2024 CVEs (page 338)
Page 338 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21914 | Medium | 5.3 | 2024-03-25 | A vulnerability exists in the affected product that allows a malicious user to restart the Rockwell Automation PanelView™ Plus 7 terminal remotely without sec… |
CVE-2024-1973 | High | 8.5 | 2024-03-25 | By leveraging the vulnerability, lower-privileged users of Content Manager can manipulate Content Manager clients to elevate privileges and perform unauthorize… |
CVE-2024-2427 | High | 7.5 | 2024-03-25 | A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper traffic throttling in the device. If multiple data packets… |
CVE-2024-2426 | High | 7.5 | 2024-03-25 | A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption… |
CVE-2024-2425 | High | 7.5 | 2024-03-25 | A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, the web serve… |
CVE-2024-29179 | Medium | 4.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. An attacker with admin privileges can upload an attachme… |
CVE-2024-29041 | Medium | 6.1 | 2024-03-25 | Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open… |
CVE-2024-29025 | Medium | 5.3 | 2024-03-25 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `Htt… |
CVE-2024-28246 | Medium | 5.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's `trust` option, specifically that provides a function to blacklist cert… |
CVE-2024-28245 | Medium | 6.3 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input usin… |
CVE-2024-28244 | Medium | 6.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input usin… |
CVE-2024-28243 | Medium | 6.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input usin… |
CVE-2024-29666 | Critical | 9.8 | 2024-03-25 | Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a remote attacker to escalate privileges vi… |
CVE-2024-29515 | High | 8.8 | 2024-03-25 | File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file to the save.php… |
CVE-2024-28850 | High | 8.1 | 2024-03-25 | WP Crontrol controls the cron events on WordPress websites. WP Crontrol includes a feature that allows administrative users to create events in the WP-Cron sy… |
CVE-2024-28108 | Medium | 4.7 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` para… |
CVE-2024-28107 | High | 8.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in th… |
CVE-2024-28106 | Medium | 4.3 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an… |
CVE-2024-28105 | High | 7.2 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulner… |
CVE-2024-27300 | Medium | 5.5 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user control panel page… |
CVE-2024-27299 | High | 8.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the… |
CVE-2024-30205 | High | 7.1 | 2024-03-25 | In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. |
CVE-2024-30204 | Low | 2.8 | 2024-03-25 | In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. |
CVE-2024-30203 | Medium | 5.5 | 2024-03-25 | In Emacs before 29.3, Gnus treats inline MIME contents as trusted. |
CVE-2024-30202 | High | 7.8 | 2024-03-25 | In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. |
CVE-2024-29650 | Critical | 9.8 | 2024-03-25 | An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components. |
CVE-2024-28183 | Medium | 6.1 | 2024-03-25 | ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulnerability was discov… |
CVE-2024-25175 | Medium | 6.1 | 2024-03-25 | An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack. |
CVE-2024-2865 | Critical | 9.8 | 2024-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Inje… |
CVE-2024-28435 | Medium | 5.4 | 2024-03-25 | The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload. |
CVE-2024-28434 | High | 7.6 | 2024-03-25 | The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0. A crafted svg file can trigger the execution of the java… |
CVE-2024-28393 | Critical | 9.8 | 2024-03-25 | SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate privileges via the ScalapayReturnModuleFrontController::postPr… |
CVE-2024-28387 | High | 7.5 | 2024-03-25 | An issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information via the log.txt component. |
CVE-2024-28386 | Critical | 9.8 | 2024-03-25 | An issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component. |
CVE-2024-25002 | High | 8.8 | 2024-03-25 | Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device. |
CVE-2024-2864 | High | 7.3 | 2024-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaineLabs Youzify - Buddypress Moderation.This issue affe… |
CVE-2024-25964 | Medium | 5.3 | 2024-03-25 | Dell PowerScale OneFS 9.5.0.x through 9.7.0.x contain a covert timing channel vulnerability. A remote unauthenticated attacker could potentially exploit this v… |
CVE-2024-30187 | Medium | 5.3 | 2024-03-25 | Anope before 2.0.15 does not prevent resetting the password of a suspended account. |
CVE-2024-2863 | Medium | 5.3 | 2024-03-25 | This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant. |
CVE-2024-2862 | Critical | 9.1 | 2024-03-25 | This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant. |
CVE-2024-29216 | Medium | 6.1 | 2024-03-25 | Exposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0. By sending a specific IOCTL request, a user without the administ… |
CVE-2024-24899 | High | 7.2 | 2024-03-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injecti… |
CVE-2024-24897 | High | 8.1 | 2024-03-25 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injecti… |
CVE-2024-24892 | High | 8.1 | 2024-03-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-… |
CVE-2024-24890 | High | 7.8 | 2024-03-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injec… |
CVE-2024-29009 | Medium | 6.1 | 2024-03-25 | Cross-site request forgery (CSRF) vulnerability in easy-popup-show all versions allows a remote unauthenticated attacker to hijack the authentication of the ad… |
CVE-2024-21865 | Medium | 6.5 | 2024-03-25 | HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via S… |
CVE-2024-21505 | High | 7.5 | 2024-03-25 | Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive… |
CVE-2024-1962 | High | 8.8 | 2024-03-25 | The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit down… |
CVE-2024-1564 | Medium | 4.3 | 2024-03-25 | The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of po… |
CVE-2024-1232 | Medium | 4.8 | 2024-03-25 | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete do… |
CVE-2024-1231 | Medium | 6.8 | 2024-03-25 | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish… |
CVE-2024-29071 | High | 8.8 | 2024-03-25 | HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings. |
CVE-2024-28041 | High | 8.8 | 2024-03-25 | HGW BL1500HM Ver 002.001.013 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary command. |
CVE-2024-29188 | High | 7.9 | 2024-03-24 | WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functiona… |
CVE-2024-29187 | High | 7.3 | 2024-03-24 | WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW… |
CVE-2024-29034 | Medium | 6.8 | 2024-03-24 | CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vuln… |
CVE-2024-29194 | High | 8.3 | 2024-03-24 | OneUptime is a solution for monitoring and managing online services. The vulnerability lies in the improper validation of client-side stored data within the we… |
CVE-2024-2856 | High | 8.8 | 2024-03-24 | A vulnerability, which was classified as critical, has been found in Tenda AC10 16.03.10.13/16.03.10.20. Affected by this issue is the function fromSetSysTime… |
CVE-2024-2855 | High | 8.8 | 2024-03-24 | A vulnerability classified as critical was found in Tenda AC15 15.03.05.18/15.03.05.19/15.03.20. Affected by this vulnerability is the function fromSetSysTime… |
CVE-2024-2854 | Medium | 6.3 | 2024-03-24 | A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetSambaConf of the file /goform/setsambacfg. The… |
CVE-2024-2853 | Medium | 6.3 | 2024-03-24 | A vulnerability was found in Tenda AC10U 15.03.06.48/15.03.06.49. It has been rated as critical. This issue affects the function formSetSambaConf of the file /… |
CVE-2024-2852 | High | 8.8 | 2024-03-24 | A vulnerability was found in Tenda AC15 15.03.20_multi. It has been declared as critical. This vulnerability affects the function saveParentControlInfo of the… |
CVE-2024-2851 | Medium | 6.3 | 2024-03-24 | A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formSetSambaConf of the file… |
CVE-2024-2850 | High | 8.8 | 2024-03-24 | A vulnerability was found in Tenda AC15 15.03.05.18 and classified as critical. Affected by this issue is the function saveParentControlInfo of the file /gofor… |
CVE-2024-30161 | Medium | 6.5 | 2024-03-24 | In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are… |
CVE-2024-30156 | High | 7.5 | 2024-03-24 | Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 co… |
CVE-2024-24725 | High | 8.8 | 2024-03-23 | Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin… |
CVE-2024-23755 | High | 8.8 | 2024-03-23 | ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. There is inadequate protection against code inject… |
CVE-2024-1603 | High | 7.5 | 2024-03-23 | paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file. |
CVE-2024-2849 | Medium | 6.3 | 2024-03-23 | A vulnerability classified as critical was found in SourceCodester Simple File Manager 1.0. This vulnerability affects unknown code. The manipulation of the ar… |
CVE-2024-24840 | Medium | 4.3 | 2024-03-23 | Missing Authorization vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.4.11. |
CVE-2024-24835 | Medium | 4.3 | 2024-03-23 | Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4. |
CVE-2024-24832 | High | 8.2 | 2024-03-23 | Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9. |
CVE-2024-2832 | Low | 3.5 | 2024-03-23 | A vulnerability classified as problematic was found in Campcodes Online Shopping System 1.0. This vulnerability affects unknown code of the file /offersmail.ph… |
CVE-2024-2326 | Medium | 4.3 | 2024-03-23 | The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all ver… |
CVE-2024-1049 | Medium | 6.4 | 2024-03-23 | The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Widget's in all versions u… |
CVE-2024-2688 | Medium | 5.4 | 2024-03-23 | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress… |
CVE-2024-2468 | Medium | 6.4 | 2024-03-23 | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress… |
CVE-2024-2202 | Medium | 6.4 | 2024-03-23 | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions up to, and includi… |
CVE-2024-2131 | Medium | 6.4 | 2024-03-23 | The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's infobox and button widget in all versions up t… |
CVE-2024-2025 | High | 8.8 | 2024-03-23 | The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions… |
CVE-2024-1697 | Medium | 6.4 | 2024-03-23 | The Custom WooCommerce Checkout Fields Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the save_wcfe_options function in all versi… |
CVE-2024-29059 | High | 7.5 | 2024-03-23 | .NET Framework Information Disclosure Vulnerability |
CVE-2024-29190 | High | 7.5 | 2024-03-22 | Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In ve… |
CVE-2024-29057 | Medium | 4.3 | 2024-03-22 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-26247 | Medium | 4.7 | 2024-03-22 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2024-2828 | Medium | 6.3 | 2024-03-22 | A vulnerability, which was classified as critical, was found in lakernote EasyAdmin up to 20240315. Affected is the function thumbnail of the file src/main/jav… |
CVE-2024-2827 | Medium | 6.3 | 2024-03-22 | A vulnerability, which was classified as critical, has been found in lakernote EasyAdmin up to 20240315. This issue affects some unknown processing of the file… |
CVE-2024-2826 | Medium | 6.3 | 2024-03-22 | A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designe… |
CVE-2024-2825 | Medium | 6.3 | 2024-03-22 | A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /ureport/designer/saveRep… |
CVE-2024-2824 | Medium | 6.3 | 2024-03-22 | A vulnerability was found in Matthias-Wandel jhead 3.08 and classified as critical. This issue affects the function PrintFormatNumber of the file exif.c. The m… |
CVE-2024-2823 | Medium | 4.3 | 2024-03-22 | A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/mda_main.php. The ma… |
CVE-2024-2822 | Medium | 4.3 | 2024-03-22 | A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/vote_edit.php. The manipulat… |
CVE-2024-29499 | High | 7.4 | 2024-03-22 | Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2. |
CVE-2024-29385 | Critical | 9.0 | 2024-03-22 | DIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function. |
CVE-2024-29366 | High | 8.8 | 2024-03-22 | A command injection vulnerability exists in the cgibin binary in DIR-845L router firmware <= v1.01KRb03. |
CVE-2024-29338 | Low | 2.4 | 2024-03-22 | Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2. |
CVE-2024-29186 | Medium | 5.3 | 2024-03-22 | Bref is an open-source project that helps users go serverless on Amazon Web Services with PHP. When Bref prior to version 2.1.17 is used with the Event-Driven… |
CVE-2024-29185 | Critical | 9.0 | 2024-03-22 | FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file… |