2024 CVEs (page 337)
Page 337 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2883 | High | 8.8 | 2024-03-26 | Use after free in ANGLE in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-28551 | High | 7.5 | 2024-03-26 | Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the ssid parameter of form_fast_setting_wifi_set function. |
CVE-2024-28545 | Critical | 9.8 | 2024-03-26 | Tenda AC18 V15.03.05.05 contains a command injection vulnerablility in the deviceName parameter of formsetUsbUnload function. |
CVE-2024-27521 | High | 8.0 | 2024-03-26 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multiple parameters in th… |
CVE-2024-26303 | Medium | 4.9 | 2024-03-26 | Authenticated Denial of Service Vulnerability in ArubaOS-Switch SSH Daemon |
CVE-2024-25421 | Critical | 9.8 | 2024-03-26 | An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component. |
CVE-2024-25420 | High | 7.2 | 2024-03-26 | An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component. |
CVE-2024-2955 | High | 7.8 | 2024-03-26 | T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file |
CVE-2024-2902 | High | 8.8 | 2024-03-26 | A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. This issue affects the function fromSetWifiGusetBasic of the file /goform/WifiGu… |
CVE-2024-2901 | High | 8.8 | 2024-03-26 | A vulnerability has been found in Tenda AC7 15.03.06.44 and classified as critical. This vulnerability affects the function setSchedWifi of the file /goform/op… |
CVE-2024-2900 | High | 8.8 | 2024-03-26 | A vulnerability, which was classified as critical, was found in Tenda AC7 15.03.06.44. This affects the function saveParentControlInfo of the file /goform/save… |
CVE-2024-28442 | High | 7.5 | 2024-03-26 | Directory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate attacker to obtain sensitive information via terms of use functio… |
CVE-2024-2899 | High | 8.8 | 2024-03-26 | A vulnerability, which was classified as critical, has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetWirelessRepeat of the… |
CVE-2024-2898 | High | 8.8 | 2024-03-26 | A vulnerability classified as critical was found in Tenda AC7 15.03.06.44. Affected by this vulnerability is the function fromSetRouteStatic of the file /gofor… |
CVE-2024-2897 | Medium | 6.3 | 2024-03-26 | A vulnerability classified as critical has been found in Tenda AC7 15.03.06.44. Affected is the function formWriteFacMac of the file /goform/WriteFacMac. The m… |
CVE-2024-22436 | Medium | 6.5 | 2024-03-26 | A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a denial of service. |
CVE-2024-2951 | Medium | 4.3 | 2024-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.3.0.0. |
CVE-2024-2896 | High | 8.8 | 2024-03-26 | A vulnerability was found in Tenda AC7 15.03.06.44. It has been rated as critical. This issue affects the function formWifiWpsStart of the file /goform/WifiWps… |
CVE-2024-2895 | High | 8.8 | 2024-03-26 | A vulnerability was found in Tenda AC7 15.03.06.44. It has been declared as critical. This vulnerability affects the function formWifiWpsOOB of the file /gofor… |
CVE-2024-26649 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer when load rlc firmware If the RLC firmware is invalid be… |
CVE-2024-26648 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay() In edp_… |
CVE-2024-26647 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()' In link_s… |
CVE-2024-26646 | High | 7.8 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: thermal: intel: hfi: Add syscore callbacks for system-wide PM The kernel allocates a memo… |
CVE-2024-1313 | Medium | 6.5 | 2024-03-26 | It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to… |
CVE-2024-2894 | High | 8.8 | 2024-03-26 | A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. This affects the function formSetQosBand of the file /goform/SetNetCont… |
CVE-2024-2893 | High | 8.8 | 2024-03-26 | A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. Affected by this issue is the function formSetDeviceName of the file /goform/Set… |
CVE-2024-29735 | Medium | 5.3 | 2024-03-26 | Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task han… |
CVE-2024-2929 | High | 7.8 | 2024-03-26 | A memory corruption vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the… |
CVE-2024-2921 | Critical | 9.8 | 2024-03-26 | Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access un… |
CVE-2024-2915 | High | 8.8 | 2024-03-26 | Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elev… |
CVE-2024-2892 | High | 8.8 | 2024-03-26 | A vulnerability has been found in Tenda AC7 15.03.06.44 and classified as critical. Affected by this vulnerability is the function formSetCfm of the file /gofo… |
CVE-2024-2452 | High | 7.0 | 2024-03-26 | In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could cause an integer wrap-around and an alloc… |
CVE-2024-2214 | High | 7.0 | 2024-03-26 | In Eclipse ThreadX before version 6.4.0, the _Mtxinit() function in the Xtensa port was missing an array size check causing a memory overwrite. The affected… |
CVE-2024-2212 | High | 7.3 | 2024-03-26 | In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compatibility_layers/FreeR… |
CVE-2024-29833 | Medium | 5.4 | 2024-03-26 | The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which… |
CVE-2024-29832 | Medium | 6.1 | 2024-03-26 | The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current… |
CVE-2024-29810 | Medium | 5.4 | 2024-03-26 | The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_… |
CVE-2024-29809 | Medium | 5.4 | 2024-03-26 | The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_… |
CVE-2024-29808 | Medium | 5.4 | 2024-03-26 | The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_i… |
CVE-2024-26645 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: tracing: Ensure visibility when inserting an element into tracing_map Running the followi… |
CVE-2024-26644 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to snapshot deleted subvolume If the source… |
CVE-2024-25958 | Medium | 6.7 | 2024-03-26 | Dell Grab for Windows, versions up to and including 5.0.4, contain Weak Application Folder Permissions vulnerability. A local authenticated attacker could pote… |
CVE-2024-25957 | Medium | 4.8 | 2024-03-26 | Dell Grab for Windows, versions 5.0.4 and below, contains a cleartext storage of sensitive information vulnerability in its appsync module. An authenticated lo… |
CVE-2024-25956 | Medium | 5.5 | 2024-03-26 | Dell Grab for Windows, versions 5.0.4 and below, contains an improper file permissions vulnerability. A locally authenticated attacker could potentially exploi… |
CVE-2024-21920 | Medium | 4.4 | 2024-03-26 | A memory buffer vulnerability in Rockwell Automation Arena Simulation could potentially let a threat actor read beyond the intended memory boundaries. This… |
CVE-2024-21919 | High | 7.8 | 2024-03-26 | An uninitialized pointer in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software… |
CVE-2024-21918 | High | 7.8 | 2024-03-26 | A memory buffer vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the sof… |
CVE-2024-21913 | High | 7.8 | 2024-03-26 | A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthor… |
CVE-2024-21912 | High | 7.8 | 2024-03-26 | An arbitrary code execution vulnerability in Rockwell Automation Arena Simulation could let a malicious user insert unauthorized code into the software. This… |
CVE-2024-29401 | Critical | 9.8 | 2024-03-26 | xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything. |
CVE-2024-29197 | Medium | 6.5 | 2024-03-26 | Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In… |
CVE-2024-23722 | High | 7.5 | 2024-03-26 | In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It cras… |
CVE-2024-23482 | High | 7.0 | 2024-03-26 | The ZScaler service is susceptible to a local privilege escalation vulnerability found in the ZScalerService process. Fixed Version: Mac ZApp 4.2.0.241 and lat… |
CVE-2024-22356 | Medium | 4.9 | 2024-03-26 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.9.0 and IBM Integration Bus for z/OS 10.1 through 10.1.0.2store potentially sensit… |
CVE-2024-2891 | High | 8.8 | 2024-03-26 | A vulnerability, which was classified as critical, was found in Tenda AC7 15.03.06.44. Affected is the function formQuickIndex of the file /goform/QuickIndex… |
CVE-2024-29883 | Medium | 4.9 | 2024-03-26 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visi… |
CVE-2024-29881 | Medium | 4.3 | 2024-03-26 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code… |
CVE-2024-29684 | Critical | 9.8 | 2024-03-26 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to exec… |
CVE-2024-29203 | Medium | 4.3 | 2024-03-26 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `ifram… |
CVE-2024-1455 | Medium | 5.9 | 2024-03-26 | A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multi… |
CVE-2024-30235 | Medium | 4.3 | 2024-03-26 | Missing Authorization vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through… |
CVE-2024-30234 | Medium | 6.5 | 2024-03-26 | Missing Authorization vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1. |
CVE-2024-30233 | Medium | 6.5 | 2024-03-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1. |
CVE-2024-2906 | Medium | 6.5 | 2024-03-26 | Missing Authorization vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73. |
CVE-2024-22156 | Medium | 6.5 | 2024-03-26 | Missing Authorization vulnerability in SNP Digital SalesKing.This issue affects SalesKing: from n/a through 1.6.15. |
CVE-2024-1933 | High | 7.1 | 2024-03-26 | Insecure UNIX Symbolic Link (Symlink) Following in TeamViewer Remote Client prior Version 15.52 for macOS allows an attacker with unprivileged access, to poten… |
CVE-2024-30232 | Medium | 6.5 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons Exclusive Addons Elementor allows Stored… |
CVE-2024-30231 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for W… |
CVE-2024-29644 | Medium | 6.1 | 2024-03-26 | Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script to the user login b… |
CVE-2024-28093 | High | 8.8 | 2024-03-26 | The TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has default credentials for a root-level account. |
CVE-2024-24799 | Medium | 6.5 | 2024-03-26 | Missing Authorization vulnerability in WooCommerce WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.2.2. |
CVE-2024-24719 | Medium | 4.3 | 2024-03-26 | Missing Authorization vulnerability in Uriahs Victor Location Picker at Checkout for WooCommerce.This issue affects Location Picker at Checkout for WooCommerce… |
CVE-2024-24718 | Medium | 4.3 | 2024-03-26 | Missing Authorization vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.6. |
CVE-2024-24711 | Medium | 4.3 | 2024-03-26 | Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11. |
CVE-2024-23520 | Medium | 4.3 | 2024-03-26 | Missing Authorization vulnerability in AccessAlly PopupAlly.This issue affects PopupAlly: from n/a through 2.1.0. |
CVE-2024-2904 | Medium | 4.3 | 2024-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Calliope.This issue affects Calliope: from n/a through 1.0.33. |
CVE-2024-28131 | High | 7.8 | 2024-03-26 | EasyRange Ver 1.41 contains an issue with the executable file search path when displaying an extracted file on Explorer, which may lead to loading an executabl… |
CVE-2024-28126 | Medium | 6.1 | 2024-03-26 | Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00. An arbitrary script may be executed on the web browser of the user accessing the website… |
CVE-2024-28048 | Critical | 9.8 | 2024-03-26 | OS command injection vulnerability exists in ffBull ver.4.11, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the pri… |
CVE-2024-28034 | Medium | 5.4 | 2024-03-26 | Cross-site scripting vulnerability exists in Mini Thread Version 3.33βi. An arbitrary script may be executed on the web browser of the user accessing the websi… |
CVE-2024-28033 | High | 7.3 | 2024-03-26 | OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command wit… |
CVE-2024-26018 | Medium | 6.1 | 2024-03-26 | Cross-site scripting vulnerability exists in TvRock 0.9t8a. An arbitrary script may be executed on the web browser of the user accessing the website that uses… |
CVE-2024-24805 | Medium | 5.3 | 2024-03-26 | Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 3.1.2. |
CVE-2024-2889 | Medium | 5.9 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon.Thi… |
CVE-2024-2888 | Medium | 6.5 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag… |
CVE-2024-2303 | Medium | 6.4 | 2024-03-26 | The Easy Textillate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'textillate' shortcode in all versions up to, and includ… |
CVE-2024-2170 | Medium | 6.4 | 2024-03-26 | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all versions up to, and i… |
CVE-2024-1745 | Medium | 4.3 | 2024-03-26 | The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial… |
CVE-2024-29199 | Low | 3.7 | 2024-03-26 | Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthentic… |
CVE-2024-29196 | Low | 3.8 | 2024-03-26 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments t… |
CVE-2024-29195 | Medium | 6.0 | 2024-03-26 | The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This library may be used by the Azure IoT C SDK for communicatio… |
CVE-2024-29189 | High | 7.4 | 2024-03-26 | PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_ins… |
CVE-2024-0866 | High | 8.1 | 2024-03-26 | The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce func… |
CVE-2024-2732 | Medium | 5.4 | 2024-03-26 | The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in all versions up to… |
CVE-2024-29303 | Critical | 9.8 | 2024-03-26 | The delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection |
CVE-2024-29302 | High | 7.5 | 2024-03-26 | SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-employee.php. |
CVE-2024-29301 | High | 7.5 | 2024-03-26 | SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-admin.php?admin_id= |
CVE-2024-28421 | Critical | 9.8 | 2024-03-25 | SQL Injection vulnerability in Razor 0.8.0 allows a remote attacker to escalate privileges via the ChannelModel::updateapk method of the channelmodle.php |
CVE-2024-0901 | High | 7.5 | 2024-03-25 | Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the co… |
CVE-2024-2873 | Critical | 9.1 | 2024-03-25 | A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user… |