2024 CVEs (page 333)
Page 333 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25506 | Medium | 6.5 | 2024-03-28 | Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control of the pm_sys_sys c… |
CVE-2024-3019 | High | 8.8 | 2024-03-28 | A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the pr… |
CVE-2024-31065 | Medium | 6.1 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the City input field. |
CVE-2024-31064 | Medium | 6.1 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input… |
CVE-2024-31063 | Medium | 6.4 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Email input fiel… |
CVE-2024-31062 | Medium | 6.3 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Street input fie… |
CVE-2024-31061 | Medium | 6.1 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Last Name input… |
CVE-2024-2947 | High | 7.3 | 2024-03-28 | A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in… |
CVE-2024-28713 | Critical | 9.8 | 2024-03-28 | An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature. |
CVE-2024-27719 | Medium | 6.1 | 2024-03-28 | A cross site scripting (XSS) vulnerability in rems FAQ Management System v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload t… |
CVE-2024-25971 | Medium | 5.5 | 2024-03-28 | Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exp… |
CVE-2024-25963 | Medium | 5.9 | 2024-03-28 | Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker cou… |
CVE-2024-25960 | High | 7.3 | 2024-03-28 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability. A local low privileged attacke… |
CVE-2024-25955 | High | 7.2 | 2024-03-28 | Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability lea… |
CVE-2024-25954 | Medium | 5.3 | 2024-03-28 | Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could pote… |
CVE-2024-25953 | Medium | 6.0 | 2024-03-28 | Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could… |
CVE-2024-25952 | Medium | 6.0 | 2024-03-28 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could… |
CVE-2024-25946 | High | 7.2 | 2024-03-28 | Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability lea… |
CVE-2024-25961 | Medium | 6.0 | 2024-03-28 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an improper privilege management vulnerability. A local high privileged attacker could potentia… |
CVE-2024-25959 | High | 7.9 | 2024-03-28 | Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an insertion of sensitive information into log file vulnerability. A low privileged local attac… |
CVE-2024-3042 | Medium | 6.3 | 2024-03-28 | A vulnerability was found in SourceCodester Simple Subscription Website 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-3041 | Medium | 6.3 | 2024-03-28 | A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-3040 | Medium | 6.3 | 2024-03-28 | A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /ad… |
CVE-2024-3039 | Medium | 6.3 | 2024-03-28 | A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/exp… |
CVE-2024-31140 | Medium | 4.1 | 2024-03-28 | In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools |
CVE-2024-31139 | Medium | 5.9 | 2024-03-28 | In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector |
CVE-2024-31138 | Medium | 4.6 | 2024-03-28 | In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings |
CVE-2024-31137 | Medium | 6.8 | 2024-03-28 | In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration |
CVE-2024-31136 | High | 7.4 | 2024-03-28 | In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter |
CVE-2024-31135 | Medium | 6.1 | 2024-03-28 | In JetBrains TeamCity before 2024.03 open redirect was possible on the login page |
CVE-2024-31134 | Medium | 6.5 | 2024-03-28 | In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled |
CVE-2024-30612 | High | 8.1 | 2024-03-28 | Tenda AC10U v15.03.06.48 has a stack overflow vulnerability in the deviceId, limitSpeed, limitSpeedUp parameter from formSetClientState function. |
CVE-2024-30604 | High | 7.5 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the list1 parameter of the fromDhcpListClient function. |
CVE-2024-30603 | Medium | 6.5 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function. |
CVE-2024-30602 | Critical | 9.8 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function. |
CVE-2024-30601 | High | 8.0 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function. |
CVE-2024-30600 | High | 8.0 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function. |
CVE-2024-30599 | High | 8.8 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function. |
CVE-2024-30598 | Medium | 6.5 | 2024-03-28 | Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function. |
CVE-2024-30597 | Medium | 6.5 | 2024-03-28 | Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function. |
CVE-2024-0259 | High | 7.3 | 2024-03-28 | Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the serv… |
CVE-2024-30607 | High | 8.0 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function. |
CVE-2024-30606 | High | 8.0 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the page parameter of the fromDhcpListClient function. |
CVE-2024-30592 | High | 8.0 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the page parameter of the fromAddressNat function. |
CVE-2024-30591 | High | 8.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function. |
CVE-2024-30590 | Medium | 6.5 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function. |
CVE-2024-30589 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability in the entrys parameter of the fromAddressNat function. |
CVE-2024-30588 | Medium | 4.3 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function. |
CVE-2024-30587 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function. |
CVE-2024-30586 | Medium | 6.5 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function. |
CVE-2024-30585 | Medium | 6.5 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function. |
CVE-2024-30584 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function. |
CVE-2024-30583 | High | 8.0 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the mitInterface parameter of the fromAddressNat function. |
CVE-2024-29898 | Medium | 4.9 | 2024-03-28 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed… |
CVE-2024-29897 | Medium | 4.9 | 2024-03-28 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) on any wiki in the f… |
CVE-2024-29882 | High | 7.2 | 2024-03-28 | SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callback function name… |
CVE-2024-29200 | Medium | 6.8 | 2024-03-28 | Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus return… |
CVE-2024-28109 | High | 8.1 | 2024-03-28 | veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote… |
CVE-2024-30596 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the formSetDeviceName function. |
CVE-2024-30594 | Medium | 6.5 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function. |
CVE-2024-30593 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability located in the deviceName parameter of the formSetDeviceName function. |
CVE-2024-29896 | High | 7.5 | 2024-03-28 | Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR co… |
CVE-2024-27775 | High | 7.2 | 2024-03-28 | SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash |
CVE-2024-30595 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the addWifiMacFilter function. |
CVE-2024-30422 | Medium | 6.5 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-eleme… |
CVE-2024-30421 | Medium | 4.3 | 2024-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.7.1. |
CVE-2024-2818 | Medium | 4.3 | 2024-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16… |
CVE-2024-2890 | Critical | 9.1 | 2024-03-28 | Unrestricted Upload of File with Dangerous Type vulnerability in Tumult Inc. Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through… |
CVE-2024-29241 | Critical | 9.9 | 2024-03-28 | Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated u… |
CVE-2024-29240 | Medium | 4.3 | 2024-03-28 | Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticat… |
CVE-2024-29239 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi component in Synology Su… |
CVE-2024-29238 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component in Synology Surveill… |
CVE-2024-29237 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in Synology Surveillan… |
CVE-2024-29236 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delete webapi component in Synology Surveill… |
CVE-2024-29235 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog webapi component in Synology Surveillanc… |
CVE-2024-29234 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi component in Synology Surveillance Stat… |
CVE-2024-29233 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi component in Synology Surveillance Sta… |
CVE-2024-29232 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi component in Synology Surveillance Stat… |
CVE-2024-29231 | Medium | 5.4 | 2024-03-28 | Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allo… |
CVE-2024-29230 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByCategory webapi component in Synology Sur… |
CVE-2024-29229 | High | 7.7 | 2024-03-28 | Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authen… |
CVE-2024-29228 | High | 7.7 | 2024-03-28 | Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenti… |
CVE-2024-29227 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in Synology Surveillan… |
CVE-2024-28002 | High | 7.1 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Archetyped Cornerstone allows Reflected XSS.This issue af… |
CVE-2024-28001 | High | 7.1 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Archetyped Favicon Rotator allows Reflected XSS.This issu… |
CVE-2024-27999 | High | 7.1 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digamber Pradhan Preview E-mails for WooCommerce allows R… |
CVE-2024-25924 | High | 7.6 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trustindex.Io WP Testimonials.This issue affects WP Testi… |
CVE-2024-25923 | Medium | 5.3 | 2024-03-28 | Insertion of Sensitive Information into Log File vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.2.7.0. |
CVE-2024-25599 | High | 7.1 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple… |
CVE-2024-22138 | Medium | 5.3 | 2024-03-28 | Insertion of Sensitive Information into Log File vulnerability in Seraphinite Solutions Seraphinite Accelerator.This issue affects Seraphinite Accelerator: fro… |
CVE-2024-30221 | Medium | 5.4 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a t… |
CVE-2024-30200 | High | 7.1 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR allows Reflected XSS.This issue affects B… |
CVE-2024-29100 | Critical | 9.1 | 2024-03-28 | Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a… |
CVE-2024-29090 | Medium | 6.8 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4. |
CVE-2024-28004 | Medium | 5.4 | 2024-03-28 | Missing Authorization vulnerability in ExtendThemes Colibri Page Builder.This issue affects Colibri Page Builder: from n/a through 1.0.248. |
CVE-2024-28003 | Medium | 5.4 | 2024-03-28 | Missing Authorization vulnerability in Megamenu Max Mega Menu.This issue affects Max Mega Menu: from n/a through 3.3. |
CVE-2024-23500 | High | 7.7 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence… |
CVE-2024-30245 | High | 7.6 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pierre Lannoy DecaLog decalog.This issue affects DecaLog… |
CVE-2024-30244 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin.This issue affects C… |
CVE-2024-30243 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tomas WordPress Tooltips.This issue affects WordPress Too… |