2024 CVEs (page 346)
Page 346 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2516 | Medium | 6.3 | 2024-03-16 | A vulnerability, which was classified as critical, was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. This affects an unknown part of th… |
CVE-2024-2515 | Low | 3.5 | 2024-03-16 | A vulnerability, which was classified as problematic, has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected by this issue is… |
CVE-2024-1857 | Medium | 5.3 | 2024-03-16 | The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress is vulnerable to S… |
CVE-2024-22513 | Medium | 5.5 | 2024-03-16 | djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their ac… |
CVE-2024-28640 | High | 7.5 | 2024-03-16 | Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause a denial of service… |
CVE-2024-28639 | Critical | 9.8 | 2024-03-16 | Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code and… |
CVE-2024-28070 | Medium | 6.8 | 2024-03-16 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected… |
CVE-2024-28069 | High | 7.5 | 2024-03-16 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct an informat… |
CVE-2024-24156 | Medium | 6.1 | 2024-03-16 | Cross Site Scripting (XSS) vulnerability in Gnuboard g6 before Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5, allows remote attackers execute arbitrar… |
CVE-2024-1733 | Medium | 5.3 | 2024-03-16 | The Word Replacer Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the word_replacer_ultra() fu… |
CVE-2024-1685 | High | 8.8 | 2024-03-16 | The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via deserialization of un… |
CVE-2024-24845 | Medium | 5.3 | 2024-03-16 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sewpafly Post Thumbnail Editor.This issue affects Post Thumbnail Editor: from n/a t… |
CVE-2024-23523 | Medium | 6.5 | 2024-03-16 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Elementor Pro.This issue affects Elementor Pro: from n/a through 3.19.2. |
CVE-2024-22259 | High | 8.1 | 2024-03-16 | Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation chec… |
CVE-2024-2042 | Medium | 6.4 | 2024-03-16 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and in… |
CVE-2024-1239 | Medium | 6.4 | 2024-03-16 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blog post read more button in all versions up to, an… |
CVE-2024-2308 | Medium | 6.4 | 2024-03-16 | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link in the EliSlider in all versions… |
CVE-2024-2294 | Medium | 4.9 | 2024-03-16 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the… |
CVE-2024-27197 | High | 7.1 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Bee BeePress allows Stored XSS.This issue affects BeePress: from n/a through 6.9.8. |
CVE-2024-27195 | High | 7.1 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in sverde1 Watermark RELOADED watermark-reloaded allows Cross Site Request Forgery.This issue affects Watermark… |
CVE-2024-27194 | High | 7.1 | 2024-03-16 | Cross-Site Request Forgery (CSRF) vulnerability in Andrei Ivasiuc Fontific | Google Fonts allows Stored XSS.This issue affects Fontific | Google Fonts: from n/… |
CVE-2024-28862 | Medium | 5.3 | 2024-03-16 | The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive d… |
CVE-2024-2514 | High | 7.3 | 2024-03-15 | A vulnerability classified as critical was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected by this vulnerability is an unknown f… |
CVE-2024-28859 | Medium | 5.0 | 2024-03-15 | Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony… |
CVE-2024-23298 | Medium | 5.5 | 2024-03-15 | A logic issue was addressed with improved state management. This issue is fixed in Xcode 15.3. An app may bypass Gatekeeper checks. |
CVE-2024-28848 | High | 8.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28847 | High | 8.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28255 | Critical | 9.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28254 | High | 8.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28253 | Critical | 9.4 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28242 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgroun… |
CVE-2024-27920 | High | 7.4 | 2024-03-15 | projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuc… |
CVE-2024-27351 | Medium | 5.3 | 2024-03-15 | In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_htm… |
CVE-2024-27100 | Medium | 6.5 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files… |
CVE-2024-27085 | Medium | 6.5 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data i… |
CVE-2024-24827 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry… |
CVE-2024-24748 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public categ… |
CVE-2024-28854 | High | 7.5 | 2024-03-15 | tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4… |
CVE-2024-28851 | Medium | 4.0 | 2024-03-15 | The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potent… |
CVE-2024-28252 | High | 7.5 | 2024-03-15 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service, extra system reso… |
CVE-2024-2537 | Medium | 4.4 | 2024-03-15 | Improper Control of Dynamically-Managed Code Resources vulnerability in Logitech Logi Tune on MacOS allows Local Code Inclusion. |
CVE-2024-2193 | Medium | 5.7 | 2024-03-15 | A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclo… |
CVE-2024-2497 | Medium | 4.7 | 2024-03-15 | A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.ph… |
CVE-2024-28404 | High | 8.0 | 2024-03-15 | TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page. |
CVE-2024-28401 | Medium | 5.4 | 2024-03-15 | TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wireless Page. |
CVE-2024-28403 | Medium | 5.4 | 2024-03-15 | TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page. |
CVE-2024-28319 | Medium | 6.2 | 2024-03-15 | gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/dash_client.c:6374 |
CVE-2024-28318 | High | 7.1 | 2024-03-15 | gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325 |
CVE-2024-25597 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This… |
CVE-2024-25596 | Medium | 5.9 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder for WooCommerce allows Stored XSS.Thi… |
CVE-2024-25593 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS… |
CVE-2024-25592 | Medium | 5.9 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue… |
CVE-2024-2495 | Medium | 5.2 | 2024-03-15 | Cryptographic key vulnerability encoded in the FriendlyWrt firmware affecting version 2022-11-16.51b3d35. This vulnerability could allow an attacker to comprom… |
CVE-2024-27196 | High | 7.1 | 2024-03-15 | Cross Site Scripting (XSS) vulnerability in Joel Starnes postMash – custom post order allows Reflected XSS.This issue affects postMash – custom post order: fro… |
CVE-2024-27193 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PayU India PayU India payu-india allows DOM-Based XSS.Thi… |
CVE-2024-27192 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Reilly Configure SMTP allows Reflected XSS.This iss… |
CVE-2024-27189 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget allows Stored XSS.This issue… |
CVE-2024-25936 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoundCloud Inc., Lawrie Malen SoundCloud Shortcode allows… |
CVE-2024-25934 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FormFacade allows Stored XSS.This issue affects FormFacad… |
CVE-2024-25921 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Concerted Action Action Network allows Reflected XSS.This… |
CVE-2024-25919 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS… |
CVE-2024-25916 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joseph C Dolson My Calendar allows Stored XSS.This issue… |
CVE-2024-25598 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for Elementor allows Stored XSS… |
CVE-2024-28752 | Critical | 9.3 | 2024-03-15 | A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on we… |
CVE-2024-27987 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a… |
CVE-2024-23944 | Medium | 5.3 | 2024-03-15 | Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching… |
CVE-2024-2490 | High | 8.8 | 2024-03-15 | A vulnerability classified as critical was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function setSchedWifi of the file /goform/ope… |
CVE-2024-2450 | High | 8.8 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switchi… |
CVE-2024-2446 | Medium | 4.3 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per me… |
CVE-2024-2445 | Medium | 6.1 | 2024-03-15 | Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to es… |
CVE-2024-2489 | High | 8.8 | 2024-03-15 | A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetQosBand of the file /goform/SetNetControlList… |
CVE-2024-2488 | High | 8.8 | 2024-03-15 | A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formSetPPTPServer of the file /goform/SetPp… |
CVE-2024-2487 | High | 8.8 | 2024-03-15 | A vulnerability was found in Tenda AC18 15.03.05.05. It has been declared as critical. This vulnerability affects the function formSetDeviceName of the file /g… |
CVE-2024-28053 | Low | 3.1 | 2024-03-15 | Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker t… |
CVE-2024-24975 | Low | 3.5 | 2024-03-15 | Uncontrolled Resource Consumption in Mattermost Mobile versions before 2.13.0 fails to limit the size of the code block that will be processed by the syntax hi… |
CVE-2024-2486 | High | 8.8 | 2024-03-15 | A vulnerability was found in Tenda AC18 15.03.05.05. It has been classified as critical. This affects the function formQuickIndex of the file /goform/QuickInde… |
CVE-2024-28354 | Critical | 10.0 | 2024-03-15 | There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post reque… |
CVE-2024-28353 | High | 8.8 | 2024-03-15 | There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post reque… |
CVE-2024-2485 | High | 8.8 | 2024-03-15 | A vulnerability was found in Tenda AC18 15.03.05.05 and classified as critical. Affected by this issue is the function formSetSpeedWan of the file /goform/SetS… |
CVE-2024-2483 | Medium | 4.3 | 2024-03-15 | A vulnerability, which was classified as problematic, has been found in Surya2Developer Hostel Management Service 1.0. This issue affects some unknown processi… |
CVE-2024-2482 | Low | 3.7 | 2024-03-15 | A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2024-2399 | Medium | 6.4 | 2024-03-15 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and includin… |
CVE-2024-27756 | High | 8.8 | 2024-03-15 | GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title. |
CVE-2024-1796 | Medium | 6.4 | 2024-03-15 | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'woof' shortcode in… |
CVE-2024-1795 | High | 8.8 | 2024-03-15 | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode in… |
CVE-2024-2481 | Medium | 6.5 | 2024-03-15 | A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0. Affected is an unknown function of the file /admi… |
CVE-2024-2480 | Medium | 6.3 | 2024-03-15 | A vulnerability classified as critical was found in MHA Sistemas arMHAzena 9.6.0.0. This vulnerability affects unknown code of the component Executa Page. The… |
CVE-2024-2479 | Low | 3.5 | 2024-03-15 | A vulnerability classified as problematic has been found in MHA Sistemas arMHAzena 9.6.0.0. This affects an unknown part of the component Cadastro Page. The ma… |
CVE-2024-2478 | Medium | 6.3 | 2024-03-15 | A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register o… |
CVE-2024-25227 | Critical | 9.8 | 2024-03-15 | SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, an… |
CVE-2024-2204 | Medium | 5.5 | 2024-03-15 | Zemana AntiLogger v2.74.204.664 is vulnerable to a Denial of Service (DoS) vulnerability by triggering the 0x80002004 and 0x80002010 IOCTL codes of the zam64.s… |
CVE-2024-2180 | Medium | 5.5 | 2024-03-15 | Zemana AntiLogger v2.74.204.664 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x80002020 IOCTL code of the zam64.sys and zamguard6… |
CVE-2024-26540 | High | 7.8 | 2024-03-15 | A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimg_library::CImg<unsigned char>::_load_analyze. |
CVE-2024-26454 | Medium | 5.4 | 2024-03-15 | A Cross Site Scripting vulnerability in Healthcare-Chatbot through 9b7058a can occur via a crafted payload to the email1 or pwd1 parameter in login.php. |
CVE-2024-1917 | Critical | 9.8 | 2024-03-15 | Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated… |
CVE-2024-1916 | Critical | 9.8 | 2024-03-15 | Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated… |
CVE-2024-1915 | Critical | 9.8 | 2024-03-15 | Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated atta… |
CVE-2024-0803 | Critical | 9.8 | 2024-03-15 | Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated… |
CVE-2024-0802 | Critical | 9.8 | 2024-03-15 | Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated atta… |
CVE-2024-26246 | Low | 3.9 | 2024-03-14 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |