2024 CVEs (page 322)
Page 322 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20669 | Medium | 6.7 | 2024-04-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-20665 | Medium | 6.1 | 2024-04-09 | BitLocker Security Feature Bypass Vulnerability |
CVE-2024-3281 | High | 8.8 | 2024-04-09 | A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not pro… |
CVE-2024-31868 | Medium | 6.1 | 2024-04-09 | Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to normal users. This… |
CVE-2024-31866 | Critical | 9.8 | 2024-04-09 | Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuratio… |
CVE-2024-31865 | Medium | 6.5 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook… |
CVE-2024-31864 | Critical | 9.8 | 2024-04-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code… |
CVE-2024-28235 | High | 8.3 | 2024-04-09 | Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protec… |
CVE-2024-31487 | Medium | 5.9 | 2024-04-09 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1… |
CVE-2024-23671 | High | 8.1 | 2024-04-09 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1… |
CVE-2024-23662 | Medium | 5.3 | 2024-04-09 | An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0… |
CVE-2024-21756 | High | 8.8 | 2024-04-09 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiS… |
CVE-2024-21755 | High | 8.8 | 2024-04-09 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiS… |
CVE-2024-28234 | Medium | 4.3 | 2024-04-09 | Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via… |
CVE-2024-28191 | Low | 3.1 | 2024-04-09 | Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in f… |
CVE-2024-28190 | Medium | 5.4 | 2024-04-09 | Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filena… |
CVE-2024-31544 | Medium | 5.4 | 2024-04-09 | A stored cross-site scripting (XSS) vulnerability in Computer Laboratory Management System v1.0 allows attackers to execute arbitrary JavaScript code by includ… |
CVE-2024-2224 | High | 8.1 | 2024-04-09 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an… |
CVE-2024-2223 | High | 8.1 | 2024-04-09 | An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigur… |
CVE-2024-31863 | Medium | 5.3 | 2024-04-09 | Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0… |
CVE-2024-3046 | High | 7.5 | 2024-04-09 | In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to re… |
CVE-2024-31862 | Medium | 5.3 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: from 0.10.1 before 0… |
CVE-2024-31978 | High | 7.6 | 2024-04-09 | A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP2). Affected devices allow authenticated users to export monitoring data. The correspon… |
CVE-2024-31860 | Medium | 6.5 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the fi… |
CVE-2024-31370 | High | 8.5 | 2024-04-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeIsAwesome AIKit aikit-wordpress-ai-writing-assistant-… |
CVE-2024-31369 | Medium | 5.4 | 2024-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2. |
CVE-2024-31368 | Medium | 6.5 | 2024-04-09 | Missing Authorization vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2. |
CVE-2024-31367 | High | 7.1 | 2024-04-09 | Missing Authorization vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2. |
CVE-2024-30191 | High | 8.4 | 2024-04-09 | A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-1 M12 (6GK5788-1GY0… |
CVE-2024-30190 | Medium | 6.1 | 2024-04-09 | A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-1 M12 (6GK5788-1GY0… |
CVE-2024-30189 | Medium | 6.1 | 2024-04-09 | A vulnerability has been identified in SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) (All versions), SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0) (All versions), SCAL… |
CVE-2024-26277 | Low | 3.3 | 2024-04-09 | A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207… |
CVE-2024-26276 | Low | 3.3 | 2024-04-09 | A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207… |
CVE-2024-26275 | High | 7.8 | 2024-04-09 | A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207… |
CVE-2024-31366 | High | 7.1 | 2024-04-09 | Missing Authorization vulnerability in Themify Post Type Builder (PTB).This issue affects Post Type Builder (PTB): from n/a through 2.0.8. |
CVE-2024-31365 | High | 7.1 | 2024-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Post Type Builder (PTB) allows Reflected XSS.This… |
CVE-2024-1233 | High | 7.3 | 2024-04-09 | A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting… |
CVE-2024-1664 | Medium | 6.1 | 2024-04-09 | The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-30218 | Medium | 6.5 | 2024-04-09 | The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashi… |
CVE-2024-30217 | Medium | 4.3 | 2024-04-09 | Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting… |
CVE-2024-30216 | Medium | 4.3 | 2024-04-09 | Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting… |
CVE-2024-30215 | Medium | 4.8 | 2024-04-09 | The Resource Settings page allows a high privilege attacker to load exploitable payload to be stored and reflected whenever a User visits the page. In a succes… |
CVE-2024-30214 | Medium | 4.8 | 2024-04-09 | The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response… |
CVE-2024-2975 | High | 8.8 | 2024-04-09 | A race condition was identified through which privilege escalation was possible in certain configurations. |
CVE-2024-28167 | Medium | 6.5 | 2024-04-09 | SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On succes… |
CVE-2024-27983 | High | 8.2 | 2024-04-09 | An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is… |
CVE-2024-27901 | High | 7.2 | 2024-04-09 | SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to… |
CVE-2024-27899 | High | 8.8 | 2024-04-09 | Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of t… |
CVE-2024-27898 | Medium | 5.3 | 2024-04-09 | SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting inter… |
CVE-2024-25646 | High | 7.7 | 2024-04-09 | Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using c… |
CVE-2024-31047 | Low | 3.3 | 2024-04-08 | An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmu… |
CVE-2024-23584 | Medium | 6.6 | 2024-04-08 | The NMAP Importer service may expose data store credentials to authorized users of the Windows Registry. |
CVE-2024-23084 | High | 7.5 | 2024-04-08 | Apfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(double[], double[]). NOTE… |
CVE-2024-23081 | Low | 3.3 | 2024-04-08 | ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate). NOTE: this i… |
CVE-2024-23079 | Medium | 6.2 | 2024-04-08 | JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compare(Double, Double)… |
CVE-2024-22949 | Critical | 9.1 | 2024-04-08 | JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /chart/annotations/CategoryLineAnnotation. NOTE: this is disputed by multi… |
CVE-2024-27632 | High | 8.8 | 2024-04-08 | An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function. |
CVE-2024-0083 | Medium | 6.5 | 2024-04-08 | NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause a cross-site scripting error by network by running malicious scripts… |
CVE-2024-0082 | High | 8.2 | 2024-04-08 | NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause improper privilege management by sending open file requests to the a… |
CVE-2024-3466 | Medium | 5.5 | 2024-04-08 | A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. Affected by this vulnerability is the function lap… |
CVE-2024-3465 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been classified as critical. Affected is the function laporan_filter of the f… |
CVE-2024-27631 | Medium | 6.0 | 2024-04-08 | Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php |
CVE-2024-27630 | High | 7.5 | 2024-04-08 | Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_da… |
CVE-2024-3464 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in SourceCodester Laundry Management System 1.0 and classified as critical. This issue affects the function laporan_filter of the fil… |
CVE-2024-3463 | Low | 3.5 | 2024-04-08 | A vulnerability has been found in SourceCodester Laundry Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the fi… |
CVE-2024-24279 | High | 8.8 | 2024-04-08 | An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated privileges via vsVe… |
CVE-2024-23086 | Critical | 9.8 | 2024-04-08 | Apfloat v1.10.1 was discovered to contain a stack overflow via the component org.apfloat.internal.DoubleModMath::modPow(double. NOTE: this is disputed by multi… |
CVE-2024-23085 | High | 7.5 | 2024-04-08 | Apfloat v1.10.1 was discovered to contain a NullPointerException via the component org.apfloat.internal.DoubleScramble::scramble(double[], int, int[]). NOTE: t… |
CVE-2024-23078 | Critical | 9.1 | 2024-04-08 | JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compare(Double, Double)… |
CVE-2024-28270 | High | 8.1 | 2024-04-08 | An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword. |
CVE-2024-28224 | Medium | 6.6 | 2024-04-08 | Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat wi… |
CVE-2024-3458 | Medium | 6.3 | 2024-04-08 | A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /adm… |
CVE-2024-3457 | Medium | 6.3 | 2024-04-08 | A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/con… |
CVE-2024-23082 | | 2024-04-08 | ThreeTen Backport v1.6.8 was discovered to contain an integer overflow via the component org.threeten.bp.format.DateTimeFormatter::parse(CharSequence, ParsePos… | |
CVE-2024-3456 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functiona… |
CVE-2024-3455 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2024-3445 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-31447 | Medium | 5.3 | 2024-04-08 | Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authe… |
CVE-2024-31442 | High | 8.8 | 2024-04-08 | Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, includin… |
CVE-2024-31224 | Critical | 9.8 | 2024-04-08 | GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deseri… |
CVE-2024-3444 | Medium | 4.7 | 2024-04-08 | A vulnerability was found in Wangshen SecGate 3600 up to 20240408. It has been classified as critical. This affects an unknown part of the file /?g=net_pro_key… |
CVE-2024-3443 | Low | 3.5 | 2024-04-08 | A vulnerability classified as problematic was found in SourceCodester Prison Management System 1.0. This vulnerability affects unknown code of the file /Employ… |
CVE-2024-3442 | Medium | 6.3 | 2024-04-08 | A vulnerability classified as critical has been found in SourceCodester Prison Management System 1.0. This affects an unknown part of the file /Employee/delete… |
CVE-2024-31221 | Medium | 5.9 | 2024-04-08 | Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI int… |
CVE-2024-31205 | Medium | 4.2 | 2024-04-08 | Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may by… |
CVE-2024-30269 | Medium | 5.3 | 2024-04-08 | DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting… |
CVE-2024-3441 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality o… |
CVE-2024-3440 | Medium | 4.7 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-2511 | Medium | 5.9 | 2024-04-08 | Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may e… |
CVE-2024-28732 | High | 7.5 | 2024-04-08 | An issue was discovered in OFPMatch in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite loop). |
CVE-2024-31817 | High | 7.5 | 2024-04-08 | In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg. |
CVE-2024-31816 | High | 7.5 | 2024-04-08 | In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getEasyWizardCfg. |
CVE-2024-31815 | Critical | 9.1 | 2024-04-08 | In TOTOLINK EX200 V4.0.3c.7314_B20191204, an attacker can obtain the configuration file without authorization through /cgi-bin/ExportSettings.sh |
CVE-2024-31814 | High | 8.8 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function. |
CVE-2024-31813 | High | 8.4 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 does not contain an authentication mechanism by default. |
CVE-2024-31812 | Medium | 6.5 | 2024-04-08 | In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig. |
CVE-2024-31811 | High | 8.0 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the langType parameter in the setLanguageCfg fu… |
CVE-2024-31809 | High | 8.8 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW func… |
CVE-2024-31808 | High | 8.8 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in the setWebWlanIdx f… |
CVE-2024-31807 | Critical | 9.8 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in the NTPSyncWithHost f… |