2024 CVEs (page 305)
Page 305 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4062 | Low | 3.7 | 2024-04-23 | A vulnerability was found in Hualai Xiaofang iSC5 3.2.2_112 and classified as problematic. Affected by this issue is some unknown functionality. The manipulati… |
CVE-2024-32658 | Critical | 9.8 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5… |
CVE-2024-32482 | Low | 2.2 | 2024-04-23 | The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’… |
CVE-2024-31208 | Medium | 6.5 | 2024-04-23 | Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch spe… |
CVE-2024-21979 | Medium | 5.3 | 2024-04-23 | An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed shader to potentia… |
CVE-2024-21972 | Medium | 5.3 | 2024-04-23 | An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed shader to potentia… |
CVE-2024-32258 | High | 8.8 | 2024-04-23 | The network server of fceux 2.7.0 has a path traversal vulnerability, allowing attackers to overwrite any files on the server without authentication by fake RO… |
CVE-2024-33217 | High | 7.5 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter in ip/goform/addressNat. |
CVE-2024-33215 | Critical | 9.8 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/addressNat. |
CVE-2024-33214 | High | 7.5 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter in ip/goform/RouteStatic. |
CVE-2024-33213 | Medium | 6.5 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/RouteStatic. |
CVE-2024-33212 | High | 8.8 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter in ip/goform/setcfm. |
CVE-2024-33211 | High | 7.3 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the PPPOEPassword parameter in ip/goform/QuickIndex. |
CVE-2024-32679 | Medium | 5.3 | 2024-04-23 | Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.16. |
CVE-2024-31804 | Medium | 6.7 | 2024-04-23 | An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privileges via the Program.exe component. |
CVE-2024-28130 | High | 7.5 | 2024-04-23 | An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malform… |
CVE-2024-2477 | Medium | 6.4 | 2024-04-23 | The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all versions up to, and… |
CVE-2024-28627 | High | 7.5 | 2024-04-23 | An issue in Flipsnack v.18/03/2024 allows a local attacker to obtain sensitive information via the reader.gz.js file. |
CVE-2024-3911 | Medium | 6.5 | 2024-04-23 | An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames. |
CVE-2024-30800 | Medium | 5.6 | 2024-04-23 | PX4 Autopilot v.1.14 allows an attacker to fly the drone into no-fly zones by breaching the geofence using flaws in the function. |
CVE-2024-26922 | High | 7.8 | 2024-04-23 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate the parameters of bo mapping operations more clearly Verify the para… |
CVE-2024-3491 | Medium | 6.4 | 2024-04-23 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all v… |
CVE-2024-3732 | Medium | 6.4 | 2024-04-23 | The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi… |
CVE-2024-3665 | Medium | 6.4 | 2024-04-23 | The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's HowTo and FAQ widgets in all versions up… |
CVE-2024-3185 | Medium | 6.8 | 2024-04-23 | A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an atta… |
CVE-2024-0900 | Medium | 4.3 | 2024-04-23 | The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! plugin for WordPress… |
CVE-2024-3664 | Medium | 4.3 | 2024-04-23 | The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_thumbnail and de… |
CVE-2024-4031 | Medium | 4.4 | 2024-04-23 | Unquoted Search Path or Element vulnerability in Logitech MEVO WEBCAM APP on Windows allows Local Execution of Code. |
CVE-2024-3889 | Medium | 6.4 | 2024-04-23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Accordion widget in all ve… |
CVE-2024-2799 | Medium | 6.4 | 2024-04-23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid & Advanced Text widget HTML tags… |
CVE-2024-2798 | Medium | 6.4 | 2024-04-23 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget containers in all versions u… |
CVE-2024-2493 | High | 7.5 | 2024-04-23 | Session Hijacking vulnerability in Hitachi Ops Center Analyzer.This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.1-00. |
CVE-2024-31857 | Medium | 5.4 | 2024-04-23 | Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc… |
CVE-2024-31077 | High | 7.2 | 2024-04-23 | Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative p… |
CVE-2024-28890 | Medium | 5.3 | 2024-04-23 | Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may… |
CVE-2024-21511 | Critical | 9.8 | 2024-04-23 | Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFo… |
CVE-2024-2760 | Medium | 5.5 | 2024-04-23 | Bkav Home v7816, build 2403161130 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x222240 IOCTL code of the BkavSDFlt.sys driver. |
CVE-2024-1241 | Medium | 5.5 | 2024-04-23 | Watchdog Antivirus v1.6.415 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002014 IOCTL code of the wsdk-driver.sys driver. |
CVE-2024-3293 | High | 8.8 | 2024-04-23 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to blind SQL Injection via the rtmedia_gallery shortcode in all versions u… |
CVE-2024-3177 | Low | 2.7 | 2024-04-22 | A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAcco… |
CVE-2024-32657 | Medium | 4.6 | 2024-04-22 | Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticate… |
CVE-2024-32656 | High | 7.8 | 2024-04-22 | Ant Media Server is live streaming engine software. A local privilege escalation vulnerability in present in versions 2.6.0 through 2.8.2 allows any unprivileg… |
CVE-2024-32653 | Medium | 6.1 | 2024-04-22 | jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary co… |
CVE-2024-32480 | High | 7.2 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The `order` parameter is… |
CVE-2024-32479 | High | 7.1 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the `Service` template n… |
CVE-2024-32461 | High | 7.1 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in LibreNMS prior to… |
CVE-2024-32460 | High | 8.1 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRD… |
CVE-2024-32459 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are v… |
CVE-2024-31036 | Medium | 6.8 | 2024-04-22 | A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of service via transmission of crafted hex… |
CVE-2024-32458 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to… |
CVE-2024-32394 | High | 8.8 | 2024-04-22 | An issue in ruijie.com/cn RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S_07150910 and RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S_07150910 allows a… |
CVE-2024-32041 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to… |
CVE-2024-32040 | High | 8.1 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connecti… |
CVE-2024-32039 | Critical | 9.8 | 2024-04-22 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to in… |
CVE-2024-29368 | Medium | 6.5 | 2024-04-22 | An arbitrary file upload vulnerability in the file handling module of moziloCMS v2.0 allows attackers to bypass extension restrictions via file renaming, poten… |
CVE-2024-27574 | Critical | 9.1 | 2024-04-22 | SQL Injection vulnerability in Trainme Academy version Ichin v.1.3.2 allows a remote attacker to obtain sensitive information via the informacion, idcurso, and… |
CVE-2024-4040 | Critical | 9.8 | 2024-04-22 | A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to… |
CVE-2024-32405 | Low | 2.6 | 2024-04-22 | Cross Site Scripting vulnerability in inducer relate before v.2024.1 allows a remote attacker to escalate privileges via a crafted payload to the Answer field… |
CVE-2024-32399 | High | 7.6 | 2024-04-22 | Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via the /webeditor/ co… |
CVE-2024-32238 | Critical | 9.8 | 2024-04-22 | H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accessed via the management system page login… |
CVE-2024-32407 | High | 8.8 | 2024-04-22 | An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature. |
CVE-2024-31545 | Critical | 9.4 | 2024-04-22 | Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manage_user&id=6. |
CVE-2024-29376 | Medium | 6.4 | 2024-04-22 | Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. |
CVE-2024-31666 | Critical | 9.8 | 2024-04-22 | An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit_addon_post.php component. |
CVE-2024-28436 | Medium | 6.1 | 2024-04-22 | Cross Site Scripting vulnerability in D-Link DAP products DAP-2230, DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2590, DAP-2690, DAP-2695, DAP-3520, DAP-3662 al… |
CVE-2024-28699 | High | 7.8 | 2024-04-22 | A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev func… |
CVE-2024-3645 | Medium | 6.4 | 2024-04-22 | The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Counter widget in all versions up to… |
CVE-2024-32368 | High | 7.3 | 2024-04-22 | Insecure Permission vulnerability in Agasta Sanketlife 2.0 Pocket 12-Lead ECG Monitor FW Version 3.0 allows a local attacker to cause a denial of service via t… |
CVE-2024-27349 | Critical | 9.1 | 2024-04-22 | Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are reco… |
CVE-2024-27348 | Critical | 9.8 | 2024-04-22 | RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Us… |
CVE-2024-27347 | Medium | 5.3 | 2024-04-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0. Users are rec… |
CVE-2024-4026 | Medium | 4.6 | 2024-04-22 | Cross-Site Scripting (XSS) vulnerability in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within all editabl… |
CVE-2024-29661 | Critical | 9.8 | 2024-04-22 | A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload. |
CVE-2024-28717 | Medium | 4.9 | 2024-04-22 | An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component. |
CVE-2024-22856 | Medium | 5.4 | 2024-04-22 | A SQL injection vulnerability via the Save Favorite Search function in Axefinance Axe Credit Portal >= v.3.0 allows authenticated attackers to execute unintend… |
CVE-2024-22815 | Medium | 5.3 | 2024-04-22 | An issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) via crafte… |
CVE-2024-22813 | Medium | 4.4 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memory, disrupting netw… |
CVE-2024-22811 | High | 8.2 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between… |
CVE-2024-22809 | Medium | 6.5 | 2024-04-22 | Incorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder and view sensitive inf… |
CVE-2024-22808 | High | 7.5 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between… |
CVE-2024-22807 | Medium | 6.5 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to erase a critical sector of the flash memory, causing the machine to lose… |
CVE-2024-32691 | Medium | 5.3 | 2024-04-22 | Missing Authorization vulnerability in realmag777 Active Products Tables for WooCommerce.This issue affects Active Products Tables for WooCommerce: from n/a th… |
CVE-2024-32688 | Medium | 6.5 | 2024-04-22 | Missing Authorization vulnerability in Long Watch Studio MyRewards.This issue affects MyRewards: from n/a through 5.3.0. |
CVE-2024-32687 | Medium | 4.3 | 2024-04-22 | Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce.This issue affects WPC Frequently Bought Together for WooCommerc… |
CVE-2024-32684 | Medium | 5.3 | 2024-04-22 | Missing Authorization vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5. |
CVE-2024-32682 | High | 7.1 | 2024-04-22 | Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3… |
CVE-2024-32681 | Medium | 4.3 | 2024-04-22 | Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3… |
CVE-2024-32698 | Medium | 6.5 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-a… |
CVE-2024-32697 | Medium | 6.5 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso allows Stored XSS.This issue affects HelloAsso… |
CVE-2024-32696 | Medium | 6.5 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Infographic Maker – iList allows Stored XSS… |
CVE-2024-32695 | High | 7.1 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Gasi Language Switcher for Transposh allows Reflect… |
CVE-2024-32694 | High | 7.1 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF E… |
CVE-2024-32693 | High | 7.6 | 2024-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in ValvePress Automatic.This issue affects Automatic: from n/a before 3.93.0. |
CVE-2024-32690 | Medium | 5.9 | 2024-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood RSS Feed Widget allows Stored XSS.This issu… |
CVE-2024-32418 | Critical | 9.8 | 2024-04-22 | An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add_addon.php component. |
CVE-2024-30799 | Medium | 4.4 | 2024-04-22 | An issue in PX4 Autopilot v1.14 and before allows a remote attacker to execute arbitrary code and cause a denial of service via the Breach Return Point functio… |
CVE-2024-28722 | Medium | 6.3 | 2024-04-22 | Cross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the query parameter to th… |
CVE-2024-29733 | Low | 2.7 | 2024-04-21 | Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which… |
CVE-2024-29217 | Medium | 4.6 | 2024-04-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1… |
CVE-2024-4022 | Medium | 5.3 | 2024-04-21 | A vulnerability was found in Keenetic KN-1010, KN-1410, KN-1711, KN-1810 and KN-1910 up to 4.1.2.15. It has been rated as problematic. Affected by this issue i… |