2024 CVEs (page 303)
Page 303 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-30939 | Medium | 6.8 | 2024-04-25 | An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attacker to gain control of an account via a… |
CVE-2024-3625 | High | 7.3 | 2024-04-25 | A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a… |
CVE-2024-3624 | High | 7.3 | 2024-04-25 | A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with acc… |
CVE-2024-3623 | Medium | 6.5 | 2024-04-25 | A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configur… |
CVE-2024-3622 | High | 8.8 | 2024-04-25 | A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration templat… |
CVE-2024-3508 | Medium | 4.3 | 2024-04-25 | A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fiel… |
CVE-2024-32649 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval… |
CVE-2024-32648 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and th… |
CVE-2024-32647 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can resul… |
CVE-2024-32646 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double ev… |
CVE-2024-32645 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` built… |
CVE-2024-2905 | Medium | 6.2 | 2024-04-25 | A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. Thi… |
CVE-2024-32481 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `rang… |
CVE-2024-32467 | Medium | 5.7 | 2024-04-25 | MeterSphere is an open source continuous testing platform. Prior to version 2.10.14-lts, members without space permissions can view member information from oth… |
CVE-2024-32358 | High | 7.5 | 2024-04-25 | An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerabi… |
CVE-2024-32236 | Low | 3.5 | 2024-04-25 | An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component. |
CVE-2024-31574 | Medium | 5.0 | 2024-04-25 | Cross Site Scripting vulnerability in TWCMS v.2.6 allows a local attacker to execute arbitrary code via a crafted script |
CVE-2024-30890 | Medium | 4.7 | 2024-04-25 | Cross Site Scripting vulnerability in ED01-CMS v.1.0 allows an attacker to obtain sensitive information via the categories.php component. |
CVE-2024-2467 | Medium | 5.9 | 2024-04-25 | A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbac… |
CVE-2024-29660 | Medium | 5.3 | 2024-04-25 | Cross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselect_main.php componen… |
CVE-2024-28241 | High | 7.3 | 2024-04-25 | The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain… |
CVE-2024-28240 | High | 7.3 | 2024-04-25 | The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cau… |
CVE-2024-25624 | Medium | 6.8 | 2024-04-25 | Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 env… |
CVE-2024-1726 | Medium | 5.3 | 2024-04-25 | A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization… |
CVE-2024-1657 | High | 8.1 | 2024-04-25 | A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An a… |
CVE-2024-1139 | High | 7.7 | 2024-04-25 | A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials t… |
CVE-2024-1102 | Medium | 6.5 | 2024-04-25 | A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the datab… |
CVE-2024-0874 | Medium | 5.3 | 2024-04-25 | A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching. |
CVE-2024-33592 | Medium | 5.4 | 2024-04-25 | Server-Side Request Forgery (SSRF) vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73. |
CVE-2024-25569 | Medium | 6.5 | 2024-04-25 | An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM fi… |
CVE-2024-22391 | High | 7.7 | 2024-04-25 | A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted mal… |
CVE-2024-22373 | High | 8.1 | 2024-04-25 | An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially… |
CVE-2024-4172 | Medium | 4.3 | 2024-04-25 | A vulnerability classified as problematic was found in idcCMS 1.35. Affected by this vulnerability is an unknown functionality of the file /admin/admin_cl.php?… |
CVE-2024-4171 | High | 8.8 | 2024-04-25 | A vulnerability classified as critical has been found in Tenda W30E 1.0/1.0.1.25. Affected is the function fromWizardHandle of the file /goform/WizardHandle. T… |
CVE-2024-4024 | High | 7.3 | 2024-04-25 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versi… |
CVE-2024-4006 | Medium | 4.3 | 2024-04-25 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all vers… |
CVE-2024-4170 | High | 8.8 | 2024-04-25 | A vulnerability was found in Tenda 4G300 1.01.42. It has been rated as critical. This issue affects the function sub_429A30. The manipulation of the argument l… |
CVE-2024-4169 | High | 8.8 | 2024-04-25 | A vulnerability was found in Tenda 4G300 1.01.42. It has been declared as critical. This vulnerability affects the function sub_42775C/sub_4279CC. The manipula… |
CVE-2024-33247 | High | 8.8 | 2024-04-25 | Sourcecodester Employee Task Management System v1.0 is vulnerable to SQL Injection via admin-manage-user.php. |
CVE-2024-25026 | Medium | 5.9 | 2024-04-25 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused… |
CVE-2024-4175 | Medium | 5.4 | 2024-04-25 | Unicode transformation vulnerability in Hyperion affecting version 2.0.15. This vulnerability could allow an attacker to send a malicious payload with Unicode… |
CVE-2024-4174 | Medium | 5.4 | 2024-04-25 | Cross-Site Scripting (XSS) vulnerability in Hyperion Web Server affecting version 2.0.15. This vulnerability could allow an attacker to execute malicious Javas… |
CVE-2024-4168 | High | 8.8 | 2024-04-25 | A vulnerability was found in Tenda 4G300 1.01.42. It has been classified as critical. This affects the function sub_4260F0. The manipulation of the argument up… |
CVE-2024-4167 | High | 8.8 | 2024-04-25 | A vulnerability was found in Tenda 4G300 1.01.42 and classified as critical. Affected by this issue is the function sub_422AA4. The manipulation of the argumen… |
CVE-2024-4166 | High | 8.8 | 2024-04-25 | A vulnerability has been found in Tenda 4G300 1.01.42 and classified as critical. Affected by this vulnerability is the function sub_41E858. The manipulation o… |
CVE-2024-4165 | High | 8.8 | 2024-04-25 | A vulnerability, which was classified as critical, was found in Tenda G3 15.11.0.17(9502). Affected is the function modifyDhcpRule of the file /goform/modifyDh… |
CVE-2024-4164 | High | 8.8 | 2024-04-25 | A vulnerability, which was classified as critical, has been found in Tenda G3 15.11.0.17(9502). This issue affects the function formModifyPppAuthWhiteMac of th… |
CVE-2024-3730 | Medium | 5.4 | 2024-04-25 | The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in al… |
CVE-2024-32676 | Medium | 5.3 | 2024-04-25 | Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue… |
CVE-2024-2829 | High | 7.5 | 2024-04-25 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all vers… |
CVE-2024-2434 | High | 8.5 | 2024-04-25 | An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where p… |
CVE-2024-1347 | Medium | 4.3 | 2024-04-25 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from… |
CVE-2024-4077 | High | 7.1 | 2024-04-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign allows Reflected XSS.This issue affec… |
CVE-2024-4035 | Medium | 6.4 | 2024-04-25 | The Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all ver… |
CVE-2024-3994 | Medium | 5.4 | 2024-04-25 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list'… |
CVE-2024-32961 | Medium | 6.5 | 2024-04-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy.This issue affects Block… |
CVE-2024-25583 | High | 7.5 | 2024-04-25 | A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default co… |
CVE-2024-3733 | Medium | 5.3 | 2024-04-25 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information… |
CVE-2024-31266 | Critical | 9.1 | 2024-04-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in AlgolPlus Advanced Order Export For WooCommerce allows Code Injection.This issue aff… |
CVE-2024-30560 | Critical | 9.6 | 2024-04-25 | Cross-Site Request Forgery (CSRF) vulnerability in 大侠WP DX-Watermark.This issue affects DX-Watermark: from n/a through 1.0.4. |
CVE-2024-25917 | High | 8.8 | 2024-04-25 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodeRevolution WP Setup Wizard.This issue affects WP Setup Wizard: from n/a through… |
CVE-2024-22144 | Critical | 9.0 | 2024-04-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in Eli Scheetz Anti-Malware Security and Brute-Force Firewall gotmls allows Code Inject… |
CVE-2024-4173 | High | 7.6 | 2024-04-25 | A vulnerability in Brocade SANnav exposes Kafka in the wan interface. The vulnerability could allow an unauthenticated attacker to perform various attacks, i… |
CVE-2024-3988 | Medium | 6.4 | 2024-04-25 | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress i… |
CVE-2024-3929 | Medium | 6.4 | 2024-04-25 | The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cros… |
CVE-2024-3893 | Medium | 4.3 | 2024-04-25 | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability… |
CVE-2024-4161 | High | 8.6 | 2024-04-25 | In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitiv… |
CVE-2024-4159 | Medium | 4.3 | 2024-04-25 | Brocade SANnav before v2.3.0a lacks protection mechanisms on port 2377/TCP and 7946/TCP, which could allow an unauthenticated attacker to sniff the SANnav Doc… |
CVE-2024-2907 | Medium | 6.8 | 2024-04-25 | The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor… |
CVE-2024-29205 | High | 7.5 | 2024-04-25 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x… |
CVE-2024-26926 | High | 7.8 | 2024-04-25 | In the Linux kernel, the following vulnerability has been resolved: binder: check offset alignment in binder_get_object() Commit 6d98eb95b450 ("binder: avoid… |
CVE-2024-26925 | High | 7.8 | 2024-04-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path The commit mutex… |
CVE-2024-26924 | High | 7.8 | 2024-04-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batc… |
CVE-2024-26923 | High | 7.8 | 2024-04-25 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take i… |
CVE-2024-23527 | High | 7.5 | 2024-04-25 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote… |
CVE-2024-20313 | High | 7.4 | 2024-04-24 | A vulnerability in the OSPF version 2 (OSPFv2) feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device t… |
CVE-2024-4127 | High | 8.8 | 2024-04-24 | A vulnerability was found in Tenda W15E 15.11.0.14. It has been classified as critical. Affected is the function guestWifiRuleRefresh. The manipulation of the… |
CVE-2024-4126 | High | 8.8 | 2024-04-24 | A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. This issue affects the function formSetSysTime of the file /goform/SetSysTimeCfg… |
CVE-2024-32879 | Medium | 4.9 | 2024-04-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB dat… |
CVE-2024-20358 | Medium | 6.0 | 2024-04-24 | A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense… |
CVE-2024-20356 | High | 8.7 | 2024-04-24 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with Admini… |
CVE-2024-20295 | High | 8.8 | 2024-04-24 | A vulnerability in the CLI of the Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to perform command injection attack… |
CVE-2024-4141 | Low | 2.9 | 2024-04-24 | Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font. The root problem was a bounds check that was being… |
CVE-2024-4125 | High | 8.8 | 2024-04-24 | A vulnerability has been found in Tenda W15E 15.11.0.14 and classified as critical. This vulnerability affects the function formSetStaticRoute of the file /gof… |
CVE-2024-4124 | High | 8.8 | 2024-04-24 | A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14. This affects the function formSetRemoteWebManage of the file /goform/Set… |
CVE-2024-4123 | High | 8.8 | 2024-04-24 | A vulnerability, which was classified as critical, has been found in Tenda W15E 15.11.0.14. Affected by this issue is the function formSetPortMapping of the fi… |
CVE-2024-32876 | High | 8.5 | 2024-04-24 | NewPipe is an Android app for video streaming written in Java. It supports exporting and importing backups, as a way to let users move their data to a new devi… |
CVE-2024-20359 | Medium | 6.0 | 2024-04-24 | A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appli… |
CVE-2024-20353 | High | 8.6 | 2024-04-24 | A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software co… |
CVE-2024-4122 | High | 8.8 | 2024-04-24 | A vulnerability classified as critical was found in Tenda W15E 15.11.0.14. Affected by this vulnerability is the function formSetDebugCfg of the file /goform/s… |
CVE-2024-4121 | High | 8.8 | 2024-04-24 | A vulnerability classified as critical has been found in Tenda W15E 15.11.0.14. Affected is the function formQOSRuleDel. The manipulation of the argument qosIn… |
CVE-2024-4120 | High | 8.8 | 2024-04-24 | A vulnerability was found in Tenda W15E 15.11.0.14. It has been rated as critical. This issue affects the function formIPMacBindModify of the file /goform/modi… |
CVE-2024-0151 | Medium | 6.5 | 2024-04-24 | Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled using toolchains t… |
CVE-2024-4119 | High | 8.8 | 2024-04-24 | A vulnerability was found in Tenda W15E 15.11.0.14. It has been declared as critical. This vulnerability affects the function formIPMacBindDel of the file /gof… |
CVE-2024-4118 | High | 8.8 | 2024-04-24 | A vulnerability was found in Tenda W15E 15.11.0.14. It has been classified as critical. This affects the function formIPMacBindAdd of the file /goform/addIpMac… |
CVE-2024-3371 | High | 7.1 | 2024-04-24 | MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including… |
CVE-2024-27791 | High | 7.1 | 2024-04-24 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonom… |
CVE-2024-23271 | Medium | 6.5 | 2024-04-24 | A logic issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. A m… |
CVE-2024-23228 | Low | 3.3 | 2024-04-24 | This issue was addressed through improved state management. This issue is fixed in iOS 17.3 and iPadOS 17.3. Locked Notes content may have been unexpectedly un… |
CVE-2024-4117 | High | 8.8 | 2024-04-24 | A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. Affected by this issue is the function formDelPortMapping of the file /goform/De… |