2024 CVEs (page 308)
Page 308 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-32338 | Medium | 5.4 | 2024-04-17 | A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted… |
CVE-2024-32337 | Medium | 6.1 | 2024-04-17 | A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted… |
CVE-2024-3817 | Critical | 9.8 | 2024-04-17 | HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-g… |
CVE-2024-29951 | Medium | 5.7 | 2024-04-17 | Brocade SANnav before v2.3.1 and v2.3.0a uses the SHA-1 hash in internal SSH ports that are not open to remote connection. |
CVE-2024-21990 | Medium | 5.4 | 2024-04-17 | ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deplo… |
CVE-2024-21989 | High | 8.1 | 2024-04-17 | ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x are susceptible to a vulnerability which when successfully exploited coul… |
CVE-2024-0257 | Low | 3.3 | 2024-04-17 | RoboDK v5.5.4 is vulnerable to heap-based buffer overflow while processing a specific project file. The resulting memory corruption may crash the applicatio… |
CVE-2024-3900 | Low | 2.9 | 2024-04-17 | Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by long Unicode sequence in ActualText. |
CVE-2024-3323 | High | 8.3 | 2024-04-17 | Cross Site Scripting in UI Request/Response Validation in TIBCO JasperReports Server 8.0.4 and 8.2.0 allows allows for the injection of malicious executabl… |
CVE-2024-32163 | Medium | 6.4 | 2024-04-17 | CMSeasy 7.7.7.9 is vulnerable to code execution. |
CVE-2024-32162 | Medium | 4.3 | 2024-04-17 | CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion. |
CVE-2024-31585 | Medium | 5.3 | 2024-04-17 | FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers… |
CVE-2024-31583 | High | 7.8 | 2024-04-17 | Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp. |
CVE-2024-31582 | High | 7.8 | 2024-04-17 | FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vul… |
CVE-2024-31581 | Critical | 9.8 | 2024-04-17 | FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c. This vulnerability… |
CVE-2024-31580 | Medium | 4.0 | 2024-04-17 | PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows… |
CVE-2024-31041 | High | 7.5 | 2024-04-17 | Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to cause a denial of service. |
CVE-2024-31040 | Low | 2.7 | 2024-04-17 | Buffer Overflow vulnerability in the get_var_integer function in mqtt_parser.c in NanoMQ 0.21.7 allows remote attackers to cause a denial of service via a seri… |
CVE-2024-31031 | High | 7.5 | 2024-04-17 | An issue in `coap_pdu.c` in libcoap 4.3.4 allows attackers to cause undefined behavior via a sequence of messages leading to unsigned integer overflow. |
CVE-2024-30990 | Critical | 9.8 | 2024-04-17 | SQL Injection vulnerability in the "Invoices" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute arbitrary SQL comman… |
CVE-2024-30989 | Medium | 5.4 | 2024-04-17 | Cross Site Scripting vulnerability in /edit-client-details.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to execute arbitra… |
CVE-2024-30953 | Medium | 6.1 | 2024-04-17 | A stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2024-30950 | Low | 3.5 | 2024-04-17 | A stored cross-site scripting (XSS) vulnerability in FUDforum v3.1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected i… |
CVE-2024-29950 | High | 7.5 | 2024-04-17 | The class FileTransfer implemented in Brocade SANnav before v2.3.1, v2.3.0a, uses the ssh-rsa signature scheme, which has a SHA-1 hash. The vulnerability could… |
CVE-2024-3914 | Medium | 6.5 | 2024-04-17 | Use after free in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-32161 | Critical | 9.8 | 2024-04-17 | jizhiCMS 2.5 suffers from a File upload vulnerability. |
CVE-2024-30988 | Medium | 6.8 | 2024-04-17 | Cross Site Scripting vulnerability in /search-invoices.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to execute arbitrary c… |
CVE-2024-30987 | Medium | 6.8 | 2024-04-17 | Cross Site Scripting vulnerability in /bwdates-reports-ds.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to execute arbitrar… |
CVE-2024-30986 | Medium | 6.5 | 2024-04-17 | Cross Site Scripting vulnerability in /edit-services-details.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to execute arbit… |
CVE-2024-30985 | Critical | 9.8 | 2024-04-17 | SQL Injection vulnerability in "B/W Dates Reports" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute arbitrary SQL c… |
CVE-2024-30982 | Critical | 9.8 | 2024-04-17 | SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands via the upid parame… |
CVE-2024-30951 | Medium | 6.1 | 2024-04-17 | FUDforum v3.1.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the chpos parameter at /adm/admsmiley.php. |
CVE-2024-2961 | High | 7.3 | 2024-04-17 | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the I… |
CVE-2024-30983 | High | 7.3 | 2024-04-17 | SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands via the compname pa… |
CVE-2024-30981 | Critical | 9.8 | 2024-04-17 | SQL Injection vulnerability in /edit-computer-detail.php in phpgurukul Cyber Cafe Management System Using PHP & MySQL v1.0 allows attackers to run arbitrary SQ… |
CVE-2024-30980 | Critical | 9.8 | 2024-04-17 | SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands via the Computer Lo… |
CVE-2024-28073 | High | 8.4 | 2024-04-17 | SolarWinds Serv-U was found to be susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability requires a highly privileged account to be… |
CVE-2024-32463 | High | 7.1 | 2024-04-17 | phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploit… |
CVE-2024-32320 | Medium | 5.9 | 2024-04-17 | Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability via the timeZone parameter in the formSetTimeZone function. |
CVE-2024-32318 | Critical | 9.8 | 2024-04-17 | Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability via the vlan parameter in the formSetVlanInfo function. |
CVE-2024-32317 | High | 7.5 | 2024-04-17 | Tenda AC10 v4.0 V16.03.10.13 and V16.03.10.20 firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterSetting function. |
CVE-2024-32316 | Medium | 6.5 | 2024-04-17 | Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability in the fromDhcpListClient function. |
CVE-2024-32314 | Low | 3.8 | 2024-04-17 | Tenda AC500 V2.0.1.9(1307) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter. |
CVE-2024-32305 | High | 8.8 | 2024-04-17 | Tenda A18 v15.03.05.05 firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function. |
CVE-2024-32303 | High | 8.0 | 2024-04-17 | Tenda AC15 v15.03.20_multi, v15.03.05.19, and v15.03.05.18 firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle fu… |
CVE-2024-31463 | Medium | 4.7 | 2024-04-17 | Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3. When the reverse proxy mode is enabled by the `IRONIC_REVERSE_PROXY_SETUP` va… |
CVE-2024-30979 | Medium | 5.9 | 2024-04-17 | Cross Site Scripting vulnerability in Cyber Cafe Management System 1.0 allows a remote attacker to execute arbitrary code via the compname parameter in edit-co… |
CVE-2024-26920 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: tracing/trigger: Fix to return error if failed to alloc snapshot Fix register_snapshot_tr… |
CVE-2024-26919 | High | 7.8 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: Fix debugfs directory leak The ULPI per-device debugfs root is named after the… |
CVE-2024-26918 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: PCI: Fix active state requirement in PME polling The commit noted in fixes added a bogus… |
CVE-2024-26917 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" This reverts commit… |
CVE-2024-26916 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amd: flush any delayed gfxoff on suspend entry" commit ab4750332dbe ("drm/amd… |
CVE-2024-26915 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reset IH OVERFLOW_CLEAR bit Allows us to detect subsequent IH ring buffer ove… |
CVE-2024-26914 | High | 7.8 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix incorrect mpc_combine array size [why] MAX_SURFACES is per stream, w… |
CVE-2024-26913 | High | 7.8 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue [why] odm calculation is missi… |
CVE-2024-26912 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix several DMA buffer leaks Nouveau manages GSP-RM DMA buffers with nvkm_gs… |
CVE-2024-26911 | High | 7.8 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: drm/buddy: Fix alloc_range() error handling code Few users have observed display corrupti… |
CVE-2024-26910 | Medium | 4.7 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix performance regression in swap operation The patch "netfilter: ipse… |
CVE-2024-3825 | Medium | 4.3 | 2024-04-17 | Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration |
CVE-2024-30253 | High | 7.5 | 2024-04-17 | @solana/web3.js is the Solana JavaScript SDK. Using particular inputs with `@solana/web3.js` will result in memory exhaustion (OOM). If you have a server, clie… |
CVE-2024-29035 | Medium | 4.1 | 2024-04-17 | Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vu… |
CVE-2024-32315 | Medium | 4.7 | 2024-04-17 | Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterSetting function. |
CVE-2024-32311 | Medium | 6.5 | 2024-04-17 | Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterSetting function. |
CVE-2024-32306 | Medium | 5.7 | 2024-04-17 | Tenda AC10U v1.0 Firmware v15.03.06.49 has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function. |
CVE-2024-32302 | Medium | 6.3 | 2024-04-17 | Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function. |
CVE-2024-32299 | High | 8.8 | 2024-04-17 | Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function. |
CVE-2024-32293 | High | 8.0 | 2024-04-17 | Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromDhcpListClient function. |
CVE-2024-32292 | High | 8.8 | 2024-04-17 | Tenda W30E v1.0 V1.0.1.25(633) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter. |
CVE-2024-32291 | High | 7.5 | 2024-04-17 | Tenda W30E v1.0 firmware v1.0.1.25(633) has a stack overflow vulnerability via the page parameter in the fromNatlimit function. |
CVE-2024-32290 | Medium | 6.7 | 2024-04-17 | Tenda W30E v1.0 v1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromAddressNat function. |
CVE-2024-32288 | Medium | 6.3 | 2024-04-17 | Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromwebExcptypemanFilter function. |
CVE-2024-32287 | Medium | 6.5 | 2024-04-17 | Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the qos parameter in the fromqossetting function. |
CVE-2024-32286 | Critical | 9.8 | 2024-04-17 | Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromVirtualSer function. |
CVE-2024-32285 | High | 8.0 | 2024-04-17 | Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the password parameter in the formaddUserName function. |
CVE-2024-32283 | High | 7.3 | 2024-04-17 | Tenda FH1203 V2.0.1.6 firmware has a command injection vulnerablility in formexeCommand function via the cmdinput parameter. |
CVE-2024-32282 | Medium | 6.3 | 2024-04-17 | Tenda FH1202 v1.2.0.14(408) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter. |
CVE-2024-31578 | High | 7.5 | 2024-04-17 | FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function. |
CVE-2024-2419 | High | 7.1 | 2024-04-17 | A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead… |
CVE-2024-1249 | High | 7.4 | 2024-04-17 | A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordina… |
CVE-2024-1132 | High | 8.1 | 2024-04-17 | A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious requ… |
CVE-2024-32313 | Medium | 6.5 | 2024-04-17 | Tenda FH1205 V2.0.0.7(775) firmware has a stack overflow vulnerability located via the adslPwd parameter of the formWanParameterSetting function. |
CVE-2024-32312 | Medium | 5.7 | 2024-04-17 | Tenda F1203 V2.0.1.6 firmware has a stack overflow vulnerability located in the adslPwd parameter of the formWanParameterSetting function. |
CVE-2024-32310 | High | 8.0 | 2024-04-17 | Tenda F1203 V2.0.1.6 firmware has a stack overflow vulnerability located in the PPW parameter of the fromWizardHandle function. |
CVE-2024-32307 | High | 7.4 | 2024-04-17 | Tenda FH1205 V2.0.0.7(775) firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function. |
CVE-2024-32301 | Critical | 9.8 | 2024-04-17 | Tenda AC7V1.0 v15.03.06.44 firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function. |
CVE-2024-32281 | High | 8.8 | 2024-04-17 | Tenda AC7V1.0 v15.03.06.44 firmware contains a command injection vulnerablility in formexeCommand function via the cmdinput parameter. |
CVE-2024-30952 | Medium | 6.1 | 2024-04-17 | A stored cross-site scripting (XSS) vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecte… |
CVE-2024-3910 | High | 8.8 | 2024-04-17 | A vulnerability, which was classified as critical, has been found in Tenda AC500 2.0.1.9(1307). Affected by this issue is the function fromDhcpListClient of th… |
CVE-2024-3909 | High | 8.8 | 2024-04-17 | A vulnerability classified as critical was found in Tenda AC500 2.0.1.9(1307). Affected by this vulnerability is the function formexeCommand of the file /gofor… |
CVE-2024-3908 | Medium | 6.3 | 2024-04-17 | A vulnerability classified as critical has been found in Tenda AC500 2.0.1.9(1307). Affected is the function formWriteFacMac of the file /goform/WriteFacMac. T… |
CVE-2024-3333 | Medium | 6.4 | 2024-04-17 | The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attributes of widgets in all versions up to, a… |
CVE-2024-3907 | High | 8.8 | 2024-04-17 | A vulnerability was found in Tenda AC500 2.0.1.9(1307). It has been rated as critical. This issue affects the function formSetCfm of the file /goform/setcfm. T… |
CVE-2024-3906 | High | 8.8 | 2024-04-17 | A vulnerability was found in Tenda AC500 2.0.1.9(1307). It has been declared as critical. This vulnerability affects the function formQuickIndex of the file /g… |
CVE-2024-3905 | High | 8.8 | 2024-04-17 | A vulnerability was found in Tenda AC500 2.0.1.9(1307). It has been classified as critical. This affects the function R7WebsSecurityHandler of the file /goform… |
CVE-2024-26909 | High | 7.0 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free A recent DRM series purporti… |
CVE-2024-26907 | High | 7.8 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix fortify source warning while accessing Eth segment ------------[ cut here… |
CVE-2024-26906 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() When trying to use cop… |
CVE-2024-26903 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security During our fuzz testing of… |
CVE-2024-26902 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: perf: RISCV: Fix panic on pmu overflow handler (1 << idx) of int is not desired when sett… |
CVE-2024-26901 | Medium | 5.5 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak syzbot identified a kernel… |