2024 CVEs (page 337)
Page 337 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24334 | High | 8.4 | 2024-03-27 | A heap buffer overflow occurs in dfs_v2 dfs_file in RT-Thread through 5.0.2. |
CVE-2024-1532 | Medium | 6.8 | 2024-03-27 | A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could enforce diagnost… |
CVE-2024-0400 | High | 7.5 | 2024-03-27 | SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for customized filtering. An… |
CVE-2024-2940 | Low | 3.5 | 2024-03-27 | A vulnerability classified as problematic was found in Campcodes Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-2244 | Medium | 5.3 | 2024-03-27 | REST service authentication anomaly with “valid username/no password” credential combination for batch job processing resulting in successful service invocatio… |
CVE-2024-1531 | High | 8.2 | 2024-03-27 | A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could print random mem… |
CVE-2024-2939 | Low | 3.5 | 2024-03-27 | A vulnerability classified as problematic has been found in Campcodes Online Examination System 1.0. Affected is an unknown function of the file /adminpanel/ad… |
CVE-2024-2938 | Medium | 6.3 | 2024-03-27 | A vulnerability was found in Campcodes Online Examination System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ad… |
CVE-2024-2935 | Low | 3.5 | 2024-03-27 | A vulnerability, which was classified as problematic, has been found in SourceCodester Todo List in Kanban Board 1.0. Affected by this issue is some unknown fu… |
CVE-2024-2934 | Medium | 6.3 | 2024-03-27 | A vulnerability classified as critical was found in SourceCodester Todo List in Kanban Board 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-2932 | Medium | 6.3 | 2024-03-27 | A vulnerability classified as critical has been found in SourceCodester Online Chatting System 1.0. Affected is an unknown function of the file admin/update_ro… |
CVE-2024-2206 | Medium | 6.5 | 2024-03-27 | An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers can exploit this vu… |
CVE-2024-2930 | High | 7.3 | 2024-03-27 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-2209 | Medium | 6.3 | 2024-03-27 | A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (F… |
CVE-2024-2927 | High | 7.3 | 2024-03-26 | A vulnerability was found in code-projects Mobile Shop 1.0. It has been classified as critical. Affected is an unknown function of the file Details.php of the… |
CVE-2024-2917 | Medium | 5.4 | 2024-03-26 | A vulnerability was found in Campcodes House Rental Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown funct… |
CVE-2024-2916 | High | 7.3 | 2024-03-26 | A vulnerability was found in Campcodes House Rental Management System 1.0. It has been classified as critical. Affected is an unknown function of the file ajax… |
CVE-2024-26577 | High | 7.5 | 2024-03-26 | VSeeFace through 1.13.38.c2 allows attackers to cause a denial of service (application hang) via a spoofed UDP packet containing at least 10 digits in JSON dat… |
CVE-2024-25138 | Medium | 6.5 | 2024-03-26 | In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device. |
CVE-2024-25137 | Medium | 4.3 | 2024-03-26 | In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may… |
CVE-2024-25136 | High | 7.5 | 2024-03-26 | There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content. |
CVE-2024-2971 | Low | 2.9 | 2024-03-26 | Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by negative object number in indirect reference in the input PDF file. |
CVE-2024-2911 | Medium | 4.3 | 2024-03-26 | A vulnerability, which was classified as problematic, was found in Tianjin PubliCMS 4.0.202302.e. This affects an unknown part. The manipulation leads to cross… |
CVE-2024-2910 | Medium | 6.3 | 2024-03-26 | A vulnerability, which was classified as critical, has been found in Ruijie RG-EG350 up to 20240318. Affected by this issue is the function vpnAction of the fi… |
CVE-2024-2909 | High | 8.8 | 2024-03-26 | A vulnerability classified as critical was found in Ruijie RG-EG350 up to 20240318. Affected by this vulnerability is the function setAction of the file /itbox… |
CVE-2024-2903 | High | 8.8 | 2024-03-26 | A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. Affected is the function GetParentControlInfo of the file /goform/GetPa… |
CVE-2024-2887 | High | 7.7 | 2024-03-26 | Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium se… |
CVE-2024-2886 | High | 7.5 | 2024-03-26 | Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromiu… |
CVE-2024-2885 | High | 8.8 | 2024-03-26 | Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2024-2883 | High | 8.8 | 2024-03-26 | Use after free in ANGLE in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-28551 | High | 7.5 | 2024-03-26 | Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the ssid parameter of form_fast_setting_wifi_set function. |
CVE-2024-28545 | Critical | 9.8 | 2024-03-26 | Tenda AC18 V15.03.05.05 contains a command injection vulnerablility in the deviceName parameter of formsetUsbUnload function. |
CVE-2024-27521 | High | 8.0 | 2024-03-26 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multiple parameters in th… |
CVE-2024-26303 | Medium | 4.9 | 2024-03-26 | Authenticated Denial of Service Vulnerability in ArubaOS-Switch SSH Daemon |
CVE-2024-25421 | Critical | 9.8 | 2024-03-26 | An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component. |
CVE-2024-25420 | High | 7.2 | 2024-03-26 | An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component. |
CVE-2024-2955 | High | 7.8 | 2024-03-26 | T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file |
CVE-2024-2902 | High | 8.8 | 2024-03-26 | A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. This issue affects the function fromSetWifiGusetBasic of the file /goform/WifiGu… |
CVE-2024-2901 | High | 8.8 | 2024-03-26 | A vulnerability has been found in Tenda AC7 15.03.06.44 and classified as critical. This vulnerability affects the function setSchedWifi of the file /goform/op… |
CVE-2024-2900 | High | 8.8 | 2024-03-26 | A vulnerability, which was classified as critical, was found in Tenda AC7 15.03.06.44. This affects the function saveParentControlInfo of the file /goform/save… |
CVE-2024-28442 | High | 7.5 | 2024-03-26 | Directory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate attacker to obtain sensitive information via terms of use functio… |
CVE-2024-2899 | High | 8.8 | 2024-03-26 | A vulnerability, which was classified as critical, has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetWirelessRepeat of the… |
CVE-2024-2898 | High | 8.8 | 2024-03-26 | A vulnerability classified as critical was found in Tenda AC7 15.03.06.44. Affected by this vulnerability is the function fromSetRouteStatic of the file /gofor… |
CVE-2024-2897 | Medium | 6.3 | 2024-03-26 | A vulnerability classified as critical has been found in Tenda AC7 15.03.06.44. Affected is the function formWriteFacMac of the file /goform/WriteFacMac. The m… |
CVE-2024-22436 | Medium | 6.5 | 2024-03-26 | A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a denial of service. |
CVE-2024-2951 | Medium | 4.3 | 2024-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.3.0.0. |
CVE-2024-2896 | High | 8.8 | 2024-03-26 | A vulnerability was found in Tenda AC7 15.03.06.44. It has been rated as critical. This issue affects the function formWifiWpsStart of the file /goform/WifiWps… |
CVE-2024-2895 | High | 8.8 | 2024-03-26 | A vulnerability was found in Tenda AC7 15.03.06.44. It has been declared as critical. This vulnerability affects the function formWifiWpsOOB of the file /gofor… |
CVE-2024-26649 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer when load rlc firmware If the RLC firmware is invalid be… |
CVE-2024-26648 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay() In edp_… |
CVE-2024-26647 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()' In link_s… |
CVE-2024-26646 | High | 7.8 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: thermal: intel: hfi: Add syscore callbacks for system-wide PM The kernel allocates a memo… |
CVE-2024-1313 | Medium | 6.5 | 2024-03-26 | It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to… |
CVE-2024-2894 | High | 8.8 | 2024-03-26 | A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. This affects the function formSetQosBand of the file /goform/SetNetCont… |
CVE-2024-2893 | High | 8.8 | 2024-03-26 | A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. Affected by this issue is the function formSetDeviceName of the file /goform/Set… |
CVE-2024-29735 | Medium | 5.3 | 2024-03-26 | Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task han… |
CVE-2024-2929 | High | 7.8 | 2024-03-26 | A memory corruption vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the… |
CVE-2024-2921 | Critical | 9.8 | 2024-03-26 | Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access un… |
CVE-2024-2915 | High | 8.8 | 2024-03-26 | Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elev… |
CVE-2024-2892 | High | 8.8 | 2024-03-26 | A vulnerability has been found in Tenda AC7 15.03.06.44 and classified as critical. Affected by this vulnerability is the function formSetCfm of the file /gofo… |
CVE-2024-2452 | High | 7.0 | 2024-03-26 | In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could cause an integer wrap-around and an alloc… |
CVE-2024-2214 | High | 7.0 | 2024-03-26 | In Eclipse ThreadX before version 6.4.0, the _Mtxinit() function in the Xtensa port was missing an array size check causing a memory overwrite. The affected… |
CVE-2024-2212 | High | 7.3 | 2024-03-26 | In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compatibility_layers/FreeR… |
CVE-2024-29833 | Medium | 5.4 | 2024-03-26 | The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which… |
CVE-2024-29832 | Medium | 6.1 | 2024-03-26 | The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current… |
CVE-2024-29810 | Medium | 5.4 | 2024-03-26 | The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_… |
CVE-2024-29809 | Medium | 5.4 | 2024-03-26 | The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_… |
CVE-2024-29808 | Medium | 5.4 | 2024-03-26 | The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_i… |
CVE-2024-26645 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: tracing: Ensure visibility when inserting an element into tracing_map Running the followi… |
CVE-2024-26644 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to snapshot deleted subvolume If the source… |
CVE-2024-25958 | Medium | 6.7 | 2024-03-26 | Dell Grab for Windows, versions up to and including 5.0.4, contain Weak Application Folder Permissions vulnerability. A local authenticated attacker could pote… |
CVE-2024-25957 | Medium | 4.8 | 2024-03-26 | Dell Grab for Windows, versions 5.0.4 and below, contains a cleartext storage of sensitive information vulnerability in its appsync module. An authenticated lo… |
CVE-2024-25956 | Medium | 5.5 | 2024-03-26 | Dell Grab for Windows, versions 5.0.4 and below, contains an improper file permissions vulnerability. A locally authenticated attacker could potentially exploi… |
CVE-2024-21920 | Medium | 4.4 | 2024-03-26 | A memory buffer vulnerability in Rockwell Automation Arena Simulation could potentially let a threat actor read beyond the intended memory boundaries. This… |
CVE-2024-21919 | High | 7.8 | 2024-03-26 | An uninitialized pointer in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software… |
CVE-2024-21918 | High | 7.8 | 2024-03-26 | A memory buffer vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the sof… |
CVE-2024-21913 | High | 7.8 | 2024-03-26 | A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthor… |
CVE-2024-21912 | High | 7.8 | 2024-03-26 | An arbitrary code execution vulnerability in Rockwell Automation Arena Simulation could let a malicious user insert unauthorized code into the software. This… |
CVE-2024-29401 | Critical | 9.8 | 2024-03-26 | xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything. |
CVE-2024-29197 | Medium | 6.5 | 2024-03-26 | Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In… |
CVE-2024-23722 | High | 7.5 | 2024-03-26 | In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It cras… |
CVE-2024-23482 | High | 7.0 | 2024-03-26 | The ZScaler service is susceptible to a local privilege escalation vulnerability found in the ZScalerService process. Fixed Version: Mac ZApp 4.2.0.241 and lat… |
CVE-2024-22356 | Medium | 4.9 | 2024-03-26 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.9.0 and IBM Integration Bus for z/OS 10.1 through 10.1.0.2store potentially sensit… |
CVE-2024-2891 | High | 8.8 | 2024-03-26 | A vulnerability, which was classified as critical, was found in Tenda AC7 15.03.06.44. Affected is the function formQuickIndex of the file /goform/QuickIndex… |
CVE-2024-29883 | Medium | 4.9 | 2024-03-26 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visi… |
CVE-2024-29881 | Medium | 4.3 | 2024-03-26 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code… |
CVE-2024-29684 | Critical | 9.8 | 2024-03-26 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to exec… |
CVE-2024-29203 | Medium | 4.3 | 2024-03-26 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `ifram… |
CVE-2024-1455 | Medium | 5.9 | 2024-03-26 | A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multi… |
CVE-2024-30235 | Medium | 4.3 | 2024-03-26 | Missing Authorization vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through… |
CVE-2024-30234 | Medium | 6.5 | 2024-03-26 | Missing Authorization vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1. |
CVE-2024-30233 | Medium | 6.5 | 2024-03-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1. |
CVE-2024-2906 | Medium | 6.5 | 2024-03-26 | Missing Authorization vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73. |
CVE-2024-22156 | Medium | 6.5 | 2024-03-26 | Missing Authorization vulnerability in SNP Digital SalesKing.This issue affects SalesKing: from n/a through 1.6.15. |
CVE-2024-1933 | High | 7.1 | 2024-03-26 | Insecure UNIX Symbolic Link (Symlink) Following in TeamViewer Remote Client prior Version 15.52 for macOS allows an attacker with unprivileged access, to poten… |
CVE-2024-30232 | Medium | 6.5 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons Exclusive Addons Elementor allows Stored… |
CVE-2024-30231 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for W… |
CVE-2024-29644 | Medium | 6.1 | 2024-03-26 | Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script to the user login b… |
CVE-2024-28093 | High | 8.8 | 2024-03-26 | The TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has default credentials for a root-level account. |
CVE-2024-24799 | Medium | 6.5 | 2024-03-26 | Missing Authorization vulnerability in WooCommerce WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.2.2. |