2024 CVEs (page 350)
Page 350 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21411 | High | 8.8 | 2024-03-12 | Skype for Consumer Remote Code Execution Vulnerability |
CVE-2024-21408 | Medium | 5.5 | 2024-03-12 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2024-21407 | High | 8.1 | 2024-03-12 | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2024-21400 | Critical | 9.0 | 2024-03-12 | Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability |
CVE-2024-21392 | High | 7.5 | 2024-03-12 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2024-21390 | High | 7.1 | 2024-03-12 | Microsoft Authenticator Elevation of Privilege Vulnerability |
CVE-2024-21334 | Critical | 9.8 | 2024-03-12 | Open Management Infrastructure (OMI) Remote Code Execution Vulnerability |
CVE-2024-21330 | High | 7.8 | 2024-03-12 | Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability |
CVE-2024-20671 | Medium | 5.5 | 2024-03-12 | Microsoft Defender Security Feature Bypass Vulnerability |
CVE-2024-27758 | High | 8.4 | 2024-03-12 | In RPyC before 6.0.0, when a server exposes a method that calls the attribute named __array__ for a client-provided netref (e.g., np.array(client_netref)), a r… |
CVE-2024-1529 | High | 7.4 | 2024-03-12 | Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability thro… |
CVE-2024-1528 | High | 7.4 | 2024-03-12 | CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/modu… |
CVE-2024-1527 | Critical | 9.8 | 2024-03-12 | Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security mea… |
CVE-2024-1304 | Medium | 6.3 | 2024-03-12 | Cross-site scripting vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows a remote attacker to send… |
CVE-2024-1303 | Medium | 6.5 | 2024-03-12 | Incorrectly limiting the path to a restricted directory vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerabilit… |
CVE-2024-1302 | High | 7.3 | 2024-03-12 | Information exposure vulnerability in Badger Meter Monitool affecting versions up to 4.6.3 and earlier. A local attacker could change the application's file pa… |
CVE-2024-1301 | Critical | 9.8 | 2024-03-12 | SQL injection vulnerability in Badger Meter Monitool affecting versions 4.6.3 and earlier. A remote attacker could send a specially crafted SQL query to the se… |
CVE-2024-2394 | Medium | 4.7 | 2024-03-12 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-23112 | High | 8.0 | 2024-03-12 | An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13… |
CVE-2024-21761 | Medium | 4.3 | 2024-03-12 | An improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organiz… |
CVE-2024-1618 | High | 7.8 | 2024-03-12 | A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This vulnerability affe… |
CVE-2024-1227 | Medium | 6.5 | 2024-03-12 | An open redirect vulnerability, the exploitation of which could allow an attacker to create a custom URL and redirect a legitimate page to a malicious site. |
CVE-2024-1226 | High | 7.5 | 2024-03-12 | The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidat… |
CVE-2024-2393 | Medium | 6.3 | 2024-03-12 | A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-2049 | Medium | 6.5 | 2024-03-12 | Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited in… |
CVE-2024-28553 | Critical | 9.8 | 2024-03-12 | Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the entrys parameter fromAddressNat function. |
CVE-2024-28535 | Critical | 9.8 | 2024-03-12 | Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the mitInterface parameter of fromAddressNat function. |
CVE-2024-2391 | Low | 2.4 | 2024-03-12 | A vulnerability was found in EVE-NG 5.0.1-13 and classified as problematic. Affected by this issue is some unknown functionality of the component Lab Handler… |
CVE-2024-27907 | High | 7.8 | 2024-03-12 | A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application contains an out of bounds write past the end of an… |
CVE-2024-22045 | High | 7.6 | 2024-03-12 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.1 SP1). The product places sensitive information into files or directori… |
CVE-2024-22044 | High | 7.5 | 2024-03-12 | A vulnerability has been identified in SENTRON 3KC ATC6 Expansion Module Ethernet (3KC9000-8TL75) (All versions). Affected devices expose an unused, unstable h… |
CVE-2024-22041 | High | 7.5 | 2024-03-12 | A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions), Cerberus PRO EN Fi… |
CVE-2024-22040 | High | 7.5 | 2024-03-12 | A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions), Cerberus PRO EN Fi… |
CVE-2024-22039 | Critical | 10.0 | 2024-03-12 | A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All versions < IP6 SR3), Ce… |
CVE-2024-21483 | Medium | 4.6 | 2024-03-12 | A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003… |
CVE-2024-2371 | Medium | 6.2 | 2024-03-12 | Information exposure vulnerability in Korenix JetI/O 6550 affecting firmware version F208 Build:0817. The SNMP protocol uses plaintext to transfer data, allowi… |
CVE-2024-27279 | Medium | 6.5 | 2024-03-12 | Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2… |
CVE-2024-26288 | High | 8.7 | 2024-03-12 | An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected. |
CVE-2024-26005 | Medium | 4.8 | 2024-03-12 | An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS. |
CVE-2024-26004 | High | 7.5 | 2024-03-12 | An unauthenticated remote attacker can DoS a control agent due to access of a uninitialized pointer which may prevent or disrupt the charging functionality. |
CVE-2024-26003 | High | 7.5 | 2024-03-12 | An unauthenticated remote attacker can DoS the control agent due to a out-of-bounds read which may prevent or disrupt the charging functionality. |
CVE-2024-26002 | High | 7.8 | 2024-03-12 | An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files. |
CVE-2024-26001 | High | 7.4 | 2024-03-12 | An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always succ… |
CVE-2024-26000 | Medium | 5.9 | 2024-03-12 | An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always succe… |
CVE-2024-25999 | High | 8.4 | 2024-03-12 | An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service. |
CVE-2024-25998 | High | 7.3 | 2024-03-12 | An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation. |
CVE-2024-25997 | Medium | 5.3 | 2024-03-12 | An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected. |
CVE-2024-25996 | Medium | 5.3 | 2024-03-12 | An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user. |
CVE-2024-25995 | Critical | 9.8 | 2024-03-12 | An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input valid… |
CVE-2024-25994 | Medium | 5.3 | 2024-03-12 | An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only. |
CVE-2024-1328 | Medium | 6.4 | 2024-03-12 | The Newsletter2Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 4.0.14 due… |
CVE-2024-0906 | Medium | 5.3 | 2024-03-12 | The f(x) Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the API. This makes… |
CVE-2024-27121 | High | 7.2 | 2024-03-12 | Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected p… |
CVE-2024-25325 | High | 7.1 | 2024-03-12 | SQL injection vulnerability in Employee Management System v.1.0 allows a local attacker to obtain sensitive information via a crafted payload to the txtemail p… |
CVE-2024-24964 | Medium | 6.3 | 2024-03-12 | Improper access control vulnerability exists in the resident process of SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2. If this vulnerability is… |
CVE-2024-21805 | High | 7.8 | 2024-03-12 | Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2. If this vulnerability is… |
CVE-2024-21584 | Medium | 6.1 | 2024-03-12 | Pleasanter 1.3.49.0 and earlier contains a cross-site scripting vulnerability. If an attacker tricks the user to access the product with a specially crafted UR… |
CVE-2024-25331 | Critical | 9.3 | 2024-03-12 | DIR-822 Rev. B Firmware v2.02KRB09 and DIR-822-CA Rev. B Firmware v2.03WWb01 suffer from a LAN-Side Unauthenticated Remote Code Execution (RCE) vulnerability e… |
CVE-2024-26521 | Medium | 4.8 | 2024-03-12 | HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive i… |
CVE-2024-28163 | Medium | 5.3 | 2024-03-12 | Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would oth… |
CVE-2024-27902 | Medium | 5.4 | 2024-03-12 | Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Si… |
CVE-2024-27900 | Medium | 4.3 | 2024-03-12 | Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job template… |
CVE-2024-25645 | Medium | 5.3 | 2024-03-12 | Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing l… |
CVE-2024-25644 | Medium | 5.3 | 2024-03-12 | Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on… |
CVE-2024-22133 | Medium | 4.6 | 2024-03-12 | SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information. This could lead to… |
CVE-2024-22127 | Critical | 9.1 | 2024-03-12 | SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous… |
CVE-2024-28199 | High | 7.1 | 2024-03-11 | phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploit… |
CVE-2024-28120 | Medium | 6.5 | 2024-03-11 | codeium-chrome is an open source code completion plugin for the chrome web browser. The service worker of the codeium-chrome extension doesn't check the sender… |
CVE-2024-27938 | Medium | 5.3 | 2024-03-11 | Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed… |
CVE-2024-27297 | Medium | 6.3 | 2024-03-11 | Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another p… |
CVE-2024-25854 | Medium | 6.1 | 2024-03-11 | Cross Site Scripting (XSS) vulnerability in Sourcecodester Insurance Management System 1.0 allows attackers to run arbitrary code via the Subject and Descripti… |
CVE-2024-25114 | Low | 2.6 | 2024-03-11 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Each document in Collabora Online is opened by a separate "Kit" instan… |
CVE-2024-1645 | Medium | 4.3 | 2024-03-11 | The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrations function in all… |
CVE-2024-1400 | Medium | 4.3 | 2024-03-11 | The Mollie Forms plugin for WordPress is vulnerable to unauthorized post or page duplication due to a missing capability check on the duplicateForm function in… |
CVE-2024-2357 | Medium | 6.5 | 2024-03-11 | The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSha… |
CVE-2024-28198 | Medium | 4.6 | 2024-03-11 | OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when usin… |
CVE-2024-28197 | High | 7.5 | 2024-03-11 | Zitadel is an open source identity management system. Zitadel uses a cookie to identify the user agent (browser) and its user sessions. Although the cookie wa… |
CVE-2024-28187 | High | 7.2 | 2024-03-11 | SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 are vulnerable to a… |
CVE-2024-27237 | Medium | 5.5 | 2024-03-11 | In wipe_ns_memory of nsmemwipe.c, there is a possible incorrect size calculation due to a logic error in the code. This could lead to local information disclos… |
CVE-2024-27236 | High | 8.4 | 2024-03-11 | In aoc_unlocked_ioctl of aoc.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additiona… |
CVE-2024-27235 | Medium | 5.5 | 2024-03-11 | In plugin_extern_func of , there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additi… |
CVE-2024-27234 | Medium | 5.9 | 2024-03-11 | In fvp_set_target of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no addit… |
CVE-2024-27233 | High | 7.8 | 2024-03-11 | In ppcfw_init_secpolicy of ppcfw.c, there is a possible permission bypass due to uninitialized data. This could lead to local escalation of privilege with no a… |
CVE-2024-27230 | Medium | 5.1 | 2024-03-11 | In ProtocolPsKeepAliveStatusAdapter::getCode() of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead… |
CVE-2024-27229 | High | 7.5 | 2024-03-11 | In ss_SendCallBarringPwdRequiredIndMsg of ss_CallBarring.c, there is a possible null pointer deref due to a missing null check. This could lead to remote denia… |
CVE-2024-27228 | Critical | 9.8 | 2024-03-11 | there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed… |
CVE-2024-27227 | Critical | 9.8 | 2024-03-11 | A malicious DNS response can trigger a number of OOB reads, writes, and other memory issues |
CVE-2024-27226 | High | 8.4 | 2024-03-11 | In tmu_config_gov_params of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no a… |
CVE-2024-27225 | Medium | 4.4 | 2024-03-11 | In sendHciCommand of bluetooth_hci.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure wi… |
CVE-2024-27224 | High | 7.8 | 2024-03-11 | In strncpy of strncpy.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additi… |
CVE-2024-27223 | Medium | 5.1 | 2024-03-11 | In EUTRAN_LCS_DecodeFacilityInformationElement of LPP_LcsManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead to… |
CVE-2024-27222 | High | 7.8 | 2024-03-11 | In onSkipButtonClick of FaceEnrollFoldPage.java, there is a possible way to access the file the app cannot access due to Intent Redirect GRANT_URI_PERMISSIONS… |
CVE-2024-27221 | High | 7.8 | 2024-03-11 | In update_policy_data of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no addi… |
CVE-2024-27220 | High | 8.4 | 2024-03-11 | In lpm_req_handler of , there is a possible out of bounds memory access due to a missing bounds check. This could lead to local escalation of privilege with no… |
CVE-2024-27219 | High | 8.4 | 2024-03-11 | In tmu_set_pi of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additio… |
CVE-2024-27218 | Medium | 5.5 | 2024-03-11 | In update_freq_data of , there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no addition… |
CVE-2024-27213 | High | 8.4 | 2024-03-11 | In BroadcastSystemMessage of servicemgr.cpp, there is a possible Remote Code Execution due to a use after free. This could lead to local escalation of privileg… |
CVE-2024-27212 | High | 7.8 | 2024-03-11 | In init_data of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional ex… |
CVE-2024-27211 | High | 7.7 | 2024-03-11 | In AtiHandleAPOMsgType of ati_Main.c, there is a possible OOB write due to a missing null check. This could lead to local escalation of privilege with no addit… |
CVE-2024-27210 | High | 7.8 | 2024-03-11 | In policy_check of fvp.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no addit… |