2024 CVEs (page 347)
Page 347 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0313 | Medium | 5.5 | 2024-03-14 | A malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization. On the contrary, if the victim is… |
CVE-2024-0312 | Medium | 5.5 | 2024-03-14 | A malicious insider can uninstall Skyhigh Client Proxy without a valid uninstall password. |
CVE-2024-0311 | Medium | 5.5 | 2024-03-14 | A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code. |
CVE-2024-28391 | Critical | 9.8 | 2024-03-14 | SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate privileges and obta… |
CVE-2024-28390 | Critical | 9.8 | 2024-03-14 | An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive info… |
CVE-2024-22398 | Medium | 4.9 | 2024-03-14 | An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could allow a remote attack… |
CVE-2024-22397 | High | 8.3 | 2024-03-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticated attacker as a f… |
CVE-2024-22396 | Medium | 5.3 | 2024-03-14 | An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and po… |
CVE-2024-1884 | Medium | 6.5 | 2024-03-14 | This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side applicat… |
CVE-2024-1883 | Medium | 6.3 | 2024-03-14 | This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious… |
CVE-2024-1882 | High | 7.2 | 2024-03-14 | This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hos… |
CVE-2024-28388 | Critical | 9.8 | 2024-03-14 | SQL injection vulnerability in SunnyToo stproductcomments module for PrestaShop v.1.0.5 and before, allows a remote attacker to escalate privileges and obtain… |
CVE-2024-25653 | Medium | 4.3 | 2024-03-14 | Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view sy… |
CVE-2024-25652 | High | 7.6 | 2024-03-14 | In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED… |
CVE-2024-25651 | Medium | 5.3 | 2024-03-14 | User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid… |
CVE-2024-25649 | Medium | 6.7 | 2024-03-14 | In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a me… |
CVE-2024-1654 | High | 7.2 | 2024-03-14 | This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin… |
CVE-2024-1223 | Medium | 4.8 | 2024-03-14 | This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge o… |
CVE-2024-1222 | High | 8.6 | 2024-03-14 | This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small su… |
CVE-2024-1221 | Low | 3.1 | 2024-03-14 | This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The… |
CVE-2024-25650 | Medium | 5.9 | 2024-03-14 | Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to e… |
CVE-2024-25228 | High | 8.8 | 2024-03-14 | Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler… |
CVE-2024-28251 | Medium | 5.6 | 2024-03-14 | Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a W… |
CVE-2024-2242 | Medium | 6.1 | 2024-03-13 | The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5… |
CVE-2024-2079 | Medium | 6.4 | 2024-03-13 | The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'per_line_mobile' shortcode in… |
CVE-2024-27703 | Medium | 5.4 | 2024-03-13 | Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter. |
CVE-2024-28662 | Medium | 5.4 | 2024-03-13 | A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/functions.php. |
CVE-2024-28193 | Medium | 6.5 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 allows users to create a public token in the settings, which… |
CVE-2024-28192 | Medium | 5.3 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 is vulnerable to NoSQL injection in the public access token… |
CVE-2024-28175 | Critical | 9.0 | 2024-03-13 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the `link.argocd.ar… |
CVE-2024-27102 | Critical | 9.9 | 2024-03-13 | Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potent… |
CVE-2024-27097 | Medium | 4.3 | 2024-03-13 | A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting fa… |
CVE-2024-25250 | Critical | 9.8 | 2024-03-13 | SQL Injection vulnerability in code-projects Agro-School Management System 1.0 allows attackers to run arbitrary code via the Login page. |
CVE-2024-24105 | High | 7.8 | 2024-03-13 | SQL Injection vulnerability in Code-projects Computer Science Time Table System 1.0 allows attackers to run arbitrary code via adminFormvalidation.php. |
CVE-2024-22167 | High | 7.9 | 2024-03-13 | A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the… |
CVE-2024-24693 | High | 7.2 | 2024-03-13 | Improper access control in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service… |
CVE-2024-24692 | Medium | 5.3 | 2024-03-13 | Race condition in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via loca… |
CVE-2024-28194 | Critical | 9.1 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authen… |
CVE-2024-0801 | High | 7.5 | 2024-03-13 | A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll. |
CVE-2024-0800 | High | 8.8 | 2024-03-13 | A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servle… |
CVE-2024-0799 | Critical | 9.8 | 2024-03-13 | An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.s… |
CVE-2024-2433 | Medium | 4.3 | 2024-03-13 | An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web… |
CVE-2024-2432 | Medium | 4.5 | 2024-03-13 | A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-2431 | Medium | 5.5 | 2024-03-13 | An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disa… |
CVE-2024-2418 | Medium | 6.3 | 2024-03-13 | A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-2403 | Medium | 5.9 | 2024-03-13 | Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attacker that compromis… |
CVE-2024-28196 | Medium | 6.5 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version < 1.9.0 does not prevent other pages from displaying it in an ifram… |
CVE-2024-28195 | High | 8.1 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.9.0 do not protect the API and login flow against Cross-Site R… |
CVE-2024-27953 | Medium | 4.7 | 2024-03-13 | Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List.This issue affects Cryptocurrency Widgets – Price Ticker… |
CVE-2024-27952 | High | 7.1 | 2024-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus Advanced Sermons allows Reflected XSS.This issu… |
CVE-2024-20327 | High | 7.4 | 2024-03-13 | A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allo… |
CVE-2024-20322 | Medium | 5.8 | 2024-03-13 | A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthent… |
CVE-2024-20320 | High | 7.8 | 2024-03-13 | A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) 540 Series and 5700… |
CVE-2024-20319 | Medium | 4.3 | 2024-03-13 | A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane pro… |
CVE-2024-20318 | High | 7.4 | 2024-03-13 | A vulnerability in the Layer 2 Ethernet services of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the line card network proc… |
CVE-2024-20315 | Medium | 5.8 | 2024-03-13 | A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated… |
CVE-2024-20266 | Medium | 5.3 | 2024-03-13 | A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of th… |
CVE-2024-20262 | Medium | 6.5 | 2024-03-13 | A vulnerability in the Secure Copy Protocol (SCP) and SFTP feature of Cisco IOS XR Software could allow an authenticated, local attacker to create or overwrite… |
CVE-2024-0173 | Low | 3.8 | 2024-03-13 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could poten… |
CVE-2024-0163 | Medium | 5.3 | 2024-03-13 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploi… |
CVE-2024-0162 | Medium | 5.3 | 2024-03-13 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacke… |
CVE-2024-0154 | Low | 3.8 | 2024-03-13 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could poten… |
CVE-2024-2293 | Medium | 6.4 | 2024-03-13 | The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user display name in all versions up to, and including, 6.11.4 due t… |
CVE-2024-2286 | Medium | 6.4 | 2024-03-13 | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart) plugin for WordPress is vulne… |
CVE-2024-2252 | Medium | 5.4 | 2024-03-13 | The Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… |
CVE-2024-2239 | Medium | 6.4 | 2024-03-13 | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Premium Magic Scroll module in all versions up to, and includi… |
CVE-2024-2238 | Medium | 6.4 | 2024-03-13 | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions up to, and includin… |
CVE-2024-2237 | Medium | 6.4 | 2024-03-13 | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9… |
CVE-2024-2194 | High | 7.2 | 2024-03-13 | The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due… |
CVE-2024-2172 | Critical | 9.8 | 2024-03-13 | The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing c… |
CVE-2024-2126 | Medium | 6.4 | 2024-03-13 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Registration Form widget in all versions up to, and includ… |
CVE-2024-2106 | Medium | 5.3 | 2024-03-13 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and inclu… |
CVE-2024-2030 | Medium | 6.4 | 2024-03-13 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in al… |
CVE-2024-2028 | Medium | 6.4 | 2024-03-13 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Covid-19 Stats Widget in all versions up to, and i… |
CVE-2024-2020 | High | 7.2 | 2024-03-13 | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and includ… |
CVE-2024-2006 | High | 8.8 | 2024-03-13 | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in al… |
CVE-2024-2000 | Medium | 6.4 | 2024-03-13 | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigation_dots' parameter of the Multi Scroll Widget in all… |
CVE-2024-28683 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via create file. |
CVE-2024-28682 | Medium | 6.3 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/sys_cache_up.php. |
CVE-2024-28681 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/plus_edit.php. |
CVE-2024-28680 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_add.php. |
CVE-2024-28679 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via Photo Collection. |
CVE-2024-28678 | Medium | 6.3 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_description_main.php |
CVE-2024-28677 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article_keywords_main.php. |
CVE-2024-28676 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via /dede/article_edit.php. |
CVE-2024-28673 | High | 8.8 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel_edit.php. |
CVE-2024-28672 | Medium | 5.4 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media_edit.php. |
CVE-2024-28671 | High | 8.8 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/stepselect_main.php. |
CVE-2024-28670 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_main.php. |
CVE-2024-28669 | Medium | 5.4 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_edit.php. |
CVE-2024-26630 | High | 7.1 | 2024-03-13 | In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix folio read-after-free in cache walk In cachestat, we access the folio… |
CVE-2024-25101 | Medium | 5.9 | 2024-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Maspik – Spam Blacklist allows Stored XSS.This is… |
CVE-2024-25099 | Medium | 6.5 | 2024-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David de Boer Paytium: Mollie payment forms & donations a… |
CVE-2024-25097 | Medium | 6.5 | 2024-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode LLC TNC PDF viewer allows Stored XSS.This issu… |
CVE-2024-24549 | High | 7.5 | 2024-03-13 | Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceed… |
CVE-2024-23672 | Medium | 6.3 | 2024-03-13 | Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to in… |
CVE-2024-1997 | Medium | 6.4 | 2024-03-13 | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_fbchat_app_id' parameter of the Messenger Chat Widget… |
CVE-2024-1996 | Medium | 6.4 | 2024-03-13 | The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's IHover widget link in all versions up to, and includi… |
CVE-2024-1985 | Medium | 4.7 | 2024-03-13 | The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including… |
CVE-2024-1951 | High | 7.5 | 2024-03-13 | The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inclu… |