2024 CVEs (page 317)
Page 317 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-3612 | Low | 3.5 | 2024-04-11 | A vulnerability was found in SourceCodester Warehouse Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown… |
CVE-2024-32001 | Low | 2.2 | 2024-04-10 | SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: `relation folder: folder | folder#pare… |
CVE-2024-29903 | Medium | 4.2 | 2024-04-10 | Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of s… |
CVE-2024-29902 | Medium | 4.2 | 2024-04-10 | Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial… |
CVE-2024-31999 | High | 7.4 | 2024-04-10 | @festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with… |
CVE-2024-31997 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, parameters of UI extensions are always interpreted as Velocity co… |
CVE-2024-31995 | Medium | 4.3 | 2024-04-10 | `@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a ch… |
CVE-2024-29504 | High | 7.6 | 2024-04-10 | Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payload to the codeview p… |
CVE-2024-31996 | Critical | 10.0 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool… |
CVE-2024-31988 | Critical | 9.6 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 13.9-rc-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, when the realtime editor is ins… |
CVE-2024-31987 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, any user who can edit any… |
CVE-2024-31986 | Critical | 9.0 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, by creating a document with a special… |
CVE-2024-31985 | Medium | 5.4 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, it is possible to schedule/trigger/un… |
CVE-2024-29460 | Medium | 6.6 | 2024-04-10 | An issue in PX4 Autopilot v.1.14.0 allows an attacker to manipulate the flight path allowing for crashes of the drone via the home point location of the missio… |
CVE-2024-26362 | High | 8.8 | 2024-04-10 | HTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML code via creation of… |
CVE-2024-1481 | Medium | 5.3 | 2024-04-10 | A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kin… |
CVE-2024-31984 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a sp… |
CVE-2024-31983 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. In multilingual wikis, translations can be edited by any user who has edit right, circumventing the rights that are… |
CVE-2024-31982 | Critical | 10.0 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search a… |
CVE-2024-31981 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, remote code execution is possible v… |
CVE-2024-31939 | Medium | 4.3 | 2024-04-10 | Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Import any XML or CSV File to WordPress.This issue affects Import any XML or CSV File to WordPress: f… |
CVE-2024-31819 | Critical | 9.8 | 2024-04-10 | An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php compon… |
CVE-2024-31465 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any… |
CVE-2024-31430 | Medium | 4.3 | 2024-04-10 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional, realmag777 BEAR – Bulk Editor and Pr… |
CVE-2024-29502 | Medium | 6.5 | 2024-04-10 | An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths. |
CVE-2024-29500 | Critical | 9.8 | 2024-04-10 | An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce applicatio… |
CVE-2024-29269 | High | 8.8 | 2024-04-10 | An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter. |
CVE-2024-3516 | Medium | 6.5 | 2024-04-10 | Heap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-3515 | Medium | 6.5 | 2024-04-10 | Use after free in Dawn in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-3157 | Critical | 9.6 | 2024-04-10 | Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU process to potentiall… |
CVE-2024-31464 | Medium | 6.8 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.19, 15.5.4, and 15.9-rc-1, it is possible to access the has… |
CVE-2024-31386 | Medium | 4.3 | 2024-04-10 | Cross-Site Request Forgery (CSRF) vulnerability in Hidekazu Ishikawa X-T9, Hidekazu Ishikawa Lightning, themeinwp Default Mag, Out the Box Namaha, Out the Box… |
CVE-2024-28345 | Medium | 5.5 | 2024-04-10 | An issue discovered in Sipwise C5 NGCP Dashboard below mr11.5.1 allows a low privileged user to access the Journal endpoint by directly visit the URL. |
CVE-2024-28344 | Low | 3.1 | 2024-04-10 | An Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open Redirect vulnerability allows attackers to control the "back" pa… |
CVE-2024-23077 | High | 7.5 | 2024-04-10 | JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java. NOTE: this is disputed by multiple t… |
CVE-2024-31944 | Medium | 4.3 | 2024-04-10 | Cross-Site Request Forgery (CSRF) vulnerability in Octolize WooCommerce UPS Shipping – Live Rates and Access Points.This issue affects WooCommerce UPS Shipping… |
CVE-2024-31943 | Medium | 4.3 | 2024-04-10 | Cross-Site Request Forgery (CSRF) vulnerability in Octolize USPS Shipping for WooCommerce – Live Rates.This issue affects USPS Shipping for WooCommerce – Live… |
CVE-2024-31461 | Critical | 9.1 | 2024-04-10 | Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an at… |
CVE-2024-31242 | Medium | 5.3 | 2024-04-10 | Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17. |
CVE-2024-31230 | Medium | 5.3 | 2024-04-10 | Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a… |
CVE-2024-31214 | Critical | 9.6 | 2024-04-10 | Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Atta… |
CVE-2024-3570 | Medium | 5.4 | 2024-04-10 | A stored Cross-Site Scripting (XSS) vulnerability exists in the chat functionality of the mintplex-labs/anything-llm repository, allowing attackers to execute… |
CVE-2024-3569 | High | 7.5 | 2024-04-10 | A Denial of Service (DoS) vulnerability exists in the mintplex-labs/anything-llm repository when the application is running in 'just me' mode with a password… |
CVE-2024-3568 | Critical | 9.6 | 2024-04-10 | The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` fu… |
CVE-2024-3388 | Medium | 4.1 | 2024-04-10 | A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send netwo… |
CVE-2024-3387 | Medium | 5.3 | 2024-04-10 | A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to ca… |
CVE-2024-3386 | Medium | 5.3 | 2024-04-10 | An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This… |
CVE-2024-3385 | High | 7.5 | 2024-04-10 | A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually c… |
CVE-2024-3384 | High | 7.5 | 2024-04-10 | A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (N… |
CVE-2024-3383 | High | 7.4 | 2024-04-10 | A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID group… |
CVE-2024-3382 | High | 7.5 | 2024-04-10 | A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually pre… |
CVE-2024-3283 | High | 7.2 | 2024-04-10 | A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their privileges to admin roles through a mass assignment issue. The… |
CVE-2024-3101 | High | 7.2 | 2024-04-10 | In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-User Mode'. By sending… |
CVE-2024-3098 | Critical | 9.8 | 2024-04-10 | A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt inject… |
CVE-2024-3025 | Critical | 9.9 | 2024-04-10 | mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. At… |
CVE-2024-31356 | High | 7.6 | 2024-04-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log.This issue affects User… |
CVE-2024-31355 | High | 8.5 | 2024-04-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow… |
CVE-2024-31343 | High | 7.5 | 2024-04-10 | Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio… |
CVE-2024-31342 | Medium | 6.5 | 2024-04-10 | Missing Authorization vulnerability in WPcloudgallery WordPress Gallery Exporter.This issue affects WordPress Gallery Exporter: from n/a through 1.3. |
CVE-2024-31299 | High | 7.1 | 2024-04-10 | Cross-Site Request Forgery (CSRF) vulnerability in Reservation Diary ReDi Restaurant Reservation allows Cross-Site Scripting (XSS).This issue affects ReDi Rest… |
CVE-2024-2952 | Critical | 9.8 | 2024-04-10 | BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` me… |
CVE-2024-2221 | Critical | 9.8 | 2024-04-10 | qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTION}/snapshots/upload` endpoint, specific… |
CVE-2024-2217 | High | 7.5 | 2024-04-10 | gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in b… |
CVE-2024-2196 | High | 8.8 | 2024-04-10 | aimhubio/aim is vulnerable to Cross-Site Request Forgery (CSRF), allowing attackers to perform actions such as deleting runs, updating data, and stealing data… |
CVE-2024-2195 | Critical | 9.8 | 2024-04-10 | A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affe… |
CVE-2024-2029 | Critical | 9.8 | 2024-04-10 | A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioToWav` function used for converting audio… |
CVE-2024-1902 | High | 7.5 | 2024-04-10 | lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerabili… |
CVE-2024-1741 | Critical | 9.1 | 2024-04-10 | lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an… |
CVE-2024-1740 | Critical | 9.1 | 2024-04-10 | In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using… |
CVE-2024-1728 | High | 7.5 | 2024-04-10 | gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attack… |
CVE-2024-1643 | Critical | 9.1 | 2024-04-10 | By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organiza… |
CVE-2024-1625 | Medium | 6.5 | 2024-04-10 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organi… |
CVE-2024-1602 | Medium | 6.1 | 2024-04-10 | parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting (XSS) that leads to Remote Code Execution (RCE). The vulnerability arises due to inadequate… |
CVE-2024-1600 | Critical | 9.3 | 2024-04-10 | A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exp… |
CVE-2024-1520 | Critical | 9.8 | 2024-04-10 | An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-s… |
CVE-2024-1511 | Critical | 9.8 | 2024-04-10 | The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allow… |
CVE-2024-3566 | Critical | 9.8 | 2024-04-10 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function whe… |
CVE-2024-31874 | Medium | 6.2 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 uses uninitialized variables when deploying that could allow a local user to cause a denial of servi… |
CVE-2024-31873 | High | 7.5 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication that could be obtai… |
CVE-2024-31872 | High | 7.5 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Open Source scrip… |
CVE-2024-31871 | High | 7.5 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Python scripts du… |
CVE-2024-31358 | High | 7.5 | 2024-04-10 | Missing Authorization vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a… |
CVE-2024-31353 | Medium | 5.3 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8. |
CVE-2024-31302 | Medium | 5.3 | 2024-04-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a throu… |
CVE-2024-31298 | Medium | 5.3 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0. |
CVE-2024-31297 | High | 7.5 | 2024-04-10 | Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0. |
CVE-2024-31287 | Medium | 6.5 | 2024-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Libr… |
CVE-2024-31282 | Medium | 4.7 | 2024-04-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Appcheap.Io App Builder.This issue affects App Builder: from n/a through 3.8.7. |
CVE-2024-31278 | Medium | 4.3 | 2024-04-10 | Insertion of Sensitive Information Into Sent Data vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium… |
CVE-2024-31259 | High | 7.5 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in Searchiq SearchIQ.This issue affects SearchIQ: from n/a through 4.5. |
CVE-2024-31254 | Low | 3.7 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from… |
CVE-2024-31253 | Medium | 4.7 | 2024-04-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP OAuth Server OAuth Server.This issue affects OAuth Server: from n/a through 4.3.3. |
CVE-2024-31249 | Medium | 5.3 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from… |
CVE-2024-31247 | Medium | 5.3 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a th… |
CVE-2024-31245 | Medium | 5.3 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in ConvertKit.This issue affects ConvertKit: from n/a through 2.4.5. |
CVE-2024-31240 | High | 7.7 | 2024-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in InfoTheme WP Poll Maker.This issue affects WP Poll Maker: from… |
CVE-2024-23735 | Medium | 6.1 | 2024-04-10 | Cross Site Scripting (XSS) vulnerability in in the S/MIME certificate upload functionality of the User Profile pages in savignano S/Notify before 4.0.0 for Con… |
CVE-2024-23734 | Medium | 5.2 | 2024-04-10 | Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for Bitbucket allow attack… |
CVE-2024-0218 | High | 7.5 | 2024-04-10 | A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian, caused by improper input validation in certain fields used in the Radius parsing functiona… |
CVE-2024-3567 | Medium | 5.5 | 2024-04-10 | A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum… |