2024 CVEs (page 346)
Page 346 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-28253 | Critical | 9.4 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28242 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgroun… |
CVE-2024-27920 | High | 7.4 | 2024-03-15 | projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuc… |
CVE-2024-27351 | Medium | 5.3 | 2024-03-15 | In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_htm… |
CVE-2024-27100 | Medium | 6.5 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files… |
CVE-2024-27085 | Medium | 6.5 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data i… |
CVE-2024-24827 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry… |
CVE-2024-24748 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public categ… |
CVE-2024-28854 | High | 7.5 | 2024-03-15 | tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4… |
CVE-2024-28851 | Medium | 4.0 | 2024-03-15 | The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potent… |
CVE-2024-28252 | High | 7.5 | 2024-03-15 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service, extra system reso… |
CVE-2024-2537 | Medium | 4.4 | 2024-03-15 | Improper Control of Dynamically-Managed Code Resources vulnerability in Logitech Logi Tune on MacOS allows Local Code Inclusion. |
CVE-2024-2193 | Medium | 5.7 | 2024-03-15 | A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclo… |
CVE-2024-2497 | Medium | 4.7 | 2024-03-15 | A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.ph… |
CVE-2024-28404 | High | 8.0 | 2024-03-15 | TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page. |
CVE-2024-28401 | Medium | 5.4 | 2024-03-15 | TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wireless Page. |
CVE-2024-28403 | Medium | 5.4 | 2024-03-15 | TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page. |
CVE-2024-28319 | Medium | 6.2 | 2024-03-15 | gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/dash_client.c:6374 |
CVE-2024-28318 | High | 7.1 | 2024-03-15 | gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325 |
CVE-2024-25597 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This… |
CVE-2024-25596 | Medium | 5.9 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder for WooCommerce allows Stored XSS.Thi… |
CVE-2024-25593 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS… |
CVE-2024-25592 | Medium | 5.9 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue… |
CVE-2024-2495 | Medium | 5.2 | 2024-03-15 | Cryptographic key vulnerability encoded in the FriendlyWrt firmware affecting version 2022-11-16.51b3d35. This vulnerability could allow an attacker to comprom… |
CVE-2024-27196 | High | 7.1 | 2024-03-15 | Cross Site Scripting (XSS) vulnerability in Joel Starnes postMash – custom post order allows Reflected XSS.This issue affects postMash – custom post order: fro… |
CVE-2024-27193 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PayU India PayU India payu-india allows DOM-Based XSS.Thi… |
CVE-2024-27192 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Reilly Configure SMTP allows Reflected XSS.This iss… |
CVE-2024-27189 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget allows Stored XSS.This issue… |
CVE-2024-25936 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoundCloud Inc., Lawrie Malen SoundCloud Shortcode allows… |
CVE-2024-25934 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FormFacade allows Stored XSS.This issue affects FormFacad… |
CVE-2024-25921 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Concerted Action Action Network allows Reflected XSS.This… |
CVE-2024-25919 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS… |
CVE-2024-25916 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joseph C Dolson My Calendar allows Stored XSS.This issue… |
CVE-2024-25598 | Medium | 6.5 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for Elementor allows Stored XSS… |
CVE-2024-28752 | Critical | 9.3 | 2024-03-15 | A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on we… |
CVE-2024-27987 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a… |
CVE-2024-23944 | Medium | 5.3 | 2024-03-15 | Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching… |
CVE-2024-2490 | High | 8.8 | 2024-03-15 | A vulnerability classified as critical was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function setSchedWifi of the file /goform/ope… |
CVE-2024-2450 | High | 8.8 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switchi… |
CVE-2024-2446 | Medium | 4.3 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per me… |
CVE-2024-2445 | Medium | 6.1 | 2024-03-15 | Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to es… |
CVE-2024-2489 | High | 8.8 | 2024-03-15 | A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetQosBand of the file /goform/SetNetControlList… |
CVE-2024-2488 | High | 8.8 | 2024-03-15 | A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formSetPPTPServer of the file /goform/SetPp… |
CVE-2024-2487 | High | 8.8 | 2024-03-15 | A vulnerability was found in Tenda AC18 15.03.05.05. It has been declared as critical. This vulnerability affects the function formSetDeviceName of the file /g… |
CVE-2024-28053 | Low | 3.1 | 2024-03-15 | Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker t… |
CVE-2024-24975 | Low | 3.5 | 2024-03-15 | Uncontrolled Resource Consumption in Mattermost Mobile versions before 2.13.0 fails to limit the size of the code block that will be processed by the syntax hi… |
CVE-2024-2486 | High | 8.8 | 2024-03-15 | A vulnerability was found in Tenda AC18 15.03.05.05. It has been classified as critical. This affects the function formQuickIndex of the file /goform/QuickInde… |
CVE-2024-28354 | Critical | 10.0 | 2024-03-15 | There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post reque… |
CVE-2024-28353 | High | 8.8 | 2024-03-15 | There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post reque… |
CVE-2024-2485 | High | 8.8 | 2024-03-15 | A vulnerability was found in Tenda AC18 15.03.05.05 and classified as critical. Affected by this issue is the function formSetSpeedWan of the file /goform/SetS… |
CVE-2024-2483 | Medium | 4.3 | 2024-03-15 | A vulnerability, which was classified as problematic, has been found in Surya2Developer Hostel Management Service 1.0. This issue affects some unknown processi… |
CVE-2024-2482 | Low | 3.7 | 2024-03-15 | A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2024-2399 | Medium | 6.4 | 2024-03-15 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and includin… |
CVE-2024-27756 | High | 8.8 | 2024-03-15 | GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title. |
CVE-2024-1796 | Medium | 6.4 | 2024-03-15 | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'woof' shortcode in… |
CVE-2024-1795 | High | 8.8 | 2024-03-15 | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode in… |
CVE-2024-2481 | Medium | 6.5 | 2024-03-15 | A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0. Affected is an unknown function of the file /admi… |
CVE-2024-2480 | Medium | 6.3 | 2024-03-15 | A vulnerability classified as critical was found in MHA Sistemas arMHAzena 9.6.0.0. This vulnerability affects unknown code of the component Executa Page. The… |
CVE-2024-2479 | Low | 3.5 | 2024-03-15 | A vulnerability classified as problematic has been found in MHA Sistemas arMHAzena 9.6.0.0. This affects an unknown part of the component Cadastro Page. The ma… |
CVE-2024-2478 | Medium | 6.3 | 2024-03-15 | A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register o… |
CVE-2024-25227 | Critical | 9.8 | 2024-03-15 | SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, an… |
CVE-2024-2204 | Medium | 5.5 | 2024-03-15 | Zemana AntiLogger v2.74.204.664 is vulnerable to a Denial of Service (DoS) vulnerability by triggering the 0x80002004 and 0x80002010 IOCTL codes of the zam64.s… |
CVE-2024-2180 | Medium | 5.5 | 2024-03-15 | Zemana AntiLogger v2.74.204.664 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x80002020 IOCTL code of the zam64.sys and zamguard6… |
CVE-2024-26540 | High | 7.8 | 2024-03-15 | A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimg_library::CImg<unsigned char>::_load_analyze. |
CVE-2024-26454 | Medium | 5.4 | 2024-03-15 | A Cross Site Scripting vulnerability in Healthcare-Chatbot through 9b7058a can occur via a crafted payload to the email1 or pwd1 parameter in login.php. |
CVE-2024-1917 | Critical | 9.8 | 2024-03-15 | Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated… |
CVE-2024-1916 | Critical | 9.8 | 2024-03-15 | Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated… |
CVE-2024-1915 | Critical | 9.8 | 2024-03-15 | Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated atta… |
CVE-2024-0803 | Critical | 9.8 | 2024-03-15 | Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated… |
CVE-2024-0802 | Critical | 9.8 | 2024-03-15 | Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated atta… |
CVE-2024-26246 | Low | 3.9 | 2024-03-14 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2024-26163 | Medium | 4.7 | 2024-03-14 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2024-1853 | Medium | 5.5 | 2024-03-14 | Zemana AntiLogger v2.74.204.664 is vulnerable to an Arbitrary Process Termination vulnerability by triggering the 0x80002048 IOCTL code of the zam64.sys and za… |
CVE-2024-2249 | Medium | 6.4 | 2024-03-14 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widget… |
CVE-2024-26503 | Critical | 9.1 | 2024-03-14 | Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafte… |
CVE-2024-26475 | Medium | 5.5 | 2024-03-14 | An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of service via the grub_sfs_read_extent fu… |
CVE-2024-2256 | Medium | 6.4 | 2024-03-14 | The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes such as bw_contact_button and bw_button shortcodes in all… |
CVE-2024-1713 | High | 7.2 | 2024-03-14 | A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum. |
CVE-2024-0860 | High | 8.0 | 2024-03-14 | The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft… |
CVE-2024-28425 | High | 7.5 | 2024-03-14 | greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability all… |
CVE-2024-28424 | High | 8.8 | 2024-03-14 | zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. This vulnera… |
CVE-2024-28423 | Critical | 9.8 | 2024-03-14 | Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attac… |
CVE-2024-27301 | High | 7.3 | 2024-03-14 | Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script… |
CVE-2024-27266 | High | 8.2 | 2024-03-14 | IBM Maximo Application Suite 7.6.1.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit t… |
CVE-2024-27265 | Medium | 4.5 | 2024-03-14 | IBM Integration Bus for z/OS 10.1 through 10.1.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthori… |
CVE-2024-24770 | Medium | 5.3 | 2024-03-14 | vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Muc… |
CVE-2024-24562 | Medium | 5.4 | 2024-03-14 | vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addresse… |
CVE-2024-23823 | Medium | 4.2 | 2024-03-14 | vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. The… |
CVE-2024-22346 | High | 8.4 | 2024-03-14 | Db2 for IBM i 7.2, 7.3, 7.4, and 7.5 infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor… |
CVE-2024-28181 | High | 8.1 | 2024-03-14 | turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has existing protections in… |
CVE-2024-28849 | Medium | 6.5 | 2024-03-14 | follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow… |
CVE-2024-25139 | Critical | 10.0 | 2024-03-14 | In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After h… |
CVE-2024-28323 | Medium | 6.5 | 2024-03-14 | The bwdates-report-result.php file in Phpgurukul User Registration & Login and User Management System 3.1 contains a potential security vulnerability related t… |
CVE-2024-25156 | Medium | 6.5 | 2024-03-14 | A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywh… |
CVE-2024-28418 | Medium | 6.5 | 2024-03-14 | Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php |
CVE-2024-28417 | Medium | 6.3 | 2024-03-14 | Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php. |
CVE-2024-28383 | Critical | 9.8 | 2024-03-14 | Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 function. |
CVE-2024-1623 | High | 7.7 | 2024-03-14 | Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the admi… |
CVE-2024-28746 | High | 8.1 | 2024-03-14 | Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variab… |
CVE-2024-27986 | Medium | 6.5 | 2024-03-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Elementor Addons by Livemesh allows Stored XSS.T… |