2024 CVEs (page 340)
Page 340 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2768 | Medium | 6.3 | 2024-03-21 | A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been classified as critical. Affected is an unknown function… |
CVE-2024-28891 | High | 8.8 | 2024-03-21 | SQL injection vulnerability exists in the script Handler_CFG.ashx. |
CVE-2024-28521 | High | 7.8 | 2024-03-21 | SQL Injection vulnerability in Netcome NS-ASG Application Security Gateway v.6.3.1 allows a local attacker to execute arbitrary code and obtain sensitive infor… |
CVE-2024-28119 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context… |
CVE-2024-28118 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context… |
CVE-2024-28117 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunctio… |
CVE-2024-28116 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which a… |
CVE-2024-28029 | High | 8.8 | 2024-03-21 | Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionalit… |
CVE-2024-27921 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version… |
CVE-2024-25937 | High | 8.8 | 2024-03-21 | SQL injection vulnerability exists in the script DIAE_tagHandler.ashx. |
CVE-2024-24272 | High | 7.1 | 2024-03-21 | An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked credentials as plai… |
CVE-2024-2767 | Medium | 6.3 | 2024-03-21 | A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This issue affects some unknown processi… |
CVE-2024-2766 | Medium | 6.3 | 2024-03-21 | A vulnerability has been found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This vulnerability affects unknown… |
CVE-2024-2764 | High | 8.8 | 2024-03-21 | A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.48. This affects the function formSetPPTPServer of the file /goform/SetPpt… |
CVE-2024-2763 | High | 8.8 | 2024-03-21 | A vulnerability, which was classified as critical, has been found in Tenda AC10U 15.03.06.48. Affected by this issue is the function formSetCfm of the file gof… |
CVE-2024-28756 | Medium | 5.9 | 2024-03-21 | The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (MitM) attacker to rea… |
CVE-2024-1727 | Medium | 4.3 | 2024-03-21 | A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running… |
CVE-2024-29374 | Medium | 6.1 | 2024-03-21 | A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter. |
CVE-2024-2580 | Medium | 6.5 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Automation By Autonami allows Stored XSS.This i… |
CVE-2024-2579 | Medium | 5.9 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Tracking Code Manager.This issue affects Tracking… |
CVE-2024-2578 | Medium | 5.9 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP… |
CVE-2024-29916 | Medium | 5.6 | 2024-03-21 | The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the att… |
CVE-2024-29180 | High | 7.4 | 2024-03-21 | Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficientl… |
CVE-2024-27968 | High | 7.1 | 2024-03-21 | Cross-Site Request Forgery (CSRF) vulnerability in Optimole Super Page Cache for Cloudflare allows Stored XSS.This issue affects Super Page Cache for Cloudflar… |
CVE-2024-27965 | Medium | 5.9 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnel… |
CVE-2024-27964 | High | 8.8 | 2024-03-21 | Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.9. |
CVE-2024-27963 | Medium | 6.5 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crisp allows Stored XSS.This issue affects Crisp: from n/… |
CVE-2024-27962 | High | 7.1 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Florian 'fkrauthan' Krauthan allows Reflected XSS.This is… |
CVE-2024-27956 | Critical | 9.9 | 2024-03-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affe… |
CVE-2024-27277 | Medium | 6.2 | 2024-03-21 | The private key for the IBM Storage Protect Plus Server 10.1.0 through 10.1.16 certificate can be disclosed, undermining the security of the certificate. IBM… |
CVE-2024-27190 | Medium | 4.3 | 2024-03-21 | Missing Authorization vulnerability in Jean-David Daviet Download Media.This issue affects Download Media: from n/a through 1.4.2. |
CVE-2024-2465 | High | 7.1 | 2024-03-21 | Open redirection vulnerability in CDeX application allows to redirect users to arbitrary websites via a specially crafted URL.This issue affects CDeX applicati… |
CVE-2024-2464 | Medium | 6.3 | 2024-03-21 | This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute f… |
CVE-2024-2463 | High | 8.0 | 2024-03-21 | Weak password recovery mechanism in CDeX application allows to retrieve password reset token.This issue affects CDeX application versions through 5.7.1. |
CVE-2024-29244 | Medium | 5.3 | 2024-03-21 | Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the pin_code_3g parameter at /apply.cgi. |
CVE-2024-29243 | Critical | 9.8 | 2024-03-21 | Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the vpn_client_ip parameter at /apply.cgi. |
CVE-2024-27995 | Medium | 5.9 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Repute Infosystems ARMember – Membership Plugin, Content… |
CVE-2024-27994 | High | 7.1 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerc… |
CVE-2024-27993 | High | 7.1 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in typps Calendarista Basic Edition calendarista-basic-editi… |
CVE-2024-2494 | Medium | 6.2 | 2024-03-21 | A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is pe… |
CVE-2024-29880 | Medium | 4.2 | 2024-03-21 | In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process |
CVE-2024-29879 | High | 7.1 | 2024-03-21 | Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter. The exp… |
CVE-2024-29878 | High | 7.1 | 2024-03-21 | Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/sitepreference/add, 'description' parameter. The exploitation of th… |
CVE-2024-29877 | High | 7.1 | 2024-03-21 | Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/expenses/expensecategories/edit, 'expense_category_name' parameter… |
CVE-2024-29876 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/activitylogreport, 'sortby' parameter. The exploitation of this vulnerab… |
CVE-2024-29875 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sort_name' parameter. The exploitation of t… |
CVE-2024-29874 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/activeuserrptpdf, 'sort_name' parameter. The exploitation of this… |
CVE-2024-29873 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/businessunits/format/html, 'bunitname' parameter. The exploitation of this… |
CVE-2024-29872 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/empscreening/add, 'agencyids' parameter. The exploitation of this vulnerability co… |
CVE-2024-29871 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/sentrifugo/index.php/index/updatecontactnumber, 'id' paramete… |
CVE-2024-29870 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter./sentrifugo/index.php/in… |
CVE-2024-29866 | Critical | 9.1 | 2024-03-21 | Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can escalate to System… |
CVE-2024-28834 | Medium | 5.3 | 2024-03-21 | A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-ch… |
CVE-2024-1394 | High | 7.5 | 2024-03-21 | A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled… |
CVE-2024-29732 | Critical | 9.8 | 2024-03-21 | A SQL Injection has been found on SCAN_VISIO eDocument Suite Web Viewer of Abast. This vulnerability allows an unauthenticated user to retrieve, update and del… |
CVE-2024-26643 | High | 7.8 | 2024-03-21 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While th… |
CVE-2024-26642 | High | 7.8 | 2024-03-21 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never u… |
CVE-2024-27438 | Critical | 9.8 | 2024-03-21 | Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote… |
CVE-2024-26307 | Medium | 5.3 | 2024-03-21 | Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming the file out from unde… |
CVE-2024-29133 | Medium | 5.4 | 2024-03-21 | Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommend… |
CVE-2024-29131 | High | 7.3 | 2024-03-21 | Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommend… |
CVE-2024-1148 | Critical | 9.8 | 2024-03-21 | Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and uploading of files. |
CVE-2024-1147 | Critical | 9.8 | 2024-03-21 | Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and download of files. |
CVE-2024-2754 | Medium | 4.7 | 2024-03-21 | A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_… |
CVE-2024-2162 | High | 8.8 | 2024-03-21 | An OS Command Injection vulnerability in Kiloview NDI allows a low-privileged user to execute arbitrary code remotely on the device with high privileges. This… |
CVE-2024-2161 | Critical | 9.8 | 2024-03-21 | Use of Hard-coded Credentials in Kiloview NDI allows un-authenticated users to bypass authenticationThis issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40… |
CVE-2024-28835 | Medium | 5.0 | 2024-03-21 | A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --… |
CVE-2024-29864 | Critical | 9.8 | 2024-03-21 | Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables. |
CVE-2024-29862 | High | 7.5 | 2024-03-21 | The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when… |
CVE-2024-29859 | Critical | 9.8 | 2024-03-21 | In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. |
CVE-2024-29858 | Critical | 9.8 | 2024-03-21 | In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. |
CVE-2024-28635 | Medium | 6.1 | 2024-03-21 | Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive infor… |
CVE-2024-22724 | Medium | 6.6 | 2024-03-21 | An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo… |
CVE-2024-1538 | High | 8.8 | 2024-03-21 | The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorr… |
CVE-2024-2713 | Medium | 6.3 | 2024-03-21 | A vulnerability, which was classified as critical, was found in Campcodes Complete Online DJ Booking System 1.0. Affected is an unknown function of the file /a… |
CVE-2024-2712 | Medium | 6.3 | 2024-03-21 | A vulnerability, which was classified as critical, has been found in Campcodes Complete Online DJ Booking System 1.0. This issue affects some unknown processin… |
CVE-2024-2054 | Critical | 9.8 | 2024-03-21 | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution… |
CVE-2024-2053 | High | 7.5 | 2024-03-21 | The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution… |
CVE-2024-2016 | Medium | 6.3 | 2024-03-21 | A vulnerability, which was classified as critical, was found in ZhiCms 4.0. Affected is the function index of the file app/manage/controller/setcontroller.php… |
CVE-2024-2015 | Medium | 6.3 | 2024-03-21 | A vulnerability, which was classified as critical, has been found in ZhiCms 4.0. This issue affects the function getindexdata of the file app/index/controller/… |
CVE-2024-2014 | High | 7.3 | 2024-03-21 | A vulnerability classified as critical was found in Panabit Panalog 202103080942. This vulnerability affects unknown code of the file /Maintain/sprog_upstatus… |
CVE-2024-2007 | Medium | 5.3 | 2024-03-21 | A vulnerability was found in OpenBMB XAgent 1.0.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the componen… |
CVE-2024-28286 | High | 7.5 | 2024-03-21 | In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c function of src/mms/iso_mms/server/mms_f… |
CVE-2024-28123 | High | 7.3 | 2024-03-21 | Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buff… |
CVE-2024-28102 | Medium | 6.8 | 2024-03-21 | JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by pas… |
CVE-2024-28101 | High | 7.5 | 2024-03-21 | The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Den… |
CVE-2024-27936 | High | 8.8 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, mal… |
CVE-2024-27935 | High | 7.2 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibil… |
CVE-2024-27934 | High | 8.4 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c_void` and… |
CVE-2024-27933 | High | 8.2 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of a… |
CVE-2024-27932 | Medium | 4.6 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifi… |
CVE-2024-27927 | Medium | 6.5 | 2024-03-21 | RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GE… |
CVE-2024-27926 | Medium | 6.1 | 2024-03-21 | RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted ima… |
CVE-2024-27923 | High | 8.8 | 2024-03-21 | Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission… |
CVE-2024-27922 | Critical | 9.8 | 2024-03-21 | TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp… |
CVE-2024-27918 | High | 8.2 | 2024-03-21 | Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OI… |
CVE-2024-27916 | High | 7.1 | 2024-03-21 | Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByNam… |
CVE-2024-27626 | Medium | 6.1 | 2024-03-21 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists within the Search functionality of the Admin… |
CVE-2024-27292 | High | 7.5 | 2024-03-21 | Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on t… |
CVE-2024-27291 | Medium | 6.1 | 2024-03-21 | Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, it is possible to create a URL that acts as an open redirect. The… |