2024 CVEs (page 328)
Page 328 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2879 | Critical | 9.8 | 2024-04-03 | The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escapi… |
CVE-2024-3227 | Medium | 4.7 | 2024-04-03 | A vulnerability was found in Panwei eoffice OA up to 9.5. It has been declared as critical. This vulnerability affects unknown code of the file /general/system… |
CVE-2024-3162 | Medium | 6.4 | 2024-04-03 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all versions up to, and includ… |
CVE-2024-30166 | Critical | 9.1 | 2024-04-03 | In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read (o… |
CVE-2024-28836 | Medium | 5.4 | 2024-04-03 | An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of… |
CVE-2024-28755 | Medium | 6.5 | 2024-04-03 | An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be n… |
CVE-2024-28219 | Medium | 6.7 | 2024-04-03 | In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. |
CVE-2024-26495 | Medium | 6.1 | 2024-04-03 | Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive informa… |
CVE-2024-25864 | Critical | 9.1 | 2024-04-03 | Server Side Request Forgery (SSRF) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive… |
CVE-2024-24724 | Critical | 9.8 | 2024-04-03 | Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is pa… |
CVE-2024-1327 | Medium | 6.4 | 2024-04-03 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image box widget in all versions up to, and including… |
CVE-2024-3226 | High | 7.3 | 2024-04-03 | A vulnerability was found in Campcodes Online Patient Record Management System 1.0. It has been classified as critical. This affects an unknown part of the fil… |
CVE-2024-3225 | Medium | 6.3 | 2024-04-03 | A vulnerability was found in SourceCodester PHP Task Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2024-3224 | Medium | 6.3 | 2024-04-03 | A vulnerability has been found in SourceCodester PHP Task Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-3223 | Medium | 6.3 | 2024-04-03 | A vulnerability, which was classified as critical, was found in SourceCodester PHP Task Management System 1.0. Affected is an unknown function of the file admi… |
CVE-2024-3222 | Medium | 6.3 | 2024-04-03 | A vulnerability, which was classified as critical, has been found in SourceCodester PHP Task Management System 1.0. This issue affects some unknown processing… |
CVE-2024-3221 | Medium | 6.3 | 2024-04-03 | A vulnerability classified as critical was found in SourceCodester PHP Task Management System 1.0. This vulnerability affects unknown code of the file attendan… |
CVE-2024-3218 | Medium | 5.4 | 2024-04-03 | A vulnerability classified as critical has been found in Shibang Communications IP Network Intercom Broadcasting System 1.0. This affects an unknown part of th… |
CVE-2024-3248 | Low | 2.9 | 2024-04-02 | In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow. |
CVE-2024-3247 | Low | 2.9 | 2024-04-02 | In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack overflow. |
CVE-2024-3209 | Medium | 5.5 | 2024-04-02 | A vulnerability was found in UPX up to 4.2.2. It has been rated as critical. This issue affects the function get_ne64 of the file bele.h. The manipulation lead… |
CVE-2024-3207 | Medium | 5.5 | 2024-04-02 | A vulnerability was found in ermig1979 Simd up to 6.0.134. It has been declared as critical. This vulnerability affects the function ReadUnsigned of the file s… |
CVE-2024-3204 | High | 7.3 | 2024-04-02 | A vulnerability has been found in c-blosc2 up to 2.13.2 and classified as critical. Affected by this vulnerability is the function ndlz4_decompress of the file… |
CVE-2024-3203 | High | 7.3 | 2024-04-02 | A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2. Affected is the function ndlz8_decompress of the file /src/c-blosc2/plug… |
CVE-2024-3202 | Low | 3.7 | 2024-04-02 | A vulnerability, which was classified as problematic, has been found in codelyfe Stupid Simple CMS 1.2.4. This issue affects some unknown processing of the com… |
CVE-2024-29434 | High | 8.3 | 2024-04-02 | An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file. |
CVE-2024-30371 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30370 | Medium | 4.3 | 2024-04-02 | RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected i… |
CVE-2024-30367 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30365 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30364 | Low | 3.3 | 2024-04-02 | Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2024-30363 | Medium | 5.5 | 2024-04-02 | Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2024-30362 | High | 7.8 | 2024-04-02 | Foxit PDF Reader PDF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2024-30361 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30360 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30359 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm 3D Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af… |
CVE-2024-30358 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm User-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30357 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Annotation Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2024-30356 | Low | 3.3 | 2024-04-02 | Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information… |
CVE-2024-30355 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affe… |
CVE-2024-30354 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30353 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… |
CVE-2024-30352 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30351 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30350 | Low | 3.3 | 2024-04-02 | Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive informati… |
CVE-2024-30349 | High | 7.8 | 2024-04-02 | Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-30348 | High | 7.8 | 2024-04-02 | Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-30347 | Low | 3.3 | 2024-04-02 | Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive inf… |
CVE-2024-30346 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30345 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30344 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-29432 | Critical | 9.8 | 2024-04-02 | Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas. |
CVE-2024-27605 | High | 7.5 | 2024-04-02 | Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system. |
CVE-2024-27604 | Critical | 9.8 | 2024-04-02 | Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized. |
CVE-2024-27602 | Critical | 9.1 | 2024-04-02 | Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs… |
CVE-2024-25075 | Medium | 5.1 | 2024-04-02 | An issue was discovered in Softing uaToolkit Embedded before 1.41.1. When a subscription with a very low MaxNotificationPerPublish parameter is created, a publ… |
CVE-2024-30343 | High | 7.8 | 2024-04-02 | Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2024-30342 | High | 7.8 | 2024-04-02 | Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2024-30341 | High | 7.8 | 2024-04-02 | Foxit PDF Reader Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2024-30340 | Low | 3.3 | 2024-04-02 | Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive informati… |
CVE-2024-30339 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30338 | High | 7.8 | 2024-04-02 | Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
CVE-2024-30337 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-30336 | High | 7.8 | 2024-04-02 | Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2024-29834 | Medium | 6.4 | 2024-04-02 | This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading t… |
CVE-2024-30532 | Medium | 4.9 | 2024-04-02 | Server-Side Request Forgery (SSRF) vulnerability in Builderall Team Builderall Builder for WordPress.This issue affects Builderall Builder for WordPress: from… |
CVE-2024-30531 | Medium | 4.9 | 2024-04-02 | Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content.This issue affects Nelio Content: from n/a through 3.2.0. |
CVE-2024-24888 | Medium | 6.4 | 2024-04-02 | Server-Side Request Forgery (SSRF) vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence… |
CVE-2024-31109 | High | 7.1 | 2024-04-02 | Cross-Site Request Forgery (CSRF) vulnerability in Toastie Studio Woocommerce Social Media Share Buttons allows Stored XSS.This issue affects Woocommerce Socia… |
CVE-2024-31105 | High | 7.1 | 2024-04-02 | Cross-Site Request Forgery (CSRF) vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5. |
CVE-2024-30809 | High | 7.5 | 2024-04-02 | An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in Ap4Sample.h in AP4_Sample::GetOffset() const, leading to a Denial of… |
CVE-2024-30808 | Low | 2.7 | 2024-04-02 | An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_SubStream::~AP4_SubStream at Ap4ByteStream.cpp, leading to a Den… |
CVE-2024-30807 | High | 7.5 | 2024-04-02 | An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_UnknownAtom::~AP4_UnknownAtom at Ap4Atom.cpp, leading to a Denia… |
CVE-2024-30806 | Medium | 6.5 | 2024-04-02 | An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a Denial of Serv… |
CVE-2024-30335 | High | 7.1 | 2024-04-02 | Foxit PDF Reader AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive… |
CVE-2024-3151 | Medium | 4.3 | 2024-04-02 | A vulnerability, which was classified as problematic, was found in Bdtask Multi-Store Inventory Management System up to 20240325. Affected is an unknown functi… |
CVE-2024-2435 | Medium | 4.3 | 2024-04-02 | For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a victim views that… |
CVE-2024-28287 | High | 7.3 | 2024-04-02 | A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL. |
CVE-2024-22248 | High | 7.1 | 2024-04-02 | VMware SD-WAN Orchestrator contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker controlled domain due t… |
CVE-2024-22247 | Medium | 4.8 | 2024-04-02 | VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access to the SD-WAN Edge applian… |
CVE-2024-22246 | High | 7.4 | 2024-04-02 | VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. A malicious actor with local acce… |
CVE-2024-30248 | High | 7.7 | 2024-04-02 | Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As… |
CVE-2024-22780 | Medium | 6.1 | 2024-04-02 | Cross Site Scripting vulnerability in CA17 TeamsACS v.1.0.1 allows a remote attacker to execute arbitrary code via a crafted script to the errmsg parameter. |
CVE-2024-30965 | High | 8.8 | 2024-04-02 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php. |
CVE-2024-30621 | Critical | 9.8 | 2024-04-02 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the serverName parameter in the function fromAdvSetMacMtuWan. |
CVE-2024-30620 | Critical | 9.8 | 2024-04-02 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the serviceName parameter in the function fromAdvSetMacMtuWan. |
CVE-2024-30946 | Medium | 5.5 | 2024-04-02 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/co_do.php. |
CVE-2024-2389 | Critical | 10.0 | 2024-04-02 | In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain ent… |
CVE-2024-29514 | High | 8.8 | 2024-04-02 | File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file. |
CVE-2024-29949 | High | 7.2 | 2024-04-02 | There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary comma… |
CVE-2024-29948 | Low | 3.8 | 2024-04-02 | There is an out-of-bounds read vulnerability in some Hikvision NVRs. An authenticated attacker could exploit this vulnerability by sending specially crafted me… |
CVE-2024-29947 | Low | 2.7 | 2024-04-02 | There is a NULL dereference pointer vulnerability in some Hikvision NVRs. Due to an insufficient validation of a parameter in a message, an attacker may send s… |
CVE-2024-2745 | Low | 3.3 | 2024-04-02 | Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through qu… |
CVE-2024-1946 | Medium | 6.4 | 2024-04-02 | The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, and including, 3.1.2 due to i… |
CVE-2024-1807 | Medium | 6.5 | 2024-04-02 | The Product Sort and Display for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the p… |
CVE-2024-1732 | Medium | 5.3 | 2024-04-02 | The Sharkdropship for AliExpress Dropshipping and Affiliate plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check o… |
CVE-2024-2931 | Medium | 4.3 | 2024-04-02 | The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.1.11184 via the wpf… |
CVE-2024-31005 | High | 8.1 | 2024-04-02 | An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cpp,AP4_MdhdAtom::AP4_MdhdAtom,mp4fragment |
CVE-2024-31004 | Critical | 9.8 | 2024-04-02 | An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4_StsdAtom::AP4_StsdAtom,mp4fragment. |
CVE-2024-31003 | High | 8.8 | 2024-04-02 | Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4_MemoryByteStream::WritePartial at Ap4B… |