2024 CVEs (page 312)
Page 312 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21003 | Low | 3.1 | 2024-04-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-21002 | Low | 2.5 | 2024-04-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-21001 | Medium | 5.4 | 2024-04-16 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). The supported version tha… |
CVE-2024-21000 | Low | 3.8 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.36 and prior… |
CVE-2024-20999 | High | 8.2 | 2024-04-16 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Zones). The supported version that is affected is 11. Easily exploitable vulnerabil… |
CVE-2024-20998 | Medium | 4.9 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0… |
CVE-2024-20997 | Critical | 9.9 | 2024-04-16 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). Supported versions… |
CVE-2024-20995 | Low | 2.4 | 2024-04-16 | Vulnerability in the Oracle Database Sharding component of Oracle Database Server. Supported versions that are affected are 19.3-19.22 and 21.3-21.13. Easily… |
CVE-2024-20994 | Medium | 5.3 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.36 and prior a… |
CVE-2024-20993 | Medium | 4.9 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20992 | Medium | 4.4 | 2024-04-16 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Content integration). The supported version that is affected is… |
CVE-2024-20991 | Medium | 5.3 | 2024-04-16 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0… |
CVE-2024-20990 | Medium | 5.3 | 2024-04-16 | Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Templates). Supported versions that are affected are 12.2.3… |
CVE-2024-20989 | High | 7.0 | 2024-04-16 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony POS). Supported versions that are affec… |
CVE-2024-20954 | Low | 3.7 | 2024-04-16 | Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are af… |
CVE-2024-3660 | Critical | 9.8 | 2024-04-16 | A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the ap… |
CVE-2024-3882 | High | 8.8 | 2024-04-16 | A vulnerability was found in Tenda W30E 1.0.1.25(633). It has been classified as critical. Affected is the function fromRouteStatic of the file /goform/fromRou… |
CVE-2024-3881 | High | 8.8 | 2024-04-16 | A vulnerability was found in Tenda W30E 1.0.1.25(633) and classified as critical. This issue affects the function frmL7PlotForm of the file /goform/frmL7ProtFo… |
CVE-2024-31446 | High | 7.7 | 2024-04-16 | OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. A user can use OpenComputers to get a Computer thread stuck in the Lu… |
CVE-2024-30380 | Medium | 6.5 | 2024-04-16 | An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to c… |
CVE-2024-30378 | Medium | 5.5 | 2024-04-16 | A Use After Free vulnerability in command processing of Juniper Networks Junos OS on MX Series allows a local, authenticated attacker to cause the broadband ed… |
CVE-2024-3880 | Medium | 6.3 | 2024-04-16 | A vulnerability has been found in Tenda W30E 1.0.1.25(633) and classified as critical. This vulnerability affects the function formWriteFacMac of the file /gof… |
CVE-2024-3879 | High | 8.8 | 2024-04-16 | A vulnerability, which was classified as critical, was found in Tenda W30E 1.0.1.25(633). This affects the function formSetCfm of the file /goform/setcfm. The… |
CVE-2024-3878 | High | 8.8 | 2024-04-16 | A vulnerability, which was classified as critical, has been found in Tenda F1202 1.2.0.20(408). Affected by this issue is the function fromwebExcptypemanFilter… |
CVE-2024-3877 | High | 8.8 | 2024-04-16 | A vulnerability classified as critical was found in Tenda F1202 1.2.0.20(408). Affected by this vulnerability is the function fromqossetting of the file /gofor… |
CVE-2024-32455 | Medium | 4.3 | 2024-04-16 | Missing Authorization vulnerability in Very Good Plugins Fatal Error Notify.This issue affects Fatal Error Notify: from n/a through 1.5.2. |
CVE-2024-25911 | High | 8.6 | 2024-04-16 | Missing Authorization vulnerability in Skymoon Labs MoveTo.This issue affects MoveTo: from n/a through 6.2. |
CVE-2024-3876 | High | 8.8 | 2024-04-16 | A vulnerability classified as critical has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromVirtualSer of the file /goform/VirtualSer. The… |
CVE-2024-3875 | High | 8.8 | 2024-04-16 | A vulnerability was found in Tenda F1202 1.2.0.20(408). It has been rated as critical. This issue affects the function fromNatlimit of the file /goform/Natlimi… |
CVE-2024-32256 | High | 8.1 | 2024-04-16 | Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. When updating a cur… |
CVE-2024-32254 | High | 8.8 | 2024-04-16 | Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via tms/admin/create-package.php. When creating a ne… |
CVE-2024-32086 | High | 7.5 | 2024-04-16 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AitThemes Citadela Listing.This issue affects Citadela Listing: from n/a through 5… |
CVE-2024-3874 | High | 8.8 | 2024-04-16 | A vulnerability was found in Tenda W20E 15.11.0.6. It has been declared as critical. This vulnerability affects the function formSetRemoteWebManage of the file… |
CVE-2024-3873 | Medium | 4.3 | 2024-04-16 | A vulnerability was found in SMI SMI-EX-5414W up to 1.0.03. It has been classified as problematic. This affects an unknown part of the component Web Interface… |
CVE-2024-3865 | High | 8.1 | 2024-04-16 | Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2024-3864 | High | 8.1 | 2024-04-16 | Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory corruption and we presume that with enou… |
CVE-2024-3863 | Critical | 9.8 | 2024-04-16 | The executable file warning was not presented when downloading .xrm-ms files. *Note: This issue only affected Windows operating systems. Other operating syst… |
CVE-2024-3862 | Medium | 5.3 | 2024-04-16 | The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment. This vulnerability af… |
CVE-2024-3861 | Medium | 4.0 | 2024-04-16 | If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free. This vulnerability… |
CVE-2024-3860 | Medium | 6.2 | 2024-04-16 | An out-of-memory condition during object initialization could result in an empty shape list. If the JIT subsequently traced the object it would crash. This vul… |
CVE-2024-3859 | Medium | 5.9 | 2024-04-16 | On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenType font. This vulner… |
CVE-2024-3858 | High | 7.5 | 2024-04-16 | It was possible to mutate a JavaScript object so that the JIT could crash while tracing it. This vulnerability affects Firefox < 125. |
CVE-2024-3857 | High | 7.8 | 2024-04-16 | The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garbage collection. This vulnerability affec… |
CVE-2024-3856 | High | 8.8 | 2024-04-16 | A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vulnerability affects Firefox < 125. |
CVE-2024-3855 | Medium | 6.5 | 2024-04-16 | In certain cases the JIT incorrectly optimized MSubstr operations, which led to out-of-bounds reads. This vulnerability affects Firefox < 125. |
CVE-2024-3854 | High | 8.8 | 2024-04-16 | In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This vulnerability affects Firefox < 125, Fi… |
CVE-2024-3853 | High | 7.5 | 2024-04-16 | A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection started. This vulnerability affects Firef… |
CVE-2024-3852 | High | 7.5 | 2024-04-16 | GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, a… |
CVE-2024-3302 | Low | 3.7 | 2024-04-16 | There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the b… |
CVE-2024-32027 | Critical | 9.1 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss v22.6.1 is vulnerable to command injection in `finetune_gui.py` This vulnerability is fixed i… |
CVE-2024-32026 | Critical | 9.1 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `git_caption_gui.py`. This vulnerability is fixed in… |
CVE-2024-32025 | Critical | 9.1 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a command injection in `group_images_gui.py`. This vulnerability is fixed in… |
CVE-2024-32024 | Medium | 6.5 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a path injection in the `common_gui.py` `add_pre_postfix` function. This vul… |
CVE-2024-32023 | Medium | 6.5 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to a path injection in the `common_gui.py` `find_and_replace` function. This vu… |
CVE-2024-32022 | Critical | 9.1 | 2024-04-16 | Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to command injection in basic_caption_gui.py. This vulnerability is fixed in 2… |
CVE-2024-31451 | Medium | 5.3 | 2024-04-16 | DocsGPT is a GPT-powered chat for documentation. DocsGPT is vulnerable to unauthenticated limited file write in routes.py. This vulnerability is fixed in 0.8.1. |
CVE-2024-30256 | Medium | 6.4 | 2024-04-16 | Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.1… |
CVE-2024-3869 | Medium | 4.3 | 2024-04-16 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'woocommerce_js… |
CVE-2024-3672 | Medium | 6.4 | 2024-04-16 | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versions up to, and incl… |
CVE-2024-3243 | Medium | 4.3 | 2024-04-16 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the send_test_email(… |
CVE-2024-3067 | High | 7.2 | 2024-04-16 | The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 2.4.2 due… |
CVE-2024-3367 | Medium | 6.5 | 2024-04-16 | Argument injection in websphere_mq agent plugin in Checkmk 2.0.0, 2.1.0, <2.2.0p26 and <2.3.0b5 allows local attacker to inject one argument to runmqsc |
CVE-2024-3867 | Medium | 6.1 | 2024-04-16 | The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapin… |
CVE-2024-1357 | Medium | 6.4 | 2024-04-16 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_timeline shortcode in… |
CVE-2024-3872 | Low | 3.1 | 2024-04-16 | Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain deeplinks, which allows an unauthenticat… |
CVE-2024-3871 | Critical | 9.8 | 2024-04-16 | The Delta Electronics DVW-W02W2-E2 devices expose a web administration interface to users. This interface implements multiple features that are affected by com… |
CVE-2024-32634 | Medium | 6.1 | 2024-04-16 | In huge memory get unmapped area check, code can never be reached because of a logical contradiction. |
CVE-2024-32633 | Medium | 4.0 | 2024-04-16 | An unsigned value can never be negative, so eMMC full disk test will always evaluate the same way. |
CVE-2024-32632 | Medium | 6.6 | 2024-04-16 | A value in ATCMD will be misinterpreted by printf, causing incorrect output and possibly out-of-bounds memory access |
CVE-2024-32631 | High | 7.2 | 2024-04-16 | Out-of-Bounds read in ciCCIOTOPT in ASR180X will cause incorrect computations. |
CVE-2024-32625 | Medium | 5.8 | 2024-04-16 | In OffloadAMRWriter, a scalar field is not initialized so will contain an arbitrary value left over from earlier computations |
CVE-2024-32557 | Medium | 6.5 | 2024-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons Exclusive Addons Elementor allows Stored… |
CVE-2024-22262 | High | 8.1 | 2024-04-16 | Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of th… |
CVE-2024-31784 | Medium | 6.1 | 2024-04-16 | An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src com… |
CVE-2024-31783 | Medium | 6.1 | 2024-04-16 | Cross Site Scripting (XSS) vulnerability in Typora v.1.6.7 and before, allows a local attacker to obtain sensitive information via a crafted script during mark… |
CVE-2024-31634 | Medium | 6.1 | 2024-04-16 | Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in… |
CVE-2024-3575 | Medium | 6.1 | 2024-04-16 | Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb |
CVE-2024-3574 | High | 7.5 | 2024-04-16 | In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party… |
CVE-2024-3573 | Critical | 9.3 | 2024-04-16 | mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the… |
CVE-2024-3572 | High | 7.5 | 2024-04-16 | The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without pro… |
CVE-2024-3571 | High | 8.8 | 2024-04-16 | langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileSt… |
CVE-2024-3271 | Critical | 9.8 | 2024-04-16 | A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended… |
CVE-2024-3029 | High | 8.0 | 2024-04-16 | In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoin… |
CVE-2024-3028 | High | 7.2 | 2024-04-16 | mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the… |
CVE-2024-30567 | Medium | 6.3 | 2024-04-16 | An issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to execute arbitrary code via the Network Troubleshooting functionali… |
CVE-2024-2912 | Critical | 10.0 | 2024-04-16 | An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By… |
CVE-2024-2260 | Medium | 4.2 | 2024-04-16 | A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This… |
CVE-2024-2083 | Critical | 9.9 | 2024-04-16 | A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnera… |
CVE-2024-1961 | High | 8.8 | 2024-04-16 | vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its file upload functionality. Attackers c… |
CVE-2024-1739 | Critical | 9.1 | 2024-04-16 | lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fai… |
CVE-2024-1738 | High | 7.5 | 2024-04-16 | An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.get route in the evaluations API endpoi… |
CVE-2024-1666 | Medium | 5.3 | 2024-04-16 | In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side c… |
CVE-2024-1646 | High | 8.2 | 2024-04-16 | parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parame… |
CVE-2024-1626 | High | 8.1 | 2024-04-16 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, within the project update endpoint. The vuln… |
CVE-2024-1601 | Critical | 9.8 | 2024-04-16 | An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discus… |
CVE-2024-1594 | High | 7.5 | 2024-04-16 | A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact_location` parameter when creating an e… |
CVE-2024-1593 | High | 7.5 | 2024-04-16 | A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smuggling path traversal sequences using t… |
CVE-2024-1569 | High | 7.5 | 2024-04-16 | parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_c… |
CVE-2024-1561 | High | 7.5 | 2024-04-16 | An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with… |
CVE-2024-1560 | High | 8.1 | 2024-04-16 | A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path valid… |