVE-2024-4514 | Low | 3.5 | 2024-05-06 | A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function o… |
CVE-2024-4513 | Low | 3.5 | 2024-05-06 | A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. This issue affects some unkn… |
CVE-2024-4512 | Low | 3.5 | 2024-05-06 | A vulnerability classified as problematic was found in SourceCodester Prison Management System 1.0. This vulnerability affects unknown code of the file /Employ… |
CVE-2024-4511 | Medium | 6.3 | 2024-05-06 | A vulnerability classified as critical has been found in Shanghai Sunfull Automation BACnet Server HMI1002-ARM 2.0.4. This affects an unknown part of the compo… |
CVE-2024-4510 | Medium | 4.7 | 2024-05-06 | A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been rated as critical. Affected by this issue is some unknown functionality of the file /vie… |
CVE-2024-4509 | Medium | 4.7 | 2024-05-06 | A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-4508 | Medium | 4.7 | 2024-05-06 | A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been classified as critical. Affected is an unknown function of the file /view/IPV6/ipv6Stati… |
CVE-2024-4507 | Medium | 4.7 | 2024-05-06 | A vulnerability was found in Ruijie RG-UAC up to 20240428 and classified as critical. This issue affects some unknown processing of the file /view/IPV6/ipv6Sta… |
CVE-2024-34529 | Medium | 4.8 | 2024-05-06 | Nebari through 2024.4.1 prints the temporary Keycloak root password. |
CVE-2024-34528 | High | 7.7 | 2024-05-06 | WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creatio… |
CVE-2024-34527 | High | 7.5 | 2024-05-06 | spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key. The printed string might be logged. |
CVE-2024-34525 | Medium | 5.3 | 2024-05-06 | FileCodeBox 2.0 stores a OneDrive password and AWS key in a cleartext env file. |
CVE-2024-34524 | Critical | 9.1 | 2024-05-06 | In XLANG OpenAgents through fe73ac4, the allowed_file protection mechanism can be bypassed by using an incorrect file extension for the nature of the file cont… |
CVE-2024-4506 | Medium | 4.7 | 2024-05-05 | A vulnerability has been found in Ruijie RG-UAC up to 20240428 and classified as critical. This vulnerability affects unknown code of the file /view/IPV6/ipv6A… |
CVE-2024-4505 | Medium | 4.7 | 2024-05-05 | A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240428. This affects an unknown part of the file /view/IPV6/ipv6Addr/ip_a… |
CVE-2024-4504 | Medium | 4.7 | 2024-05-05 | A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428. Affected by this issue is some unknown functionality of the… |
CVE-2024-4503 | Medium | 4.7 | 2024-05-05 | A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240428. Affected by this vulnerability is an unknown functionality of the file /view/… |
CVE-2024-4502 | Medium | 4.7 | 2024-05-05 | A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240428. Affected is an unknown function of the file /view/dhcp/dhcpClient/dhcp_c… |
CVE-2024-34519 | Medium | 6.8 | 2024-05-05 | Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367. If a user can create a dashboard with an auto-l… |
CVE-2024-34515 | High | 8.8 | 2024-05-05 | image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists(). |
CVE-2024-4501 | Medium | 4.7 | 2024-05-05 | A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been rated as critical. This issue affects some unknown processing of the file /view/bugSolve… |
CVE-2024-34510 | High | 7.5 | 2024-05-05 | Gradio before 4.20 allows credential leakage on Windows. |
CVE-2024-34509 | Medium | 5.3 | 2024-05-05 | dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. |
CVE-2024-34508 | Medium | 4.3 | 2024-05-05 | dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. |
CVE-2024-34507 | High | 7.4 | 2024-05-05 | An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occu… |
CVE-2024-34506 | High | 7.5 | 2024-05-05 | An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the… |
CVE-2024-34502 | Critical | 9.8 | 2024-05-05 | An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attemp… |
CVE-2024-34500 | Medium | 6.1 | 2024-05-05 | An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an… |
CVE-2024-4500 | Medium | 6.3 | 2024-05-05 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2024-34474 | High | 7.8 | 2024-05-05 | Clario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there as SYSTEM. |
CVE-2024-4497 | High | 8.8 | 2024-05-05 | A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been declared as critical. This vulnerability affects the function formexeCommand. The manipulati… |
CVE-2024-4496 | High | 8.8 | 2024-05-05 | A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been classified as critical. This affects the function formWifiMacFilterSet. The manipulation of… |
CVE-2024-4495 | High | 8.8 | 2024-05-05 | A vulnerability was found in Tenda i21 1.0.0.14(4656) and classified as critical. Affected by this issue is the function formWifiMacFilterGet. The manipulation… |
CVE-2024-4494 | High | 8.8 | 2024-05-05 | A vulnerability has been found in Tenda i21 1.0.0.14(4656) and classified as critical. Affected by this vulnerability is the function formSetUplinkInfo of the… |
CVE-2024-4493 | High | 8.8 | 2024-05-05 | A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656). Affected is the function formSetAutoPing. The manipulation of the arg… |
CVE-2024-34490 | Medium | 5.1 | 2024-05-05 | In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controlled by a local attac… |
CVE-2024-34489 | High | 7.5 | 2024-05-05 | OFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0. |
CVE-2024-34488 | High | 7.5 | 2024-05-05 | OFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0. |
CVE-2024-34487 | High | 7.5 | 2024-05-05 | OFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0. |