2024 CVEs (page 294)
Page 294 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-33793 | Medium | 5.3 | 2024-05-03 | netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the ping test page. |
CVE-2024-33792 | Critical | 9.8 | 2024-05-03 | netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the tracert page. |
CVE-2024-33791 | Medium | 4.6 | 2024-05-03 | A cross-site scripting (XSS) vulnerability in netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj… |
CVE-2024-33789 | Critical | 9.8 | 2024-05-03 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the ipurl parameter at /API/info form endpoint. |
CVE-2024-31636 | Low | 3.9 | 2024-05-03 | An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component. |
CVE-2024-30851 | Medium | 6.5 | 2024-05-03 | Directory Traversal vulnerability in codesiddhant Jasmin Ransomware v.1.0.1 allows an attacker to obtain sensitive information via the download_file.php compon… |
CVE-2024-28519 | High | 7.8 | 2024-05-03 | A kernel handle leak issue in ProcObsrvesx.sys 4.0.0.49 in MicroWorld Technologies Inc eScan Antivirus could allow privilege escalation for low-privileged user… |
CVE-2024-34449 | Medium | 6.1 | 2024-05-03 | Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true. |
CVE-2024-34447 | High | 7.5 | 2024-05-03 | An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FI… |
CVE-2024-33398 | High | 7.5 | 2024-05-03 | There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to impersonate the servi… |
CVE-2024-3480 | Low | 2.8 | 2024-05-03 | An Implicit intent vulnerability was reported in the Motorola framework that could allow an attacker to read telephony-related data. |
CVE-2024-3479 | Low | 2.8 | 2024-05-03 | An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterprise.MotoDpmsProvider) that could allow… |
CVE-2024-34446 | High | 7.5 | 2024-05-03 | Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave… |
CVE-2024-33844 | High | 7.5 | 2024-05-03 | The 'control' in Parrot ANAFI USA firmware 1.10.4 does not check the MAV_MISSION_TYPE(0, 1, 2, 255), which allows attacker to cut off the connection between a… |
CVE-2024-29417 | High | 8.4 | 2024-05-03 | Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function. |
CVE-2024-3109 | Medium | 6.3 | 2024-05-03 | A hard-coded AES key vulnerability was reported in the Motorola GuideMe application, along with a lack of URI sanitation, could allow for a local attacker to… |
CVE-2024-3108 | Medium | 5.5 | 2024-05-03 | An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquire the location of t… |
CVE-2024-1395 | Medium | 6.7 | 2024-05-03 | Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing op… |
CVE-2024-1067 | High | 7.4 | 2024-05-03 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2024-33787 | High | 8.2 | 2024-05-03 | Hengan Weighing Management Information Query Platform 2019-2021 53.25 was discovered to contain a SQL injection vulnerability via the tuser_Number parameter at… |
CVE-2024-33786 | Critical | 9.8 | 2024-05-03 | An arbitrary file upload vulnerability in Zhongcheng Kexin Ticketing Management Platform 20.04 allows attackers to execute arbitrary code via uploading a craft… |
CVE-2024-2410 | High | 7.6 | 2024-05-03 | The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into se… |
CVE-2024-4466 | Critical | 9.8 | 2024-05-03 | SQL injection vulnerability in Gescen on the centrosdigitales.net platform. This vulnerability allows an attacker to send a specially crafted SQL query to the… |
CVE-2024-4461 | High | 7.8 | 2024-05-03 | Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows. This misconfiguration could allow an unauthorized local user to in… |
CVE-2024-34073 | High | 7.8 | 2024-05-03 | sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capture_dependencies functio… |
CVE-2024-34072 | High | 7.8 | 2024-05-03 | sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer mo… |
CVE-2024-34063 | Low | 2.5 | 2024-05-03 | vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to chan… |
CVE-2024-34062 | Medium | 4.8 | 2024-05-03 | tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through p… |
CVE-2024-32986 | Critical | 9.6 | 2024-05-03 | PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as… |
CVE-2024-33937 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in Nico Martin Progressive WordPress (PWA).This issue affects Progressive WordPress (PWA): from n/a through 2.1.13. |
CVE-2024-33931 | Medium | 6.5 | 2024-05-03 | Missing Authorization vulnerability in ilGhera JW Player for WordPress.This issue affects JW Player for WordPress: from n/a through 2.3.3. |
CVE-2024-33929 | Medium | 5.3 | 2024-05-03 | Missing Authorization vulnerability in wpWax Directorist.This issue affects Directorist: from n/a through 7.8.6. |
CVE-2024-33925 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in Adrian Mörchen Embed Google Fonts.This issue affects Embed Google Fonts: from n/a through 3.1.0. |
CVE-2024-33923 | Medium | 6.3 | 2024-05-03 | Missing Authorization vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager : from n/a through 4.69. |
CVE-2024-33921 | Medium | 4.3 | 2024-05-03 | Broken Access Control vulnerability in ReviewX.This issue affects ReviewX: from n/a through 1.6.21. |
CVE-2024-33920 | Medium | 5.3 | 2024-05-03 | Missing Authorization vulnerability in Kama Democracy Poll.This issue affects Democracy Poll: from n/a through 6.0.3. |
CVE-2024-33919 | Medium | 6.5 | 2024-05-03 | Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor.This issue affects RomethemeKit For Elementor: from n/a through 1.4.1. |
CVE-2024-33915 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1. |
CVE-2024-33914 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in Exclusive Addons Exclusive Addons Elementor.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.1. |
CVE-2024-23914 | Medium | 5.7 | 2024-05-03 | Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MC_Open_Association() function is used to open DICOM As… |
CVE-2024-23913 | Medium | 4.0 | 2024-05-03 | Use of Out-of-range Pointer Offset vulnerability in Merge DICOM Toolkit C/C++ on Windows. When deprecated MC_XML_To_Message() function is used to read a malfo… |
CVE-2024-23912 | Medium | 4.0 | 2024-05-03 | Out-of-bounds Read vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MC_Open_File() function is used to read a malformed DICOM data, it might result… |
CVE-2024-33941 | Medium | 5.3 | 2024-05-03 | Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder.This issue affects iPanorama 360 WordPress Virtual Tour Builder: fr… |
CVE-2024-33927 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team GIPHY Giphypress allows Stored XSS.This issue affect… |
CVE-2024-33926 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Karl Kiesinger GWP-Histats allows Stored XSS.This issue a… |
CVE-2024-33924 | High | 7.1 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Organic IDX plugin allows Reflected XSS… |
CVE-2024-33918 | Medium | 5.9 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maxim K AJAX Login and Registration modal popup + inline… |
CVE-2024-33916 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue af… |
CVE-2024-32831 | Medium | 5.9 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lorna Timbah (webgrrrl) Accessibility Widget allows Store… |
CVE-2024-32810 | High | 7.6 | 2024-05-03 | Missing Authorization vulnerability in ShortPixel ShortPixel Critical CSS.This issue affects ShortPixel Critical CSS: from n/a through 1.0.2. |
CVE-2024-28072 | Medium | 5.7 | 2024-05-03 | A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly. |
CVE-2024-24710 | Medium | 4.3 | 2024-05-03 | Missing Authorization vulnerability in SlickRemix Feed Them Social.This issue affects Feed Them Social: from n/a through 4.2.0. |
CVE-2024-33947 | High | 7.1 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic allows Reflected XSS.This iss… |
CVE-2024-33946 | High | 7.1 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPify s.R.O. WPify Woo Czech allows Reflected XSS.This is… |
CVE-2024-33945 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solverwp.Com Eleblog – Elementor Blog And Magazine Addons… |
CVE-2024-33943 | Medium | 5.9 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyKite Ultimate Under Construction allows Stored XSS.T… |
CVE-2024-33940 | Medium | 5.9 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashan Jay EventON allows Stored XSS.This issue affects Ev… |
CVE-2024-33936 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Print-O-Matic allows Stored XSS.This issue a… |
CVE-2024-33935 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Bajorat PB MailCrypt allows Stored XSS.This issue… |
CVE-2024-33934 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey Lampert Mini Loops allows Stored XSS.This issue af… |
CVE-2024-33932 | Medium | 6.5 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vinod Dalvi Login Logout Register Menu allows Stored XSS… |
CVE-2024-33928 | High | 7.1 | 2024-05-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon… |
CVE-2024-4439 | High | 7.2 | 2024-05-03 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient outp… |
CVE-2024-3703 | Medium | 4.7 | 2024-05-03 | The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where th… |
CVE-2024-3692 | Medium | 6.1 | 2024-05-03 | The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the b… |
CVE-2024-3637 | Medium | 6.1 | 2024-05-03 | The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allo… |
CVE-2024-34408 | Medium | 5.3 | 2024-05-03 | Tencent libpag through 4.3.51 has an integer overflow in DecodeStream::checkEndOfFile() in codec/utils/DecodeStream.cpp via a crafted PAG (Portable Animated Gr… |
CVE-2024-34404 | Medium | 6.8 | 2024-05-03 | A vulnerability was discovered in the Alta Recovery Vault feature of Veritas NetBackup before 10.4 and NetBackup Appliance before 5.4. By design, only the clou… |
CVE-2024-34403 | Medium | 5.9 | 2024-05-03 | An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string. |
CVE-2024-34402 | High | 8.6 | 2024-05-03 | An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer o… |
CVE-2024-34401 | Medium | 6.1 | 2024-05-03 | Savsoft Quiz 6.0 allows stored XSS via the index.php/quiz/insert_quiz/ quiz_name parameter. |
CVE-2024-34033 | High | 8.8 | 2024-05-03 | Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended di… |
CVE-2024-34032 | High | 8.8 | 2024-05-03 | Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploi… |
CVE-2024-34031 | High | 8.8 | 2024-05-03 | Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit… |
CVE-2024-30306 | High | 7.8 | 2024-05-02 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could res… |
CVE-2024-30305 | High | 7.8 | 2024-05-02 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-30304 | High | 7.8 | 2024-05-02 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-30303 | High | 7.8 | 2024-05-02 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-30302 | Medium | 5.5 | 2024-05-02 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory… |
CVE-2024-30301 | High | 7.8 | 2024-05-02 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-25047 | High | 8.6 | 2024-05-02 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided… |
CVE-2024-4140 | High | 7.5 | 2024-05-02 | An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The… |
CVE-2024-34394 | High | 8.1 | 2024-05-02 | libxmljs2 is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes XmlNode… |
CVE-2024-34393 | High | 8.1 | 2024-05-02 | libxmljs2 is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was call… |
CVE-2024-34392 | High | 8.1 | 2024-05-02 | libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes _wrap__xm… |
CVE-2024-34391 | High | 8.1 | 2024-05-02 | libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was calle… |
CVE-2024-33396 | High | 8.4 | 2024-05-02 | An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. |
CVE-2024-4216 | High | 7.4 | 2024-05-02 | pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script a… |
CVE-2024-4215 | High | 7.4 | 2024-05-02 | pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’… |
CVE-2024-33394 | Medium | 5.9 | 2024-05-02 | An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. |
CVE-2024-4334 | Medium | 6.4 | 2024-05-02 | The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the ‘typing_cursor… |
CVE-2024-4324 | Medium | 6.4 | 2024-05-02 | The WP Video Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.9.10… |
CVE-2024-4265 | Medium | 6.4 | 2024-05-02 | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-4203 | Medium | 5.4 | 2024-05-02 | The Premium Addons Pro for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maps widget in all versions up to, and including… |
CVE-2024-4156 | Medium | 6.4 | 2024-05-02 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-4133 | Medium | 6.1 | 2024-05-02 | The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Open Redirect in all ver… |
CVE-2024-4097 | High | 7.2 | 2024-05-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including… |
CVE-2024-4092 | Medium | 6.4 | 2024-05-02 | The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmltag’ parameter in all versions up to, and including, 6.7.7… |
CVE-2024-4086 | Medium | 4.3 | 2024-05-02 | The CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.1… |
CVE-2024-4085 | Medium | 4.4 | 2024-05-02 | The Tabellen von faustball.com plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.0.4… |