2024 CVEs (page 322)
Page 322 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-30190 | Medium | 6.1 | 2024-04-09 | A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-1 M12 (6GK5788-1GY0… |
CVE-2024-30189 | Medium | 6.1 | 2024-04-09 | A vulnerability has been identified in SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) (All versions), SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0) (All versions), SCAL… |
CVE-2024-26277 | Low | 3.3 | 2024-04-09 | A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207… |
CVE-2024-26276 | Low | 3.3 | 2024-04-09 | A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207… |
CVE-2024-26275 | High | 7.8 | 2024-04-09 | A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207… |
CVE-2024-31366 | High | 7.1 | 2024-04-09 | Missing Authorization vulnerability in Themify Post Type Builder (PTB).This issue affects Post Type Builder (PTB): from n/a through 2.0.8. |
CVE-2024-31365 | High | 7.1 | 2024-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Post Type Builder (PTB) allows Reflected XSS.This… |
CVE-2024-1233 | High | 7.3 | 2024-04-09 | A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting… |
CVE-2024-1664 | Medium | 6.1 | 2024-04-09 | The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-30218 | Medium | 6.5 | 2024-04-09 | The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashi… |
CVE-2024-30217 | Medium | 4.3 | 2024-04-09 | Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting… |
CVE-2024-30216 | Medium | 4.3 | 2024-04-09 | Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting… |
CVE-2024-30215 | Medium | 4.8 | 2024-04-09 | The Resource Settings page allows a high privilege attacker to load exploitable payload to be stored and reflected whenever a User visits the page. In a succes… |
CVE-2024-30214 | Medium | 4.8 | 2024-04-09 | The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response… |
CVE-2024-2975 | High | 8.8 | 2024-04-09 | A race condition was identified through which privilege escalation was possible in certain configurations. |
CVE-2024-28167 | Medium | 6.5 | 2024-04-09 | SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On succes… |
CVE-2024-27983 | High | 8.2 | 2024-04-09 | An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is… |
CVE-2024-27901 | High | 7.2 | 2024-04-09 | SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to… |
CVE-2024-27899 | High | 8.8 | 2024-04-09 | Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of t… |
CVE-2024-27898 | Medium | 5.3 | 2024-04-09 | SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting inter… |
CVE-2024-25646 | High | 7.7 | 2024-04-09 | Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using c… |
CVE-2024-31047 | Low | 3.3 | 2024-04-08 | An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmu… |
CVE-2024-23584 | Medium | 6.6 | 2024-04-08 | The NMAP Importer service may expose data store credentials to authorized users of the Windows Registry. |
CVE-2024-23084 | High | 7.5 | 2024-04-08 | Apfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(double[], double[]). NOTE… |
CVE-2024-23081 | Low | 3.3 | 2024-04-08 | ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate). NOTE: this i… |
CVE-2024-23079 | Medium | 6.2 | 2024-04-08 | JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compare(Double, Double)… |
CVE-2024-22949 | Critical | 9.1 | 2024-04-08 | JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /chart/annotations/CategoryLineAnnotation. NOTE: this is disputed by multi… |
CVE-2024-27632 | High | 8.8 | 2024-04-08 | An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function. |
CVE-2024-0083 | Medium | 6.5 | 2024-04-08 | NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause a cross-site scripting error by network by running malicious scripts… |
CVE-2024-0082 | High | 8.2 | 2024-04-08 | NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause improper privilege management by sending open file requests to the a… |
CVE-2024-3466 | Medium | 5.5 | 2024-04-08 | A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. Affected by this vulnerability is the function lap… |
CVE-2024-3465 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been classified as critical. Affected is the function laporan_filter of the f… |
CVE-2024-27631 | Medium | 6.0 | 2024-04-08 | Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php |
CVE-2024-27630 | High | 7.5 | 2024-04-08 | Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_da… |
CVE-2024-3464 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in SourceCodester Laundry Management System 1.0 and classified as critical. This issue affects the function laporan_filter of the fil… |
CVE-2024-3463 | Low | 3.5 | 2024-04-08 | A vulnerability has been found in SourceCodester Laundry Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the fi… |
CVE-2024-24279 | High | 8.8 | 2024-04-08 | An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated privileges via vsVe… |
CVE-2024-23086 | Critical | 9.8 | 2024-04-08 | Apfloat v1.10.1 was discovered to contain a stack overflow via the component org.apfloat.internal.DoubleModMath::modPow(double. NOTE: this is disputed by multi… |
CVE-2024-23085 | High | 7.5 | 2024-04-08 | Apfloat v1.10.1 was discovered to contain a NullPointerException via the component org.apfloat.internal.DoubleScramble::scramble(double[], int, int[]). NOTE: t… |
CVE-2024-23078 | Critical | 9.1 | 2024-04-08 | JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compare(Double, Double)… |
CVE-2024-28270 | High | 8.1 | 2024-04-08 | An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword. |
CVE-2024-28224 | Medium | 6.6 | 2024-04-08 | Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat wi… |
CVE-2024-3458 | Medium | 6.3 | 2024-04-08 | A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /adm… |
CVE-2024-3457 | Medium | 6.3 | 2024-04-08 | A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/con… |
CVE-2024-23082 | | 2024-04-08 | ThreeTen Backport v1.6.8 was discovered to contain an integer overflow via the component org.threeten.bp.format.DateTimeFormatter::parse(CharSequence, ParsePos… | |
CVE-2024-3456 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functiona… |
CVE-2024-3455 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2024-3445 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-31447 | Medium | 5.3 | 2024-04-08 | Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authe… |
CVE-2024-31442 | High | 8.8 | 2024-04-08 | Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, includin… |
CVE-2024-31224 | Critical | 9.8 | 2024-04-08 | GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deseri… |
CVE-2024-3444 | Medium | 4.7 | 2024-04-08 | A vulnerability was found in Wangshen SecGate 3600 up to 20240408. It has been classified as critical. This affects an unknown part of the file /?g=net_pro_key… |
CVE-2024-3443 | Low | 3.5 | 2024-04-08 | A vulnerability classified as problematic was found in SourceCodester Prison Management System 1.0. This vulnerability affects unknown code of the file /Employ… |
CVE-2024-3442 | Medium | 6.3 | 2024-04-08 | A vulnerability classified as critical has been found in SourceCodester Prison Management System 1.0. This affects an unknown part of the file /Employee/delete… |
CVE-2024-31221 | Medium | 5.9 | 2024-04-08 | Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI int… |
CVE-2024-31205 | Medium | 4.2 | 2024-04-08 | Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may by… |
CVE-2024-30269 | Medium | 5.3 | 2024-04-08 | DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting… |
CVE-2024-3441 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality o… |
CVE-2024-3440 | Medium | 4.7 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-2511 | Medium | 5.9 | 2024-04-08 | Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may e… |
CVE-2024-28732 | High | 7.5 | 2024-04-08 | An issue was discovered in OFPMatch in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite loop). |
CVE-2024-31817 | High | 7.5 | 2024-04-08 | In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg. |
CVE-2024-31816 | High | 7.5 | 2024-04-08 | In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getEasyWizardCfg. |
CVE-2024-31815 | Critical | 9.1 | 2024-04-08 | In TOTOLINK EX200 V4.0.3c.7314_B20191204, an attacker can obtain the configuration file without authorization through /cgi-bin/ExportSettings.sh |
CVE-2024-31814 | High | 8.8 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function. |
CVE-2024-31813 | High | 8.4 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 does not contain an authentication mechanism by default. |
CVE-2024-31812 | Medium | 6.5 | 2024-04-08 | In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig. |
CVE-2024-31811 | High | 8.0 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the langType parameter in the setLanguageCfg fu… |
CVE-2024-31809 | High | 8.8 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW func… |
CVE-2024-31808 | High | 8.8 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in the setWebWlanIdx f… |
CVE-2024-31807 | Critical | 9.8 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in the NTPSyncWithHost f… |
CVE-2024-31806 | Medium | 6.5 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which can reboot the syste… |
CVE-2024-31805 | Medium | 6.5 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in the setTelnetCfg f… |
CVE-2024-2834 | High | 8.7 | 2024-04-08 | A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be… |
CVE-2024-28066 | High | 8.8 | 2024-04-08 | In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password). |
CVE-2024-3439 | High | 7.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /Acco… |
CVE-2024-26574 | High | 7.8 | 2024-04-08 | Insecure Permissions vulnerability in Wondershare Filmora v.13.0.51 allows a local attacker to execute arbitrary code via a crafted script to the WSNativePushS… |
CVE-2024-3438 | High | 7.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /Ad… |
CVE-2024-27897 | High | 7.5 | 2024-04-08 | Input verification vulnerability in the call module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-27896 | High | 7.5 | 2024-04-08 | Input verification vulnerability in the log module. Impact: Successful exploitation of this vulnerability can affect integrity. |
CVE-2024-27895 | High | 7.5 | 2024-04-08 | Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2024-26811 | Critical | 9.8 | 2024-04-08 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate payload size in ipc response If installing malicious ksmbd-tools, ksmbd.m… |
CVE-2024-31375 | Medium | 5.4 | 2024-04-08 | Missing Authorization vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads.This issue affects WP2LEADS: from n/a through <= 3.2.7. |
CVE-2024-31357 | Medium | 6.5 | 2024-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Store… |
CVE-2024-23192 | Medium | 6.1 | 2024-04-08 | RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or succes… |
CVE-2024-23191 | Medium | 5.4 | 2024-04-08 | Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attack… |
CVE-2024-23190 | Medium | 5.4 | 2024-04-08 | Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would… |
CVE-2024-23189 | Medium | 5.4 | 2024-04-08 | Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker… |
CVE-2024-31022 | Critical | 9.8 | 2024-04-08 | An issue was discovered in CandyCMS version 1.0.0, allows remote attackers to execute arbitrary code via the install.php component. |
CVE-2024-27488 | Critical | 9.8 | 2024-04-08 | Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information… |
CVE-2024-1958 | Medium | 4.8 | 2024-04-08 | The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-1956 | Medium | 6.1 | 2024-04-08 | The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated reque… |
CVE-2024-1752 | Medium | 6.1 | 2024-04-08 | The Font Farsi WordPress plugin through 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-1589 | Medium | 6.1 | 2024-04-08 | The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-1588 | Medium | 6.8 | 2024-04-08 | The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-1292 | Medium | 4.7 | 2024-04-08 | The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cros… |
CVE-2024-23658 | Medium | 4.4 | 2024-04-08 | In camera driver, there is a possible use after free due to a logic error. This could lead to local denial of service with System execution privileges needed |
CVE-2024-28744 | High | 8.8 | 2024-04-08 | The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthentica… |
CVE-2024-3437 | High | 7.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2024-3436 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |