2024 CVEs (page 339)
Page 339 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-29184 | High | 8.0 | 2024-03-22 | FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting (XSS) vulnerability has been identified within the Signature Input Field… |
CVE-2024-29042 | Medium | 5.3 | 2024-03-22 | Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacker controlling the… |
CVE-2024-28861 | Critical | 9.8 | 2024-03-22 | Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Sym… |
CVE-2024-2821 | Medium | 4.3 | 2024-03-22 | A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. Affected by this issue is some unknown functionality of the file /src/dede… |
CVE-2024-2820 | Medium | 4.3 | 2024-03-22 | A vulnerability classified as problematic was found in DedeCMS 5.7. Affected by this vulnerability is an unknown functionality of the file /src/dede/baidunews… |
CVE-2024-2228 | High | 7.1 | 2024-03-22 | This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Popul… |
CVE-2024-2227 | Critical | 10.0 | 2024-03-22 | This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.2… |
CVE-2024-29865 | Medium | 5.4 | 2024-03-22 | Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form. |
CVE-2024-28593 | Medium | 5.4 | 2024-03-22 | The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance d… |
CVE-2024-2728 | Medium | 4.1 | 2024-03-22 | Information exposure vulnerability in the CIGESv2 system. This vulnerability could allow a local attacker to intercept traffic due to the lack of proper implem… |
CVE-2024-2727 | Medium | 6.1 | 2024-03-22 | HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confi… |
CVE-2024-2726 | Medium | 6.1 | 2024-03-22 | Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the… |
CVE-2024-2725 | High | 7.5 | 2024-03-22 | Information exposure vulnerability in the CIGESv2 system. A remote attacker might be able to access /vendor/composer/installed.json and retrieve all installed… |
CVE-2024-2724 | Critical | 9.8 | 2024-03-22 | SQL injection vulnerability in the CIGESv2 system, through /ajaxServiciosAtencion.php, in the 'idServicio' parameter. The exploitation of this vulnerability co… |
CVE-2024-2723 | Critical | 9.8 | 2024-03-22 | SQL injection vulnerability in the CIGESv2 system, through /ajaxSubServicios.php, in the 'idServicio' parameter. The exploitation of this vulnerability could a… |
CVE-2024-2722 | Critical | 9.8 | 2024-03-22 | SQL injection vulnerability in the CIGESv2 system, through /ajaxConfigTotem.php, in the 'id' parameter. The exploitation of this vulnerability could allow a re… |
CVE-2024-2449 | High | 7.5 | 2024-03-22 | A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostn… |
CVE-2024-2448 | High | 8.4 | 2024-03-22 | An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands… |
CVE-2024-29944 | High | 8.4 | 2024-03-22 | An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vuln… |
CVE-2024-29943 | Critical | 9.8 | 2024-03-22 | An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This vulnerability affec… |
CVE-2024-28560 | Medium | 5.4 | 2024-03-22 | SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea() function of the Address.php comp… |
CVE-2024-28559 | High | 8.8 | 2024-03-22 | SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the setPrice() function of the Goodsbatchset.php… |
CVE-2024-25168 | Medium | 6.3 | 2024-03-22 | SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the system/role/list interfa… |
CVE-2024-28824 | High | 8.8 | 2024-03-22 | Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0… |
CVE-2024-1848 | High | 7.8 | 2024-03-22 | Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Us… |
CVE-2024-1742 | Low | 3.8 | 2024-03-22 | Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24… |
CVE-2024-0638 | High | 8.2 | 2024-03-22 | Least privilege violation in the Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0… |
CVE-2024-2817 | Medium | 4.3 | 2024-03-22 | A vulnerability, which was classified as problematic, has been found in Tenda AC15 15.03.05.18. Affected by this issue is the function fromSysToolRestoreSet of… |
CVE-2024-2816 | Medium | 4.3 | 2024-03-22 | A vulnerability classified as problematic was found in Tenda AC15 15.03.05.18. Affected by this vulnerability is the function fromSysToolReboot of the file /go… |
CVE-2024-2815 | High | 8.8 | 2024-03-22 | A vulnerability classified as critical has been found in Tenda AC15 15.03.20_multi. Affected is the function R7WebsSecurityHandler of the file /goform/execComm… |
CVE-2024-2814 | High | 8.8 | 2024-03-22 | A vulnerability was found in Tenda AC15 15.03.20_multi. It has been rated as critical. This issue affects the function fromDhcpListClient of the file /goform/D… |
CVE-2024-2813 | High | 8.8 | 2024-03-22 | A vulnerability was found in Tenda AC15 15.03.20_multi. It has been declared as critical. This vulnerability affects the function form_fast_setting_wifi_set of… |
CVE-2024-2812 | Medium | 6.3 | 2024-03-22 | A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formWriteFacMac of the file /… |
CVE-2024-2811 | High | 8.8 | 2024-03-22 | A vulnerability was found in Tenda AC15 15.03.20_multi and classified as critical. Affected by this issue is the function formWifiWpsStart of the file /goform/… |
CVE-2024-2810 | High | 8.8 | 2024-03-22 | A vulnerability has been found in Tenda AC15 15.03.05.18/15.03.20_multi and classified as critical. Affected by this vulnerability is the function formWifiWpsO… |
CVE-2024-2809 | High | 8.8 | 2024-03-22 | A vulnerability, which was classified as critical, was found in Tenda AC15 15.03.05.18/15.03.20_multi. Affected is the function formSetFirewallCfg of the file… |
CVE-2024-2808 | High | 8.8 | 2024-03-22 | A vulnerability, which was classified as critical, has been found in Tenda AC15 15.03.05.18/15.03.20_multi. This issue affects the function formQuickIndex of t… |
CVE-2024-2807 | High | 8.8 | 2024-03-22 | A vulnerability classified as critical was found in Tenda AC15 15.03.05.18/15.03.20_multi. This vulnerability affects the function formExpandDlnaFile of the fi… |
CVE-2024-2806 | High | 8.8 | 2024-03-22 | A vulnerability classified as critical has been found in Tenda AC15 15.03.05.18/15.03.20_multi. This affects the function addWifiMacFilter of the file /goform/… |
CVE-2024-29275 | Critical | 9.8 | 2024-03-22 | SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the… |
CVE-2024-29273 | Medium | 6.1 | 2024-03-22 | There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document. |
CVE-2024-29272 | Medium | 6.5 | 2024-03-22 | Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive inf… |
CVE-2024-29271 | Medium | 6.1 | 2024-03-22 | Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obtain sensitive info… |
CVE-2024-25808 | High | 8.3 | 2024-03-22 | Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function. |
CVE-2024-2805 | High | 8.8 | 2024-03-22 | A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been rated as critical. Affected by this issue is the function formSetSpeedWan of th… |
CVE-2024-26557 | Medium | 5.4 | 2024-03-22 | Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter. |
CVE-2024-25807 | Medium | 6.1 | 2024-03-22 | Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title para… |
CVE-2024-2780 | Low | 3.5 | 2024-03-22 | A vulnerability was found in Campcodes Online Marriage Registration System 1.0. It has been declared as problematic. This vulnerability affects unknown code of… |
CVE-2024-2500 | Medium | 6.4 | 2024-03-22 | The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insu… |
CVE-2024-2392 | Medium | 6.4 | 2024-03-22 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including… |
CVE-2024-2080 | Medium | 4.3 | 2024-03-22 | The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu… |
CVE-2024-28441 | Critical | 9.8 | 2024-03-22 | File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of… |
CVE-2024-0957 | Medium | 6.1 | 2024-03-22 | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custo… |
CVE-2024-2779 | Low | 3.5 | 2024-03-22 | A vulnerability was found in Campcodes Online Marriage Registration System 1.0. It has been classified as problematic. This affects an unknown part of the file… |
CVE-2024-2778 | Low | 3.5 | 2024-03-22 | A vulnerability was found in Campcodes Online Marriage Registration System 1.0 and classified as problematic. Affected by this issue is some unknown functional… |
CVE-2024-2777 | Medium | 6.3 | 2024-03-22 | A vulnerability has been found in Campcodes/PHPGurukul Online Marriage Registration System 1.0 and classified as critical. Affected by this vulnerability is an… |
CVE-2024-2776 | Medium | 6.3 | 2024-03-22 | A vulnerability, which was classified as critical, was found in Campcodes Online Marriage Registration System 1.0. Affected is an unknown function of the file… |
CVE-2024-2775 | Low | 3.5 | 2024-03-21 | A vulnerability, which was classified as problematic, has been found in Campcodes Online Marriage Registration System 1.0. This issue affects some unknown proc… |
CVE-2024-2774 | Medium | 6.3 | 2024-03-21 | A vulnerability classified as critical was found in Campcodes Online Marriage Registration System 1.0. This vulnerability affects unknown code of the file /use… |
CVE-2024-2773 | Low | 3.5 | 2024-03-21 | A vulnerability classified as problematic has been found in Campcodes Online Marriage Registration System 1.0. This affects an unknown part of the file /user/s… |
CVE-2024-2770 | Medium | 6.3 | 2024-03-21 | A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been rated as critical. Affected by this issue is some unkno… |
CVE-2024-2453 | Medium | 6.4 | 2024-03-21 | There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the databas… |
CVE-2024-29031 | High | 7.5 | 2024-03-21 | Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vul… |
CVE-2024-28863 | Medium | 6.5 | 2024-03-21 | node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker wh… |
CVE-2024-28171 | High | 8.1 | 2024-03-21 | It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file sys… |
CVE-2024-28045 | Medium | 4.6 | 2024-03-21 | Improper neutralization of input within the affected product could lead to cross-site scripting. |
CVE-2024-28040 | High | 8.8 | 2024-03-21 | SQL injection vulnerability exists in GetDIAE_astListParameters. |
CVE-2024-25567 | High | 8.1 | 2024-03-21 | Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already e… |
CVE-2024-23975 | High | 8.8 | 2024-03-21 | SQL injection vulnerability exists in GetDIAE_slogListParameters. |
CVE-2024-23494 | High | 8.8 | 2024-03-21 | SQL injection vulnerability exists in GetDIAE_unListParameters. |
CVE-2024-2769 | Medium | 6.3 | 2024-03-21 | A vulnerability was detected in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/a… |
CVE-2024-2768 | Medium | 6.3 | 2024-03-21 | A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been classified as critical. Affected is an unknown function… |
CVE-2024-28891 | High | 8.8 | 2024-03-21 | SQL injection vulnerability exists in the script Handler_CFG.ashx. |
CVE-2024-28521 | High | 7.8 | 2024-03-21 | SQL Injection vulnerability in Netcome NS-ASG Application Security Gateway v.6.3.1 allows a local attacker to execute arbitrary code and obtain sensitive infor… |
CVE-2024-28119 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context… |
CVE-2024-28118 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context… |
CVE-2024-28117 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunctio… |
CVE-2024-28116 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which a… |
CVE-2024-28029 | High | 8.8 | 2024-03-21 | Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionalit… |
CVE-2024-27921 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version… |
CVE-2024-25937 | High | 8.8 | 2024-03-21 | SQL injection vulnerability exists in the script DIAE_tagHandler.ashx. |
CVE-2024-24272 | High | 7.1 | 2024-03-21 | An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked credentials as plai… |
CVE-2024-2767 | Medium | 6.3 | 2024-03-21 | A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This issue affects some unknown processi… |
CVE-2024-2766 | Medium | 6.3 | 2024-03-21 | A vulnerability has been found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This vulnerability affects unknown… |
CVE-2024-2764 | High | 8.8 | 2024-03-21 | A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.48. This affects the function formSetPPTPServer of the file /goform/SetPpt… |
CVE-2024-2763 | High | 8.8 | 2024-03-21 | A vulnerability, which was classified as critical, has been found in Tenda AC10U 15.03.06.48. Affected by this issue is the function formSetCfm of the file gof… |
CVE-2024-28756 | Medium | 5.9 | 2024-03-21 | The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (MitM) attacker to rea… |
CVE-2024-1727 | Medium | 4.3 | 2024-03-21 | A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running… |
CVE-2024-29374 | Medium | 6.1 | 2024-03-21 | A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter. |
CVE-2024-2580 | Medium | 6.5 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Automation By Autonami allows Stored XSS.This i… |
CVE-2024-2579 | Medium | 5.9 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Tracking Code Manager.This issue affects Tracking… |
CVE-2024-2578 | Medium | 5.9 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP… |
CVE-2024-29916 | Medium | 5.6 | 2024-03-21 | The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the att… |
CVE-2024-29180 | High | 7.4 | 2024-03-21 | Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficientl… |
CVE-2024-27968 | High | 7.1 | 2024-03-21 | Cross-Site Request Forgery (CSRF) vulnerability in Optimole Super Page Cache for Cloudflare allows Stored XSS.This issue affects Super Page Cache for Cloudflar… |
CVE-2024-27965 | Medium | 5.9 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnel… |
CVE-2024-27964 | High | 8.8 | 2024-03-21 | Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.9. |
CVE-2024-27963 | Medium | 6.5 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crisp allows Stored XSS.This issue affects Crisp: from n/… |
CVE-2024-27962 | High | 7.1 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Florian 'fkrauthan' Krauthan allows Reflected XSS.This is… |
CVE-2024-27956 | Critical | 9.9 | 2024-03-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affe… |