2024 CVEs (page 349)
Page 349 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-28432 | High | 8.8 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php. |
CVE-2024-28431 | High | 8.8 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_del.php. |
CVE-2024-28430 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_edit.php. |
CVE-2024-28429 | Medium | 5.5 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.php |
CVE-2024-2416 | Medium | 6.5 | 2024-03-13 | Cross-Site Request Forgery vulnerability in Movistar's 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an attacker to force an e… |
CVE-2024-2415 | High | 7.8 | 2024-03-13 | Command injection vulnerability in Movistar 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an authenticated user to execute com… |
CVE-2024-2414 | High | 8.8 | 2024-03-13 | The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820. This device has the 'adb' service open on port 5555 and pr… |
CVE-2024-2123 | High | 7.2 | 2024-03-13 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2024-1979 | Low | 3.5 | 2024-03-13 | A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the gi… |
CVE-2024-28623 | Medium | 6.1 | 2024-03-13 | RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section. |
CVE-2024-26529 | High | 7.5 | 2024-03-13 | An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) via the mmsServer_handleDeleteNamedVariab… |
CVE-2024-27440 | Medium | 4.8 | 2024-03-13 | The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don't properly verify server certifi… |
CVE-2024-2400 | High | 8.8 | 2024-03-13 | Use after free in Performance Manager in Google Chrome prior to 122.0.6261.128 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2024-2413 | Critical | 9.8 | 2024-03-13 | Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timest… |
CVE-2024-2412 | Medium | 5.3 | 2024-03-13 | The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user reg… |
CVE-2024-1582 | Medium | 6.4 | 2024-03-13 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgmza' shortcode in all versions… |
CVE-2024-1421 | Medium | 6.4 | 2024-03-12 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘border_type’ attribute of the Post Carou… |
CVE-2024-1397 | Medium | 6.4 | 2024-03-12 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, an… |
CVE-2024-2395 | High | 7.3 | 2024-03-12 | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.14. This is due to… |
CVE-2024-2107 | Medium | 5.8 | 2024-03-12 | The Blossom Spa theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.3 via generated source. This make… |
CVE-2024-24101 | Critical | 9.8 | 2024-03-12 | Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Eligibility Information Update. |
CVE-2024-0386 | High | 7.2 | 2024-03-12 | The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Referer' HTTP header in all versions up to, and including, 1.6.21 due to… |
CVE-2024-2406 | Medium | 5.4 | 2024-03-12 | A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Uplo… |
CVE-2024-28239 | Medium | 5.4 | 2024-03-12 | Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an… |
CVE-2024-28238 | Low | 2.3 | 2024-03-12 | Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of s… |
CVE-2024-28236 | High | 7.7 | 2024-03-12 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined wi… |
CVE-2024-27305 | Medium | 5.3 | 2024-03-12 | aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vuln… |
CVE-2024-24097 | Medium | 5.4 | 2024-03-12 | Cross Site Scripting (XSS) vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via the News Feed. |
CVE-2024-24093 | Critical | 9.8 | 2024-03-12 | SQL Injection vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via Personal Information Update information. |
CVE-2024-24092 | High | 7.8 | 2024-03-12 | SQL Injection vulnerability in Code-projects.org Scholars Tracking System 1.0 allows attackers to run arbitrary code via login.php. |
CVE-2024-23300 | High | 7.8 | 2024-03-12 | A use-after-free issue was addressed with improved memory management. This issue is fixed in GarageBand 10.4.11. Processing a maliciously crafted file may lead… |
CVE-2024-2130 | Medium | 6.4 | 2024-03-12 | The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and including, 1.2.7 due to i… |
CVE-2024-2031 | Medium | 6.4 | 2024-03-12 | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meeting' shortcode in a… |
CVE-2024-28186 | High | 7.1 | 2024-03-12 | FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP s… |
CVE-2024-28121 | High | 8.8 | 2024-03-12 | stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time we… |
CVE-2024-28114 | High | 8.1 | 2024-03-12 | Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manage… |
CVE-2024-28113 | Low | 3.5 | 2024-03-12 | Peering Manager is a BGP session management tool. In Peering Manager <=1.8.2, it is possible to redirect users to an arbitrary page using a crafted url. As a r… |
CVE-2024-28112 | Medium | 6.1 | 2024-03-12 | Peering Manager is a BGP session management tool. Affected versions of Peering Manager are subject to a potential stored Cross-Site Scripting (XSS) attack in t… |
CVE-2024-28098 | Medium | 6.4 | 2024-03-12 | The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading se… |
CVE-2024-27894 | High | 8.5 | 2024-03-12 | The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a U… |
CVE-2024-27317 | High | 8.4 | 2024-03-12 | In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Wo… |
CVE-2024-27135 | High | 8.5 | 2024-03-12 | Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, out… |
CVE-2024-1765 | Medium | 5.9 | 2024-03-12 | Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the… |
CVE-2024-1410 | Low | 3.7 | 2024-03-12 | Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resour… |
CVE-2024-1138 | High | 8.8 | 2024-03-12 | The FTL Server component of TIBCO Software Inc.'s TIBCO FTL - Enterprise Edition contains a vulnerability that allows a low privileged attacker with network ac… |
CVE-2024-1137 | Medium | 4.3 | 2024-03-12 | The Proxy and Client components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Enterprise Edition contain a vulnerability that theoretically allows an Active Sp… |
CVE-2024-2182 | Medium | 6.5 | 2024-03-12 | A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject special… |
CVE-2024-28340 | High | 7.5 | 2024-03-12 | An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtai… |
CVE-2024-28339 | Medium | 5.4 | 2024-03-12 | An information leak in the debuginfo.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sen… |
CVE-2024-28338 | High | 8.0 | 2024-03-12 | A login bypass in TOTOLINK A8000RU V7.1cu.643_B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie. |
CVE-2024-26204 | High | 7.5 | 2024-03-12 | Outlook for Android Information Disclosure Vulnerability |
CVE-2024-26203 | High | 7.3 | 2024-03-12 | Azure Data Studio Elevation of Privilege Vulnerability |
CVE-2024-26201 | Medium | 6.6 | 2024-03-12 | Microsoft Intune Linux Agent Elevation of Privilege Vulnerability |
CVE-2024-26199 | High | 7.8 | 2024-03-12 | Microsoft Office Elevation of Privilege Vulnerability |
CVE-2024-26198 | High | 8.8 | 2024-03-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2024-26197 | Medium | 6.5 | 2024-03-12 | Windows Standards-Based Storage Management Service Denial of Service Vulnerability |
CVE-2024-26190 | High | 7.5 | 2024-03-12 | Microsoft QUIC Denial of Service Vulnerability |
CVE-2024-26185 | Medium | 6.5 | 2024-03-12 | Windows Compressed Folder Tampering Vulnerability |
CVE-2024-26182 | High | 7.8 | 2024-03-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-26181 | Medium | 5.5 | 2024-03-12 | Windows Kernel Denial of Service Vulnerability |
CVE-2024-26178 | High | 7.8 | 2024-03-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-26177 | Medium | 5.5 | 2024-03-12 | Windows Kernel Information Disclosure Vulnerability |
CVE-2024-26176 | High | 7.8 | 2024-03-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-26174 | Medium | 5.5 | 2024-03-12 | Windows Kernel Information Disclosure Vulnerability |
CVE-2024-26173 | High | 7.8 | 2024-03-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-26170 | High | 7.8 | 2024-03-12 | Windows Composite Image File System (CimFS) Elevation of Privilege Vulnerability |
CVE-2024-26169 | High | 7.8 | 2024-03-12 | Windows Error Reporting Service Elevation of Privilege Vulnerability |
CVE-2024-26166 | High | 8.8 | 2024-03-12 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2024-26165 | High | 8.8 | 2024-03-12 | Visual Studio Code Elevation of Privilege Vulnerability |
CVE-2024-26164 | High | 8.8 | 2024-03-12 | Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability |
CVE-2024-26162 | High | 8.8 | 2024-03-12 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2024-26161 | High | 8.8 | 2024-03-12 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2024-26160 | Medium | 5.5 | 2024-03-12 | Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability |
CVE-2024-26159 | High | 8.8 | 2024-03-12 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2024-21451 | High | 8.8 | 2024-03-12 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2024-21450 | High | 8.8 | 2024-03-12 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2024-21448 | Medium | 5.0 | 2024-03-12 | Microsoft Teams for Android Information Disclosure Vulnerability |
CVE-2024-21446 | High | 7.8 | 2024-03-12 | NTFS Elevation of Privilege Vulnerability |
CVE-2024-21445 | High | 7.0 | 2024-03-12 | Windows USB Print Driver Elevation of Privilege Vulnerability |
CVE-2024-21444 | High | 8.8 | 2024-03-12 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2024-21443 | High | 7.3 | 2024-03-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-21442 | High | 7.8 | 2024-03-12 | Windows USB Print Driver Elevation of Privilege Vulnerability |
CVE-2024-21441 | High | 8.8 | 2024-03-12 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2024-21440 | High | 8.8 | 2024-03-12 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2024-21439 | High | 7.0 | 2024-03-12 | Windows Telephony Server Elevation of Privilege Vulnerability |
CVE-2024-21438 | High | 7.5 | 2024-03-12 | Microsoft AllJoyn API Denial of Service Vulnerability |
CVE-2024-21437 | High | 7.8 | 2024-03-12 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2024-21436 | High | 7.8 | 2024-03-12 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2024-21435 | High | 8.8 | 2024-03-12 | Windows OLE Remote Code Execution Vulnerability |
CVE-2024-21434 | High | 7.8 | 2024-03-12 | Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability |
CVE-2024-21433 | High | 7.0 | 2024-03-12 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2024-21432 | High | 7.0 | 2024-03-12 | Windows Update Stack Elevation of Privilege Vulnerability |
CVE-2024-21431 | High | 7.8 | 2024-03-12 | Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability |
CVE-2024-21430 | Medium | 5.7 | 2024-03-12 | Windows USB Attached SCSI (UAS) Protocol Remote Code Execution Vulnerability |
CVE-2024-21429 | Medium | 6.8 | 2024-03-12 | Windows USB Hub Driver Remote Code Execution Vulnerability |
CVE-2024-21427 | High | 7.5 | 2024-03-12 | Windows Kerberos Security Feature Bypass Vulnerability |
CVE-2024-21426 | High | 7.8 | 2024-03-12 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2024-21421 | High | 7.5 | 2024-03-12 | Azure SDK Spoofing Vulnerability |
CVE-2024-21419 | High | 7.6 | 2024-03-12 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2024-21418 | High | 7.8 | 2024-03-12 | Software for Open Networking in the Cloud (SONiC) Elevation of Privilege Vulnerability |