2024 CVEs (page 341)
Page 341 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27290 | Medium | 6.1 | 2024-03-21 | Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including the field for the… |
CVE-2024-27105 | High | 8.1 | 2024-03-21 | Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less… |
CVE-2024-27094 | Medium | 6.5 | 2024-03-21 | OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks… |
CVE-2024-26196 | Medium | 4.3 | 2024-03-21 | Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-25811 | Medium | 6.5 | 2024-03-21 | An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information. |
CVE-2024-25359 | Medium | 6.6 | 2024-03-21 | An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle_load function of the serialize.py file. |
CVE-2024-25239 | Critical | 9.8 | 2024-03-21 | SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POST request to /emloy… |
CVE-2024-25167 | Medium | 6.1 | 2024-03-21 | Cross Site Scripting vulnerability in eblog v1.0 allows a remote attacker to execute arbitrary code via a crafted script to the argument description parameter… |
CVE-2024-24818 | Medium | 5.9 | 2024-03-21 | EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victi… |
CVE-2024-24813 | High | 7.5 | 2024-03-21 | Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access… |
CVE-2024-24520 | High | 7.8 | 2024-03-21 | An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place. |
CVE-2024-24110 | Medium | 6.5 | 2024-03-21 | SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the component /api/front/spre… |
CVE-2024-24028 | Medium | 5.9 | 2024-03-21 | Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function U… |
CVE-2024-22352 | Medium | 6.5 | 2024-03-21 | IBM InfoSphere Information Server 11.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 280361. |
CVE-2024-1908 | Medium | 6.3 | 2024-03-21 | An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect… |
CVE-2024-1503 | Medium | 4.3 | 2024-03-21 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6… |
CVE-2024-1502 | Medium | 5.4 | 2024-03-21 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the t… |
CVE-2024-1450 | Medium | 6.4 | 2024-03-21 | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including… |
CVE-2024-1326 | Medium | 6.4 | 2024-03-21 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tag attributes in all versions up to, and including, 2.6.2 due… |
CVE-2024-1278 | Medium | 6.4 | 2024-03-21 | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'efb_lik… |
CVE-2024-1214 | Medium | 4.3 | 2024-03-21 | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and… |
CVE-2024-1213 | Medium | 5.4 | 2024-03-21 | The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and… |
CVE-2024-1202 | Critical | 9.8 | 2024-03-21 | Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass. This issue affects Octopod: before v1. NOTE: The ven… |
CVE-2024-1142 | Medium | 5.4 | 2024-03-21 | Path Traversal in Sonatype IQ Server from version 143 allows remote authenticated attackers to overwrite or delete files via a specially crafted request. Versi… |
CVE-2024-0966 | Medium | 6.4 | 2024-03-21 | The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including… |
CVE-2024-2748 | Medium | 4.3 | 2024-03-21 | A Cross Site Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker to execute unauthorized actions on behalf of an… |
CVE-2024-28916 | High | 8.8 | 2024-03-21 | Xbox Gaming Services Elevation of Privilege Vulnerability |
CVE-2024-2469 | High | 8.0 | 2024-03-20 | An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Ent… |
CVE-2024-2443 | Critical | 9.1 | 2024-03-20 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-2720 | Low | 3.5 | 2024-03-20 | A vulnerability classified as problematic was found in Campcodes Complete Online DJ Booking System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2024-29026 | High | 8.2 | 2024-03-20 | Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy all… |
CVE-2024-24050 | Medium | 4.7 | 2024-03-20 | Cross Site Scripting (XSS) vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary code via parameters firstname and lastname… |
CVE-2024-2719 | Low | 3.5 | 2024-03-20 | A vulnerability classified as problematic has been found in Campcodes Complete Online DJ Booking System 1.0. Affected is an unknown function of the file /admin… |
CVE-2024-2718 | Low | 3.5 | 2024-03-20 | A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been rated as problematic. This issue affects some unknown processing of t… |
CVE-2024-2717 | Low | 3.5 | 2024-03-20 | A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been declared as problematic. This vulnerability affects unknown code of t… |
CVE-2024-29474 | Medium | 5.4 | 2024-03-20 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Management module. |
CVE-2024-29473 | Medium | 6.1 | 2024-03-20 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Role Management module. |
CVE-2024-29472 | Medium | 5.4 | 2024-03-20 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Privilege Management module. |
CVE-2024-29471 | Medium | 5.4 | 2024-03-20 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notice Manage module. |
CVE-2024-29470 | Medium | 6.1 | 2024-03-20 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component {{rootpath}}/links. |
CVE-2024-29469 | Medium | 6.1 | 2024-03-20 | A stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2024-29037 | Critical | 9.1 | 2024-03-20 | datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to v… |
CVE-2024-29036 | Medium | 4.3 | 2024-03-20 | Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the… |
CVE-2024-29033 | High | 7.5 | 2024-03-20 | OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 p… |
CVE-2024-29032 | Medium | 5.3 | 2024-03-20 | Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum computing SDK. Starting i… |
CVE-2024-29018 | Medium | 5.9 | 2024-03-20 | Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes… |
CVE-2024-25294 | Critical | 9.1 | 2024-03-20 | An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload,U… |
CVE-2024-2716 | Low | 3.5 | 2024-03-20 | A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been classified as problematic. This affects an unknown part of the file /… |
CVE-2024-2715 | Low | 3.5 | 2024-03-20 | A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0 and classified as problematic. Affected by this issue is some unknown functionalit… |
CVE-2024-2714 | Medium | 6.3 | 2024-03-20 | A vulnerability has been found in Campcodes Complete Online DJ Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-28868 | Low | 3.7 | 2024-03-20 | Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration… |
CVE-2024-28231 | Critical | 9.6 | 2024-03-20 | eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.14.0, 2.13.4, 2.12.3, 2… |
CVE-2024-28179 | Critical | 9.0 | 2024-03-20 | Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to… |
CVE-2024-27286 | Medium | 6.5 | 2024-03-20 | Zulip is an open-source team collaboration tool. When a user moves a Zulip message, they have the option to move all messages in the topic, move only subsequen… |
CVE-2024-23721 | High | 7.5 | 2024-03-20 | A Directory Traversal issue was discovered in process_post on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and… |
CVE-2024-2711 | High | 8.8 | 2024-03-20 | A vulnerability was found in Tenda AC10U 15.03.06.48. It has been rated as critical. Affected by this issue is the function addWifiMacFilter of the file /gofor… |
CVE-2024-2710 | High | 8.8 | 2024-03-20 | A vulnerability was found in Tenda AC10U 15.03.06.49. It has been declared as critical. Affected by this vulnerability is the function setSchedWifi of the file… |
CVE-2024-2709 | High | 8.8 | 2024-03-20 | A vulnerability was found in Tenda AC10U 15.03.06.49. It has been classified as critical. Affected is the function fromSetRouteStatic of the file /goform/SetSt… |
CVE-2024-2708 | High | 8.8 | 2024-03-20 | A vulnerability was found in Tenda AC10U 15.03.06.49 and classified as critical. This issue affects the function formexeCommand of the file /goform/execCommand… |
CVE-2024-23821 | Medium | 4.8 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerabil… |
CVE-2024-23819 | Medium | 4.8 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerabil… |
CVE-2024-23818 | Medium | 4.8 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerabil… |
CVE-2024-23643 | Medium | 4.8 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerabil… |
CVE-2024-23642 | Medium | 4.8 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerabil… |
CVE-2024-2707 | Medium | 6.3 | 2024-03-20 | A vulnerability has been found in Tenda AC10U 15.03.06.49 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /gofo… |
CVE-2024-2706 | High | 8.8 | 2024-03-20 | A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.49. This affects the function formWifiWpsStart of the file /goform/WifiWps… |
CVE-2024-2705 | High | 8.8 | 2024-03-20 | A vulnerability, which was classified as critical, has been found in Tenda AC10U 1.0/15.03.06.49. Affected by this issue is the function formSetQosBand of the… |
CVE-2024-2631 | Medium | 4.3 | 2024-03-20 | Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2024-2630 | Medium | 6.5 | 2024-03-20 | Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2024-2629 | Medium | 4.3 | 2024-03-20 | Incorrect security UI in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium securi… |
CVE-2024-2628 | Medium | 4.3 | 2024-03-20 | Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted URL. (Chromium… |
CVE-2024-2627 | High | 8.8 | 2024-03-20 | Use after free in Canvas in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2024-2626 | Medium | 6.5 | 2024-03-20 | Out of bounds read in Swiftshader in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a crafted HTML p… |
CVE-2024-2625 | High | 8.8 | 2024-03-20 | Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page… |
CVE-2024-2704 | High | 8.8 | 2024-03-20 | A vulnerability classified as critical was found in Tenda AC10U 15.03.06.49. Affected by this vulnerability is the function formSetFirewallCfg of the file /gof… |
CVE-2024-2703 | High | 8.8 | 2024-03-20 | A vulnerability classified as critical has been found in Tenda AC10U 15.03.06.49. Affected is the function formSetDeviceName of the file /goform/SetOnlineDevNa… |
CVE-2024-23640 | Medium | 4.8 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerabil… |
CVE-2024-23634 | Medium | 6.0 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file renaming vulnerability exist… |
CVE-2024-2291 | Medium | 4.3 | 2024-03-20 | In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerab… |
CVE-2024-29419 | Medium | 5.4 | 2024-03-20 | There is a Cross-site scripting (XSS) vulnerability in the Wireless settings under the Easy Setup Page of TOTOLINK X2000R before v1.0.0-B20231213.1013. |
CVE-2024-28735 | High | 8.1 | 2024-03-20 | Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user… |
CVE-2024-28396 | High | 7.5 | 2024-03-20 | An issue in MyPrestaModules ordersexport v.6.0.2 and before allows a remote attacker to execute arbitrary code via the download.php component. |
CVE-2024-28395 | Critical | 9.8 | 2024-03-20 | SQL injection vulnerability in Best-Kit bestkit_popup v.1.7.2 and before allows a remote attacker to escalate privileges via the bestkit_popup.php component. |
CVE-2024-28392 | Critical | 9.8 | 2024-03-20 | SQL injection vulnerability in pscartabandonmentpro v.2.0.11 and before allows a remote attacker to escalate privileges via the pscartabandonmentproFrontCAPUns… |
CVE-2024-1856 | High | 8.5 | 2024-03-20 | In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure dese… |
CVE-2024-1811 | Critical | 9.8 | 2024-03-20 | A potential vulnerability has been identified in OpenText ArcSight Platform. The vulnerability could be remotely exploited. |
CVE-2024-1801 | High | 7.7 | 2024-03-20 | In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a local threat actor through an insecure deser… |
CVE-2024-1800 | Critical | 9.9 | 2024-03-20 | In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vu… |
CVE-2024-2721 | High | 8.2 | 2024-03-20 | Deserialization of Untrusted Data vulnerability in Social Media Share Buttons By Sygnoos Social Media Share Buttons.This issue affects Social Media Share Butto… |
CVE-2024-2702 | High | 8.2 | 2024-03-20 | Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import allows importing settings and data, ultimately leading to XSS.This issue affect… |
CVE-2024-2690 | Medium | 6.3 | 2024-03-20 | A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been classified as critical. Affected is an unknown function of the file /… |
CVE-2024-2687 | Medium | 6.3 | 2024-03-20 | A vulnerability was found in Campcodes Online Job Finder System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/a… |
CVE-2024-2686 | Low | 3.5 | 2024-03-20 | A vulnerability has been found in Campcodes Online Job Finder System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /ad… |
CVE-2024-2685 | Low | 3.5 | 2024-03-20 | A vulnerability, which was classified as problematic, was found in Campcodes Online Job Finder System 1.0. This affects an unknown part of the file /admin/appl… |
CVE-2024-2684 | Low | 3.5 | 2024-03-20 | A vulnerability, which was classified as problematic, has been found in Campcodes Online Job Finder System 1.0. Affected by this issue is some unknown function… |
CVE-2024-2683 | Low | 3.5 | 2024-03-20 | A vulnerability classified as problematic was found in Campcodes Online Job Finder System 1.0. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-2682 | Low | 3.5 | 2024-03-20 | A vulnerability classified as problematic has been found in Campcodes Online Job Finder System 1.0. Affected is an unknown function of the file /admin/employee… |
CVE-2024-2681 | Low | 3.5 | 2024-03-20 | A vulnerability was found in Campcodes Online Job Finder System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /… |
CVE-2024-2680 | Low | 3.5 | 2024-03-20 | A vulnerability was found in Campcodes Online Job Finder System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /… |
CVE-2024-2679 | Low | 3.5 | 2024-03-20 | A vulnerability was found in Campcodes Online Job Finder System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/vac… |