2024 CVEs (page 294)
Page 294 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34486 | High | 7.5 | 2024-05-05 | OFPPacketQueue in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPQueueProp.len=0. |
CVE-2024-34484 | Medium | 5.3 | 2024-05-05 | OFPBucket in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via action.len=0. |
CVE-2024-34483 | High | 7.5 | 2024-05-05 | OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPBucket.len=0. |
CVE-2024-4492 | High | 8.8 | 2024-05-05 | A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). This issue affects the function formOfflineSet of the file /gofo… |
CVE-2024-34478 | High | 7.5 | 2024-05-05 | btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically… |
CVE-2024-4491 | High | 8.8 | 2024-05-05 | A vulnerability classified as critical was found in Tenda i21 1.0.0.14(4656). This vulnerability affects the function formGetDiagnoseInfo. The manipulation of… |
CVE-2024-34476 | Medium | 5.3 | 2024-05-05 | Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs_nas_encrypt in lib/nas/common/security… |
CVE-2024-34475 | High | 7.5 | 2024-05-05 | Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm_state_authentication in amf/gmm-sm.c fo… |
CVE-2024-34473 | Medium | 5.3 | 2024-05-04 | An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. An attacker could register an unintended RMR message type during xApp registration to disrupt… |
CVE-2024-34469 | High | 7.1 | 2024-05-04 | Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save. |
CVE-2024-34468 | Medium | 6.1 | 2024-05-04 | Rukovoditel before 3.5.3 allows XSS via user_photo to My Page. |
CVE-2024-34467 | Medium | 6.1 | 2024-05-04 | ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl. |
CVE-2024-34462 | Medium | 6.1 | 2024-05-04 | Alinto SOGo through 5.10.0 allows XSS during attachment preview. |
CVE-2024-1050 | Medium | 4.3 | 2024-05-04 | The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax… |
CVE-2024-34461 | Critical | 9.8 | 2024-05-04 | Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a des… |
CVE-2024-34460 | Medium | 6.5 | 2024-05-04 | The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.) |
CVE-2024-3240 | High | 8.8 | 2024-05-04 | The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input… |
CVE-2024-3237 | Medium | 5.4 | 2024-05-04 | The ConvertPlug plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cp_dismiss_notice() function i… |
CVE-2024-3868 | Medium | 5.4 | 2024-05-04 | The Folders Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's First Name and Last Name in all versions up to, and including, 3… |
CVE-2024-34455 | High | 7.5 | 2024-05-03 | Buildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. A fix was released in 2024.02.2. |
CVE-2024-34453 | Medium | 4.3 | 2024-05-03 | TwoNav 2.1.13 contains an SSRF vulnerability via the url paramater to index.php?c=api&method=read_data&type=connectivity_test (which reaches /system/api.php). |
CVE-2024-34075 | Medium | 6.2 | 2024-05-03 | kurwov is a fast, dependency-free library for creating Markov Chains. An unsafe sanitization of dataset contents on the `MarkovData#getNext` method used in `Ma… |
CVE-2024-34068 | Medium | 6.4 | 2024-05-03 | Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously imp… |
CVE-2024-34067 | Medium | 6.1 | 2024-05-03 | Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance co… |
CVE-2024-34066 | High | 8.4 | 2024-05-03 | Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accide… |
CVE-2024-31673 | Critical | 9.8 | 2024-05-03 | Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in load_data.php via the userid parameter. |
CVE-2024-27453 | High | 8.6 | 2024-05-03 | In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machin… |
CVE-2024-33793 | Medium | 5.3 | 2024-05-03 | netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the ping test page. |
CVE-2024-33792 | Critical | 9.8 | 2024-05-03 | netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the tracert page. |
CVE-2024-33791 | Medium | 4.6 | 2024-05-03 | A cross-site scripting (XSS) vulnerability in netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj… |
CVE-2024-33789 | Critical | 9.8 | 2024-05-03 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the ipurl parameter at /API/info form endpoint. |
CVE-2024-31636 | Low | 3.9 | 2024-05-03 | An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component. |
CVE-2024-30851 | Medium | 6.5 | 2024-05-03 | Directory Traversal vulnerability in codesiddhant Jasmin Ransomware v.1.0.1 allows an attacker to obtain sensitive information via the download_file.php compon… |
CVE-2024-28519 | High | 7.8 | 2024-05-03 | A kernel handle leak issue in ProcObsrvesx.sys 4.0.0.49 in MicroWorld Technologies Inc eScan Antivirus could allow privilege escalation for low-privileged user… |
CVE-2024-34449 | Medium | 6.1 | 2024-05-03 | Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true. |
CVE-2024-34447 | High | 7.5 | 2024-05-03 | An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FI… |
CVE-2024-33398 | High | 7.5 | 2024-05-03 | There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to impersonate the servi… |
CVE-2024-3480 | Low | 2.8 | 2024-05-03 | An Implicit intent vulnerability was reported in the Motorola framework that could allow an attacker to read telephony-related data. |
CVE-2024-3479 | Low | 2.8 | 2024-05-03 | An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterprise.MotoDpmsProvider) that could allow… |
CVE-2024-34446 | High | 7.5 | 2024-05-03 | Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave… |
CVE-2024-33844 | High | 7.5 | 2024-05-03 | The 'control' in Parrot ANAFI USA firmware 1.10.4 does not check the MAV_MISSION_TYPE(0, 1, 2, 255), which allows attacker to cut off the connection between a… |
CVE-2024-29417 | High | 8.4 | 2024-05-03 | Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function. |
CVE-2024-3109 | Medium | 6.3 | 2024-05-03 | A hard-coded AES key vulnerability was reported in the Motorola GuideMe application, along with a lack of URI sanitation, could allow for a local attacker to… |
CVE-2024-3108 | Medium | 5.5 | 2024-05-03 | An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquire the location of t… |
CVE-2024-1395 | Medium | 6.7 | 2024-05-03 | Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing op… |
CVE-2024-1067 | High | 7.4 | 2024-05-03 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2024-33787 | High | 8.2 | 2024-05-03 | Hengan Weighing Management Information Query Platform 2019-2021 53.25 was discovered to contain a SQL injection vulnerability via the tuser_Number parameter at… |
CVE-2024-33786 | Critical | 9.8 | 2024-05-03 | An arbitrary file upload vulnerability in Zhongcheng Kexin Ticketing Management Platform 20.04 allows attackers to execute arbitrary code via uploading a craft… |
CVE-2024-2410 | High | 7.6 | 2024-05-03 | The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into se… |
CVE-2024-4466 | Critical | 9.8 | 2024-05-03 | SQL injection vulnerability in Gescen on the centrosdigitales.net platform. This vulnerability allows an attacker to send a specially crafted SQL query to the… |
CVE-2024-4461 | High | 7.8 | 2024-05-03 | Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows. This misconfiguration could allow an unauthorized local user to in… |
CVE-2024-34073 | High | 7.8 | 2024-05-03 | sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capture_dependencies functio… |
CVE-2024-34072 | High | 7.8 | 2024-05-03 | sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer mo… |
CVE-2024-34063 | Low | 2.5 | 2024-05-03 | vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to chan… |
CVE-2024-34062 | Medium | 4.8 | 2024-05-03 | tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through p… |
CVE-2024-32986 | Critical | 9.6 | 2024-05-03 | PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as… |
CVE-2024-33937 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in Nico Martin Progressive WordPress (PWA).This issue affects Progressive WordPress (PWA): from n/a through 2.1.13. |
CVE-2024-33931 | Medium | 6.5 | 2024-05-03 | Missing Authorization vulnerability in ilGhera JW Player for WordPress.This issue affects JW Player for WordPress: from n/a through 2.3.3. |
CVE-2024-33929 | Medium | 5.3 | 2024-05-03 | Missing Authorization vulnerability in wpWax Directorist.This issue affects Directorist: from n/a through 7.8.6. |
CVE-2024-33925 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in Adrian Mörchen Embed Google Fonts.This issue affects Embed Google Fonts: from n/a through 3.1.0. |
CVE-2024-33923 | Medium | 6.3 | 2024-05-03 | Missing Authorization vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager : from n/a through 4.69. |
CVE-2024-33921 | Medium | 4.3 | 2024-05-03 | Broken Access Control vulnerability in ReviewX.This issue affects ReviewX: from n/a through 1.6.21. |
CVE-2024-33920 | Medium | 5.3 | 2024-05-03 | Missing Authorization vulnerability in Kama Democracy Poll.This issue affects Democracy Poll: from n/a through 6.0.3. |
CVE-2024-33919 | Medium | 6.5 | 2024-05-03 | Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor.This issue affects RomethemeKit For Elementor: from n/a through 1.4.1. |
CVE-2024-33915 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1. |
CVE-2024-33914 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in Exclusive Addons Exclusive Addons Elementor.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.1. |
CVE-2024-23914 | Medium | 5.7 | 2024-05-03 | Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MC_Open_Association() function is used to open DICOM As… |
CVE-2024-23913 | Medium | 4.0 | 2024-05-03 | Use of Out-of-range Pointer Offset vulnerability in Merge DICOM Toolkit C/C++ on Windows. When deprecated MC_XML_To_Message() function is used to read a malfo… |
CVE-2024-23912 | Medium | 4.0 | 2024-05-03 | Out-of-bounds Read vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MC_Open_File() function is used to read a malformed DICOM data, it might result… |
CVE-2024-33941 | Medium | 5.3 | 2024-05-03 | Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder.This issue affects iPanorama 360 WordPress Virtual Tour Builder: fr… |
CVE-2024-33927 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team GIPHY Giphypress allows Stored XSS.This issue affect… |
CVE-2024-33926 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Karl Kiesinger GWP-Histats allows Stored XSS.This issue a… |
CVE-2024-33924 | High | 7.1 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Organic IDX plugin allows Reflected XSS… |
CVE-2024-33918 | Medium | 5.9 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maxim K AJAX Login and Registration modal popup + inline… |
CVE-2024-33916 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue af… |
CVE-2024-32831 | Medium | 5.9 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lorna Timbah (webgrrrl) Accessibility Widget allows Store… |
CVE-2024-32810 | High | 7.6 | 2024-05-03 | Missing Authorization vulnerability in ShortPixel ShortPixel Critical CSS.This issue affects ShortPixel Critical CSS: from n/a through 1.0.2. |
CVE-2024-28072 | Medium | 5.7 | 2024-05-03 | A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly. |
CVE-2024-24710 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in SlickRemix Feed Them Social.This issue affects Feed Them Social: from n/a through 4.2.0. |
CVE-2024-33947 | High | 7.1 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic allows Reflected XSS.This iss… |
CVE-2024-33946 | High | 7.1 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPify s.R.O. WPify Woo Czech allows Reflected XSS.This is… |
CVE-2024-33945 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solverwp.Com Eleblog – Elementor Blog And Magazine Addons… |
CVE-2024-33943 | Medium | 5.9 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyKite Ultimate Under Construction allows Stored XSS.T… |
CVE-2024-33940 | Medium | 5.9 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashan Jay EventON allows Stored XSS.This issue affects Ev… |
CVE-2024-33936 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Print-O-Matic allows Stored XSS.This issue a… |
CVE-2024-33935 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Bajorat PB MailCrypt allows Stored XSS.This issue… |
CVE-2024-33934 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey Lampert Mini Loops allows Stored XSS.This issue af… |
CVE-2024-33932 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vinod Dalvi Login Logout Register Menu allows Stored XSS… |
CVE-2024-33928 | High | 7.1 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon… |
CVE-2024-4439 | High | 7.2 | 2024-05-03 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient outp… |
CVE-2024-3703 | Medium | 4.7 | 2024-05-03 | The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where th… |
CVE-2024-3692 | Medium | 6.1 | 2024-05-03 | The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the b… |
CVE-2024-3637 | Medium | 6.1 | 2024-05-03 | The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allo… |
CVE-2024-34408 | Medium | 5.3 | 2024-05-03 | Tencent libpag through 4.3.51 has an integer overflow in DecodeStream::checkEndOfFile() in codec/utils/DecodeStream.cpp via a crafted PAG (Portable Animated Gr… |
CVE-2024-34404 | Medium | 6.8 | 2024-05-03 | A vulnerability was discovered in the Alta Recovery Vault feature of Veritas NetBackup before 10.4 and NetBackup Appliance before 5.4. By design, only the clou… |
CVE-2024-34403 | Medium | 5.9 | 2024-05-03 | An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string. |
CVE-2024-34402 | High | 8.6 | 2024-05-03 | An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer o… |
CVE-2024-34401 | Medium | 6.1 | 2024-05-03 | Savsoft Quiz 6.0 allows stored XSS via the index.php/quiz/insert_quiz/ quiz_name parameter. |
CVE-2024-34033 | High | 8.8 | 2024-05-03 | Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended di… |
CVE-2024-34032 | High | 8.8 | 2024-05-03 | Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploi… |