2024 CVEs (page 305)
Page 305 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4031 | Medium | 4.4 | 2024-04-23 | Unquoted Search Path or Element vulnerability in Logitech MEVO WEBCAM APP on Windows allows Local Execution of Code. |
CVE-2024-3889 | Medium | 6.4 | 2024-04-23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Accordion widget in all ve… |
CVE-2024-2799 | Medium | 6.4 | 2024-04-23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid & Advanced Text widget HTML tags… |
CVE-2024-2798 | Medium | 6.4 | 2024-04-23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget containers in all versions u… |
CVE-2024-2493 | High | 7.5 | 2024-04-23 | Session Hijacking vulnerability in Hitachi Ops Center Analyzer.This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.1-00. |
CVE-2024-31857 | Medium | 5.4 | 2024-04-23 | Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc… |
CVE-2024-31077 | High | 7.2 | 2024-04-23 | Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative p… |
CVE-2024-28890 | Medium | 5.3 | 2024-04-23 | Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may… |
CVE-2024-21511 | Critical | 9.8 | 2024-04-23 | Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFo… |
CVE-2024-2760 | Medium | 5.5 | 2024-04-23 | Bkav Home v7816, build 2403161130 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x222240 IOCTL code of the BkavSDFlt.sys driver. |
CVE-2024-1241 | Medium | 5.5 | 2024-04-23 | Watchdog Antivirus v1.6.415 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002014 IOCTL code of the wsdk-driver.sys driver. |
CVE-2024-3293 | High | 8.8 | 2024-04-23 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to blind SQL Injection via the rtmedia_gallery shortcode in all versions u… |
CVE-2024-3177 | Low | 2.7 | 2024-04-22 | A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAcco… |
CVE-2024-32657 | Medium | 4.6 | 2024-04-22 | Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticate… |
CVE-2024-32656 | High | 7.8 | 2024-04-22 | Ant Media Server is live streaming engine software. A local privilege escalation vulnerability in present in versions 2.6.0 through 2.8.2 allows any unprivileg… |
CVE-2024-32653 | Medium | 6.1 | 2024-04-22 | jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary co… |
CVE-2024-32480 | High | 7.2 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The `order` parameter is… |
CVE-2024-32479 | High | 7.1 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the `Service` template n… |
CVE-2024-32461 | High | 7.1 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in LibreNMS prior to… |
CVE-2024-32460 | High | 8.1 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRD… |
CVE-2024-32459 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are v… |
CVE-2024-31036 | Medium | 6.8 | 2024-04-22 | A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of service via transmission of crafted hex… |
CVE-2024-32458 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to… |
CVE-2024-32394 | High | 8.8 | 2024-04-22 | An issue in ruijie.com/cn RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S_07150910 and RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S_07150910 allows a… |
CVE-2024-32041 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to… |
CVE-2024-32040 | High | 8.1 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connecti… |
CVE-2024-32039 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to in… |
CVE-2024-29368 | Medium | 6.5 | 2024-04-22 | An arbitrary file upload vulnerability in the file handling module of moziloCMS v2.0 allows attackers to bypass extension restrictions via file renaming, poten… |
CVE-2024-27574 | Critical | 9.1 | 2024-04-22 | SQL Injection vulnerability in Trainme Academy version Ichin v.1.3.2 allows a remote attacker to obtain sensitive information via the informacion, idcurso, and… |
CVE-2024-4040 | Critical | 9.8 | 2024-04-22 | A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to… |
CVE-2024-32405 | Low | 2.6 | 2024-04-22 | Cross Site Scripting vulnerability in inducer relate before v.2024.1 allows a remote attacker to escalate privileges via a crafted payload to the Answer field… |
CVE-2024-32399 | High | 7.6 | 2024-04-22 | Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via the /webeditor/ co… |
CVE-2024-32238 | Critical | 9.8 | 2024-04-22 | H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accessed via the management system page login… |
CVE-2024-32407 | High | 8.8 | 2024-04-22 | An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature. |
CVE-2024-31545 | Critical | 9.4 | 2024-04-22 | Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manage_user&id=6. |
CVE-2024-29376 | Medium | 6.4 | 2024-04-22 | Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. |
CVE-2024-31666 | Critical | 9.8 | 2024-04-22 | An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit_addon_post.php component. |
CVE-2024-28436 | Medium | 6.1 | 2024-04-22 | Cross Site Scripting vulnerability in D-Link DAP products DAP-2230, DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2590, DAP-2690, DAP-2695, DAP-3520, DAP-3662 al… |
CVE-2024-28699 | High | 7.8 | 2024-04-22 | A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev func… |
CVE-2024-3645 | Medium | 6.4 | 2024-04-22 | The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Counter widget in all versions up to… |
CVE-2024-32368 | High | 7.3 | 2024-04-22 | Insecure Permission vulnerability in Agasta Sanketlife 2.0 Pocket 12-Lead ECG Monitor FW Version 3.0 allows a local attacker to cause a denial of service via t… |
CVE-2024-27349 | Critical | 9.1 | 2024-04-22 | Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are reco… |
CVE-2024-27348 | Critical | 9.8 | 2024-04-22 | RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Us… |
CVE-2024-27347 | Medium | 5.3 | 2024-04-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0. Users are rec… |
CVE-2024-4026 | Medium | 4.6 | 2024-04-22 | Cross-Site Scripting (XSS) vulnerability in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within all editabl… |
CVE-2024-29661 | Critical | 9.8 | 2024-04-22 | A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload. |
CVE-2024-28717 | Medium | 4.9 | 2024-04-22 | An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component. |
CVE-2024-22856 | Medium | 5.4 | 2024-04-22 | A SQL injection vulnerability via the Save Favorite Search function in Axefinance Axe Credit Portal >= v.3.0 allows authenticated attackers to execute unintend… |
CVE-2024-22815 | Medium | 5.3 | 2024-04-22 | An issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) via crafte… |
CVE-2024-22813 | Medium | 4.4 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memory, disrupting netw… |
CVE-2024-22811 | High | 8.2 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between… |
CVE-2024-22809 | Medium | 6.5 | 2024-04-22 | Incorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder and view sensitive inf… |
CVE-2024-22808 | High | 7.5 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between… |
CVE-2024-22807 | Medium | 6.5 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to erase a critical sector of the flash memory, causing the machine to lose… |
CVE-2024-32691 | Medium | 5.3 | 2024-04-22 | Missing Authorization vulnerability in realmag777 Active Products Tables for WooCommerce.This issue affects Active Products Tables for WooCommerce: from n/a th… |
CVE-2024-32688 | Medium | 6.5 | 2024-04-22 | Missing Authorization vulnerability in Long Watch Studio MyRewards.This issue affects MyRewards: from n/a through 5.3.0. |
CVE-2024-32687 | Medium | 4.3 | 2024-04-22 | Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce.This issue affects WPC Frequently Bought Together for WooCommerc… |
CVE-2024-32684 | Medium | 5.3 | 2024-04-22 | Missing Authorization vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5. |
CVE-2024-32682 | High | 7.1 | 2024-04-22 | Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3… |
CVE-2024-32681 | Medium | 4.3 | 2024-04-22 | Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3… |
CVE-2024-32698 | Medium | 6.5 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-a… |
CVE-2024-32697 | Medium | 6.5 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso allows Stored XSS.This issue affects HelloAsso… |
CVE-2024-32696 | Medium | 6.5 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Infographic Maker – iList allows Stored XSS… |
CVE-2024-32695 | High | 7.1 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Gasi Language Switcher for Transposh allows Reflect… |
CVE-2024-32694 | High | 7.1 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF E… |
CVE-2024-32693 | High | 7.6 | 2024-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in ValvePress Automatic.This issue affects Automatic: from n/a before 3.93.0. |
CVE-2024-32690 | Medium | 5.9 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood RSS Feed Widget allows Stored XSS.This issu… |
CVE-2024-32418 | Critical | 9.8 | 2024-04-22 | An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add_addon.php component. |
CVE-2024-30799 | Medium | 4.4 | 2024-04-22 | An issue in PX4 Autopilot v1.14 and before allows a remote attacker to execute arbitrary code and cause a denial of service via the Breach Return Point functio… |
CVE-2024-28722 | Medium | 6.3 | 2024-04-22 | Cross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the query parameter to th… |
CVE-2024-29733 | Low | 2.7 | 2024-04-21 | Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which… |
CVE-2024-29217 | Medium | 4.6 | 2024-04-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1… |
CVE-2024-4022 | Medium | 5.3 | 2024-04-21 | A vulnerability was found in Keenetic KN-1010, KN-1410, KN-1711, KN-1810 and KN-1910 up to 4.1.2.15. It has been rated as problematic. Affected by this issue i… |
CVE-2024-4021 | Medium | 5.3 | 2024-04-21 | A vulnerability was found in Keenetic KN-1010, KN-1410, KN-1711, KN-1810 and KN-1910 up to 4.1.2.15. It has been declared as problematic. Affected by this vuln… |
CVE-2024-4020 | High | 8.8 | 2024-04-20 | A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromAddressNat of the file /goform/addressN… |
CVE-2024-4019 | Medium | 6.3 | 2024-04-20 | A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /impo… |
CVE-2024-4014 | Medium | 6.4 | 2024-04-20 | The hCaptcha for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf7-hcaptcha shortcode in all versions up to, and… |
CVE-2024-1730 | Medium | 5.4 | 2024-04-20 | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) p… |
CVE-2024-1057 | Medium | 6.4 | 2024-04-20 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Sto… |
CVE-2024-31994 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie will atte… |
CVE-2024-1480 | High | 7.5 | 2024-04-19 | Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication. |
CVE-2024-4018 | High | 8.8 | 2024-04-19 | Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (local appliance api modules) allows Privilege Escalation.This… |
CVE-2024-4017 | High | 8.8 | 2024-04-19 | Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (filesystem modules) allows DLL Side-Loading.This issue affect… |
CVE-2024-32392 | Medium | 4.5 | 2024-04-19 | Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component. |
CVE-2024-32391 | High | 7.3 | 2024-04-19 | Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload. |
CVE-2024-31993 | Medium | 6.2 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the scrape_image function will retrieve an image based on a user-provided URL, however… |
CVE-2024-31992 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a r… |
CVE-2024-31991 | Medium | 4.1 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a r… |
CVE-2024-31584 | Medium | 5.5 | 2024-04-19 | Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp. |
CVE-2024-30974 | High | 7.3 | 2024-04-19 | SQL Injection vulnerability in autoexpress v.1.3.0 allows attackers to run arbitrary SQL commands via the carId parameter. |
CVE-2024-22905 | High | 7.0 | 2024-04-19 | Buffer Overflow vulnerability in ARM mbed-os v.6.17.0 allows a remote attacker to execute arbitrary code via a crafted script to the hciTrSerialRxIncoming func… |
CVE-2024-1681 | Medium | 5.3 | 2024-04-19 | corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending… |
CVE-2024-32652 | High | 7.5 | 2024-04-19 | The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a va… |
CVE-2024-31450 | Low | 2.7 | 2024-04-19 | Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API a… |
CVE-2024-3979 | Medium | 4.4 | 2024-04-19 | A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10. Affected by this issue is some unknown functionality. The… |
CVE-2024-31547 | Critical | 9.1 | 2024-04-19 | Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/item/view_item.php. |
CVE-2024-31546 | Critical | 9.8 | 2024-04-19 | Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/damage/view_damage.php. |
CVE-2024-31552 | High | 7.1 | 2024-04-19 | CuteHttpFileServer v.3.1 version has an arbitrary file download vulnerability, which allows attackers to download arbitrary files on the server and obtain sens… |
CVE-2024-2440 | Medium | 5.5 | 2024-04-19 | A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter r… |
CVE-2024-29991 | Medium | 5.0 | 2024-04-19 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |