2024 CVEs (page 347)
Page 347 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-26163 | Medium | 4.7 | 2024-03-14 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2024-1853 | Medium | 5.5 | 2024-03-14 | Zemana AntiLogger v2.74.204.664 is vulnerable to an Arbitrary Process Termination vulnerability by triggering the 0x80002048 IOCTL code of the zam64.sys and za… |
CVE-2024-2249 | Medium | 6.4 | 2024-03-14 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widget… |
CVE-2024-26503 | Critical | 9.1 | 2024-03-14 | Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafte… |
CVE-2024-26475 | Medium | 5.5 | 2024-03-14 | An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of service via the grub_sfs_read_extent fu… |
CVE-2024-2256 | Medium | 6.4 | 2024-03-14 | The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes such as bw_contact_button and bw_button shortcodes in all… |
CVE-2024-1713 | High | 7.2 | 2024-03-14 | A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum. |
CVE-2024-0860 | High | 8.0 | 2024-03-14 | The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft… |
CVE-2024-28425 | High | 7.5 | 2024-03-14 | greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability all… |
CVE-2024-28424 | High | 8.8 | 2024-03-14 | zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. This vulnera… |
CVE-2024-28423 | Critical | 9.8 | 2024-03-14 | Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attac… |
CVE-2024-27301 | High | 7.3 | 2024-03-14 | Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script… |
CVE-2024-27266 | High | 8.2 | 2024-03-14 | IBM Maximo Application Suite 7.6.1.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit t… |
CVE-2024-27265 | Medium | 4.5 | 2024-03-14 | IBM Integration Bus for z/OS 10.1 through 10.1.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthori… |
CVE-2024-24770 | Medium | 5.3 | 2024-03-14 | vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Muc… |
CVE-2024-24562 | Medium | 5.4 | 2024-03-14 | vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addresse… |
CVE-2024-23823 | Medium | 4.2 | 2024-03-14 | vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. The… |
CVE-2024-22346 | High | 8.4 | 2024-03-14 | Db2 for IBM i 7.2, 7.3, 7.4, and 7.5 infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor… |
CVE-2024-28181 | High | 8.1 | 2024-03-14 | turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has existing protections in… |
CVE-2024-28849 | Medium | 6.5 | 2024-03-14 | follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow… |
CVE-2024-25139 | Critical | 10.0 | 2024-03-14 | In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After h… |
CVE-2024-28323 | Medium | 6.5 | 2024-03-14 | The bwdates-report-result.php file in Phpgurukul User Registration & Login and User Management System 3.1 contains a potential security vulnerability related t… |
CVE-2024-25156 | Medium | 6.5 | 2024-03-14 | A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywh… |
CVE-2024-28418 | Medium | 6.5 | 2024-03-14 | Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php |
CVE-2024-28417 | Medium | 6.3 | 2024-03-14 | Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php. |
CVE-2024-28383 | Critical | 9.8 | 2024-03-14 | Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 function. |
CVE-2024-1623 | High | 7.7 | 2024-03-14 | Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the admi… |
CVE-2024-28746 | High | 8.1 | 2024-03-14 | Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variab… |
CVE-2024-27986 | Medium | 6.5 | 2024-03-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Elementor Addons by Livemesh allows Stored XSS.T… |
CVE-2024-0313 | Medium | 5.5 | 2024-03-14 | A malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization. On the contrary, if the victim is… |
CVE-2024-0312 | Medium | 5.5 | 2024-03-14 | A malicious insider can uninstall Skyhigh Client Proxy without a valid uninstall password. |
CVE-2024-0311 | Medium | 5.5 | 2024-03-14 | A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code. |
CVE-2024-28391 | Critical | 9.8 | 2024-03-14 | SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate privileges and obta… |
CVE-2024-28390 | Critical | 9.8 | 2024-03-14 | An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive info… |
CVE-2024-22398 | Medium | 4.9 | 2024-03-14 | An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could allow a remote attack… |
CVE-2024-22397 | High | 8.3 | 2024-03-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticated attacker as a f… |
CVE-2024-22396 | Medium | 5.3 | 2024-03-14 | An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and po… |
CVE-2024-1884 | Medium | 6.5 | 2024-03-14 | This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side applicat… |
CVE-2024-1883 | Medium | 6.3 | 2024-03-14 | This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious… |
CVE-2024-1882 | High | 7.2 | 2024-03-14 | This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hos… |
CVE-2024-28388 | Critical | 9.8 | 2024-03-14 | SQL injection vulnerability in SunnyToo stproductcomments module for PrestaShop v.1.0.5 and before, allows a remote attacker to escalate privileges and obtain… |
CVE-2024-25653 | Medium | 4.3 | 2024-03-14 | Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view sy… |
CVE-2024-25652 | High | 7.6 | 2024-03-14 | In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED… |
CVE-2024-25651 | Medium | 5.3 | 2024-03-14 | User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid… |
CVE-2024-25649 | Medium | 6.7 | 2024-03-14 | In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a me… |
CVE-2024-1654 | High | 7.2 | 2024-03-14 | This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin… |
CVE-2024-1223 | Medium | 4.8 | 2024-03-14 | This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge o… |
CVE-2024-1222 | High | 8.6 | 2024-03-14 | This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small su… |
CVE-2024-1221 | Low | 3.1 | 2024-03-14 | This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The… |
CVE-2024-25650 | Medium | 5.9 | 2024-03-14 | Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to e… |
CVE-2024-25228 | High | 8.8 | 2024-03-14 | Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler… |
CVE-2024-28251 | Medium | 5.6 | 2024-03-14 | Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a W… |
CVE-2024-2242 | Medium | 6.1 | 2024-03-13 | The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5… |
CVE-2024-2079 | Medium | 6.4 | 2024-03-13 | The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'per_line_mobile' shortcode in… |
CVE-2024-27703 | Medium | 5.4 | 2024-03-13 | Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter. |
CVE-2024-28662 | Medium | 5.4 | 2024-03-13 | A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/functions.php. |
CVE-2024-28193 | Medium | 6.5 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 allows users to create a public token in the settings, which… |
CVE-2024-28192 | Medium | 5.3 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 is vulnerable to NoSQL injection in the public access token… |
CVE-2024-28175 | Critical | 9.0 | 2024-03-13 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the `link.argocd.ar… |
CVE-2024-27102 | Critical | 9.9 | 2024-03-13 | Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potent… |
CVE-2024-27097 | Medium | 4.3 | 2024-03-13 | A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting fa… |
CVE-2024-25250 | Critical | 9.8 | 2024-03-13 | SQL Injection vulnerability in code-projects Agro-School Management System 1.0 allows attackers to run arbitrary code via the Login page. |
CVE-2024-24105 | High | 7.8 | 2024-03-13 | SQL Injection vulnerability in Code-projects Computer Science Time Table System 1.0 allows attackers to run arbitrary code via adminFormvalidation.php. |
CVE-2024-22167 | High | 7.9 | 2024-03-13 | A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the… |
CVE-2024-24693 | High | 7.2 | 2024-03-13 | Improper access control in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service… |
CVE-2024-24692 | Medium | 5.3 | 2024-03-13 | Race condition in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via loca… |
CVE-2024-28194 | Critical | 9.1 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authen… |
CVE-2024-0801 | High | 7.5 | 2024-03-13 | A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll. |
CVE-2024-0800 | High | 8.8 | 2024-03-13 | A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servle… |
CVE-2024-0799 | Critical | 9.8 | 2024-03-13 | An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.s… |
CVE-2024-2433 | Medium | 4.3 | 2024-03-13 | An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web… |
CVE-2024-2432 | Medium | 4.5 | 2024-03-13 | A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-2431 | Medium | 5.5 | 2024-03-13 | An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disa… |
CVE-2024-2418 | Medium | 6.3 | 2024-03-13 | A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-2403 | Medium | 5.9 | 2024-03-13 | Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attacker that compromis… |
CVE-2024-28196 | Medium | 6.5 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version < 1.9.0 does not prevent other pages from displaying it in an ifram… |
CVE-2024-28195 | High | 8.1 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.9.0 do not protect the API and login flow against Cross-Site R… |
CVE-2024-27953 | Medium | 4.7 | 2024-03-13 | Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List.This issue affects Cryptocurrency Widgets – Price Ticker… |
CVE-2024-27952 | High | 7.1 | 2024-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus Advanced Sermons allows Reflected XSS.This issu… |
CVE-2024-20327 | High | 7.4 | 2024-03-13 | A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allo… |
CVE-2024-20322 | Medium | 5.8 | 2024-03-13 | A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthent… |
CVE-2024-20320 | High | 7.8 | 2024-03-13 | A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) 540 Series and 5700… |
CVE-2024-20319 | Medium | 4.3 | 2024-03-13 | A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane pro… |
CVE-2024-20318 | High | 7.4 | 2024-03-13 | A vulnerability in the Layer 2 Ethernet services of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the line card network proc… |
CVE-2024-20315 | Medium | 5.8 | 2024-03-13 | A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated… |
CVE-2024-20266 | Medium | 5.3 | 2024-03-13 | A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of th… |
CVE-2024-20262 | Medium | 6.5 | 2024-03-13 | A vulnerability in the Secure Copy Protocol (SCP) and SFTP feature of Cisco IOS XR Software could allow an authenticated, local attacker to create or overwrite… |
CVE-2024-0173 | Low | 3.8 | 2024-03-13 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could poten… |
CVE-2024-0163 | Medium | 5.3 | 2024-03-13 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploi… |
CVE-2024-0162 | Medium | 5.3 | 2024-03-13 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacke… |
CVE-2024-0154 | Low | 3.8 | 2024-03-13 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could poten… |
CVE-2024-2293 | Medium | 6.4 | 2024-03-13 | The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user display name in all versions up to, and including, 6.11.4 due t… |
CVE-2024-2286 | Medium | 6.4 | 2024-03-13 | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart) plugin for WordPress is vulne… |
CVE-2024-2252 | Medium | 5.4 | 2024-03-13 | The Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… |
CVE-2024-2239 | Medium | 6.4 | 2024-03-13 | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Premium Magic Scroll module in all versions up to, and includi… |
CVE-2024-2238 | Medium | 6.4 | 2024-03-13 | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions up to, and includin… |
CVE-2024-2237 | Medium | 6.4 | 2024-03-13 | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9… |
CVE-2024-2194 | High | 7.2 | 2024-03-13 | The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due… |
CVE-2024-2172 | Critical | 9.8 | 2024-03-13 | The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing c… |
CVE-2024-2126 | Medium | 6.4 | 2024-03-13 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Registration Form widget in all versions up to, and includ… |