2024 CVEs (page 340)
Page 340 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27277 | Medium | 6.2 | 2024-03-21 | The private key for the IBM Storage Protect Plus Server 10.1.0 through 10.1.16 certificate can be disclosed, undermining the security of the certificate. IBM… |
CVE-2024-27190 | Medium | 4.3 | 2024-03-21 | Missing Authorization vulnerability in Jean-David Daviet Download Media.This issue affects Download Media: from n/a through 1.4.2. |
CVE-2024-2465 | High | 7.1 | 2024-03-21 | Open redirection vulnerability in CDeX application allows to redirect users to arbitrary websites via a specially crafted URL.This issue affects CDeX applicati… |
CVE-2024-2464 | Medium | 6.3 | 2024-03-21 | This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute f… |
CVE-2024-2463 | High | 8.0 | 2024-03-21 | Weak password recovery mechanism in CDeX application allows to retrieve password reset token.This issue affects CDeX application versions through 5.7.1. |
CVE-2024-29244 | Medium | 5.3 | 2024-03-21 | Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the pin_code_3g parameter at /apply.cgi. |
CVE-2024-29243 | Critical | 9.8 | 2024-03-21 | Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the vpn_client_ip parameter at /apply.cgi. |
CVE-2024-27995 | Medium | 5.9 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Repute Infosystems ARMember – Membership Plugin, Content… |
CVE-2024-27994 | High | 7.1 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerc… |
CVE-2024-27993 | High | 7.1 | 2024-03-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in typps Calendarista Basic Edition calendarista-basic-editi… |
CVE-2024-2494 | Medium | 6.2 | 2024-03-21 | A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is pe… |
CVE-2024-29880 | Medium | 4.2 | 2024-03-21 | In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process |
CVE-2024-29879 | High | 7.1 | 2024-03-21 | Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter. The exp… |
CVE-2024-29878 | High | 7.1 | 2024-03-21 | Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/sitepreference/add, 'description' parameter. The exploitation of th… |
CVE-2024-29877 | High | 7.1 | 2024-03-21 | Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/expenses/expensecategories/edit, 'expense_category_name' parameter… |
CVE-2024-29876 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/activitylogreport, 'sortby' parameter. The exploitation of this vulnerab… |
CVE-2024-29875 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sort_name' parameter. The exploitation of t… |
CVE-2024-29874 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/activeuserrptpdf, 'sort_name' parameter. The exploitation of this… |
CVE-2024-29873 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/businessunits/format/html, 'bunitname' parameter. The exploitation of this… |
CVE-2024-29872 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/empscreening/add, 'agencyids' parameter. The exploitation of this vulnerability co… |
CVE-2024-29871 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/sentrifugo/index.php/index/updatecontactnumber, 'id' paramete… |
CVE-2024-29870 | Critical | 9.8 | 2024-03-21 | SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter./sentrifugo/index.php/in… |
CVE-2024-29866 | Critical | 9.1 | 2024-03-21 | Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can escalate to System… |
CVE-2024-28834 | Medium | 5.3 | 2024-03-21 | A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-ch… |
CVE-2024-1394 | High | 7.5 | 2024-03-21 | A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled… |
CVE-2024-29732 | Critical | 9.8 | 2024-03-21 | A SQL Injection has been found on SCAN_VISIO eDocument Suite Web Viewer of Abast. This vulnerability allows an unauthenticated user to retrieve, update and del… |
CVE-2024-26643 | High | 7.8 | 2024-03-21 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While th… |
CVE-2024-26642 | High | 7.8 | 2024-03-21 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never u… |
CVE-2024-27438 | Critical | 9.8 | 2024-03-21 | Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote… |
CVE-2024-26307 | Medium | 5.3 | 2024-03-21 | Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming the file out from unde… |
CVE-2024-29133 | Medium | 5.4 | 2024-03-21 | Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommend… |
CVE-2024-29131 | High | 7.3 | 2024-03-21 | Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommend… |
CVE-2024-1148 | Critical | 9.8 | 2024-03-21 | Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and uploading of files. |
CVE-2024-1147 | Critical | 9.8 | 2024-03-21 | Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and download of files. |
CVE-2024-2754 | Medium | 4.7 | 2024-03-21 | A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_… |
CVE-2024-2162 | High | 8.8 | 2024-03-21 | An OS Command Injection vulnerability in Kiloview NDI allows a low-privileged user to execute arbitrary code remotely on the device with high privileges. This… |
CVE-2024-2161 | Critical | 9.8 | 2024-03-21 | Use of Hard-coded Credentials in Kiloview NDI allows un-authenticated users to bypass authenticationThis issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40… |
CVE-2024-28835 | Medium | 5.0 | 2024-03-21 | A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --… |
CVE-2024-29864 | Critical | 9.8 | 2024-03-21 | Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables. |
CVE-2024-29862 | High | 7.5 | 2024-03-21 | The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when… |
CVE-2024-29859 | Critical | 9.8 | 2024-03-21 | In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. |
CVE-2024-29858 | Critical | 9.8 | 2024-03-21 | In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. |
CVE-2024-28635 | Medium | 6.1 | 2024-03-21 | Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive infor… |
CVE-2024-22724 | Medium | 6.6 | 2024-03-21 | An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo… |
CVE-2024-1538 | High | 8.8 | 2024-03-21 | The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorr… |
CVE-2024-2713 | Medium | 6.3 | 2024-03-21 | A vulnerability, which was classified as critical, was found in Campcodes Complete Online DJ Booking System 1.0. Affected is an unknown function of the file /a… |
CVE-2024-2712 | Medium | 6.3 | 2024-03-21 | A vulnerability, which was classified as critical, has been found in Campcodes Complete Online DJ Booking System 1.0. This issue affects some unknown processin… |
CVE-2024-2054 | Critical | 9.8 | 2024-03-21 | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution… |
CVE-2024-2053 | High | 7.5 | 2024-03-21 | The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution… |
CVE-2024-2016 | Medium | 6.3 | 2024-03-21 | A vulnerability, which was classified as critical, was found in ZhiCms 4.0. Affected is the function index of the file app/manage/controller/setcontroller.php… |
CVE-2024-2015 | Medium | 6.3 | 2024-03-21 | A vulnerability, which was classified as critical, has been found in ZhiCms 4.0. This issue affects the function getindexdata of the file app/index/controller/… |
CVE-2024-2014 | High | 7.3 | 2024-03-21 | A vulnerability classified as critical was found in Panabit Panalog 202103080942. This vulnerability affects unknown code of the file /Maintain/sprog_upstatus… |
CVE-2024-2007 | Medium | 5.3 | 2024-03-21 | A vulnerability was found in OpenBMB XAgent 1.0.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the componen… |
CVE-2024-28286 | High | 7.5 | 2024-03-21 | In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c function of src/mms/iso_mms/server/mms_f… |
CVE-2024-28123 | High | 7.3 | 2024-03-21 | Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buff… |
CVE-2024-28102 | Medium | 6.8 | 2024-03-21 | JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by pas… |
CVE-2024-28101 | High | 7.5 | 2024-03-21 | The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Den… |
CVE-2024-27936 | High | 8.8 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, mal… |
CVE-2024-27935 | High | 7.2 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibil… |
CVE-2024-27934 | High | 8.4 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c_void` and… |
CVE-2024-27933 | High | 8.2 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of a… |
CVE-2024-27932 | Medium | 4.6 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifi… |
CVE-2024-27927 | Medium | 6.5 | 2024-03-21 | RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GE… |
CVE-2024-27926 | Medium | 6.1 | 2024-03-21 | RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted ima… |
CVE-2024-27923 | High | 8.8 | 2024-03-21 | Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission… |
CVE-2024-27922 | Critical | 9.8 | 2024-03-21 | TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp… |
CVE-2024-27918 | High | 8.2 | 2024-03-21 | Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OI… |
CVE-2024-27916 | High | 7.1 | 2024-03-21 | Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByNam… |
CVE-2024-27626 | Medium | 6.1 | 2024-03-21 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists within the Search functionality of the Admin… |
CVE-2024-27292 | High | 7.5 | 2024-03-21 | Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on t… |
CVE-2024-27291 | Medium | 6.1 | 2024-03-21 | Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, it is possible to create a URL that acts as an open redirect. The… |
CVE-2024-27290 | Medium | 6.1 | 2024-03-21 | Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including the field for the… |
CVE-2024-27105 | High | 8.1 | 2024-03-21 | Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less… |
CVE-2024-27094 | Medium | 6.5 | 2024-03-21 | OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks… |
CVE-2024-26196 | Medium | 4.3 | 2024-03-21 | Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-25811 | Medium | 6.5 | 2024-03-21 | An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information. |
CVE-2024-25359 | Medium | 6.6 | 2024-03-21 | An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle_load function of the serialize.py file. |
CVE-2024-25239 | Critical | 9.8 | 2024-03-21 | SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POST request to /emloy… |
CVE-2024-25167 | Medium | 6.1 | 2024-03-21 | Cross Site Scripting vulnerability in eblog v1.0 allows a remote attacker to execute arbitrary code via a crafted script to the argument description parameter… |
CVE-2024-24818 | Medium | 5.9 | 2024-03-21 | EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victi… |
CVE-2024-24813 | High | 7.5 | 2024-03-21 | Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access… |
CVE-2024-24520 | High | 7.8 | 2024-03-21 | An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place. |
CVE-2024-24110 | Medium | 6.5 | 2024-03-21 | SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the component /api/front/spre… |
CVE-2024-24028 | Medium | 5.9 | 2024-03-21 | Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function U… |
CVE-2024-22352 | Medium | 6.5 | 2024-03-21 | IBM InfoSphere Information Server 11.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 280361. |
CVE-2024-1908 | Medium | 6.3 | 2024-03-21 | An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect… |
CVE-2024-1503 | Medium | 4.3 | 2024-03-21 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6… |
CVE-2024-1502 | Medium | 5.4 | 2024-03-21 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the t… |
CVE-2024-1450 | Medium | 6.4 | 2024-03-21 | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including… |
CVE-2024-1326 | Medium | 6.4 | 2024-03-21 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tag attributes in all versions up to, and including, 2.6.2 due… |
CVE-2024-1278 | Medium | 6.4 | 2024-03-21 | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'efb_lik… |
CVE-2024-1214 | Medium | 4.3 | 2024-03-21 | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and… |
CVE-2024-1213 | Medium | 5.4 | 2024-03-21 | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and… |
CVE-2024-1202 | Critical | 9.8 | 2024-03-21 | Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass. This issue affects Octopod: before v1. NOTE: The ven… |
CVE-2024-1142 | Medium | 5.4 | 2024-03-21 | Path Traversal in Sonatype IQ Server from version 143 allows remote authenticated attackers to overwrite or delete files via a specially crafted request. Versi… |
CVE-2024-0966 | Medium | 6.4 | 2024-03-21 | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including… |
CVE-2024-2748 | Medium | 4.3 | 2024-03-21 | A Cross Site Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker to execute unauthorized actions on behalf of an… |
CVE-2024-28916 | High | 8.8 | 2024-03-21 | Xbox Gaming Services Elevation of Privilege Vulnerability |
CVE-2024-2469 | High | 8.0 | 2024-03-20 | An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Ent… |
CVE-2024-2443 | Critical | 9.1 | 2024-03-20 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |