2024 CVEs (page 354)
Page 354 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20336 | Medium | 6.5 | 2024-03-06 | A vulnerability in the web-based user interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated, remote attacker to… |
CVE-2024-20335 | Medium | 6.5 | 2024-03-06 | A vulnerability in the web-based management interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated, remote attack… |
CVE-2024-20301 | Medium | 6.2 | 2024-03-06 | A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary authentication and ac… |
CVE-2024-20292 | Medium | 4.4 | 2024-03-06 | A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker to view sensitive i… |
CVE-2024-2005 | Critical | 9.0 | 2024-03-06 | In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authenticatio… |
CVE-2024-26580 | Critical | 9.1 | 2024-03-06 | Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the speci… |
CVE-2024-25103 | Medium | 6.3 | 2024-03-06 | This vulnerability exists in AppSamvid software due to the usage of vulnerable and outdated components. An attacker with local administrative privileges could… |
CVE-2024-25102 | High | 7.8 | 2024-03-06 | This vulnerability exists in AppSamvid software due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. An attacker with loca… |
CVE-2024-1224 | High | 7.1 | 2024-03-06 | This vulnerability exists in USB Pratirodh due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. A local attacker with admi… |
CVE-2024-2211 | Medium | 4.6 | 2024-03-06 | Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript paylo… |
CVE-2024-26627 | Medium | 5.5 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler Inside scsi_e… |
CVE-2024-26626 | High | 7.5 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: ipmr: fix kernel panic when forwarding mcast packets The stacktrace was: [ 86.305548] B… |
CVE-2024-26625 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at release time syzbot reported an interesting trace [1] caused b… |
CVE-2024-26623 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: pds_core: Prevent race issues involving the adminq There are multiple paths that can resu… |
CVE-2024-1989 | Medium | 6.4 | 2024-03-06 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Sassy_Social_Share' shortcod… |
CVE-2024-1771 | Medium | 4.3 | 2024-03-06 | The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sections() function in al… |
CVE-2024-1760 | Medium | 4.3 | 2024-03-06 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions… |
CVE-2024-1220 | High | 8.2 | 2024-03-06 | A stack-based buffer overflow in the built-in web server in Moxa NPort W2150A/W2250A Series firmware version 2.3 and prior allows a remote attacker to exploit… |
CVE-2024-27278 | Medium | 5.4 | 2024-03-06 | OpenPNE Plugin "opTimelinePlugin" 1.2.11 and earlier contains a cross-site scripting vulnerability. On the site which uses the affected product, when a user co… |
CVE-2024-25817 | High | 7.8 | 2024-03-06 | Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects com… |
CVE-2024-22889 | High | 7.5 | 2024-03-06 | Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request. |
CVE-2024-27765 | High | 7.5 | 2024-03-05 | Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController componen… |
CVE-2024-27764 | Critical | 9.8 | 2024-03-05 | An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component. |
CVE-2024-24786 | High | 7.5 | 2024-03-05 | The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a… |
CVE-2024-24785 | Medium | 5.4 | 2024-03-05 | If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template… |
CVE-2024-24784 | High | 7.5 | 2024-03-05 | The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address… |
CVE-2024-24783 | Medium | 5.9 | 2024-03-05 | Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto… |
CVE-2024-24278 | High | 7.5 | 2024-03-05 | An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the messa… |
CVE-2024-24276 | Critical | 9.6 | 2024-03-05 | Cross Site Scripting (XSS) vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information vi… |
CVE-2024-24275 | Critical | 9.6 | 2024-03-05 | Cross Site Scripting vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a cr… |
CVE-2024-1901 | Medium | 4.3 | 2024-03-05 | Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permiss… |
CVE-2024-1900 | Medium | 5.5 | 2024-03-05 | Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an iden… |
CVE-2024-1898 | Medium | 4.3 | 2024-03-05 | Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings… |
CVE-2024-1764 | High | 7.6 | 2024-03-05 | Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue using the elevated… |
CVE-2024-2179 | Low | 2.2 | 2024-03-05 | Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insufficient validation of administrator prov… |
CVE-2024-25858 | High | 8.4 | 2024-03-05 | In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScript could occur because of an unoptimized prompt message for users to… |
CVE-2024-25616 | Low | 3.7 | 2024-03-05 | Aruba has identified certain configurations of ArubaOS that can lead to partial disclosure of sensitive information in the IKE_AUTH negotiation process. The sc… |
CVE-2024-25615 | Medium | 5.3 | 2024-03-05 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Spectrum service accessed via the PAPI protocol in ArubaOS 8.x. Successful exploitation… |
CVE-2024-25614 | Medium | 5.5 | 2024-03-05 | There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitation of this vulnerability results in the ability to delete ar… |
CVE-2024-25613 | High | 7.2 | 2024-03-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2024-25612 | High | 7.2 | 2024-03-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2024-25611 | High | 7.2 | 2024-03-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2024-1356 | High | 7.2 | 2024-03-05 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the abi… |
CVE-2024-2056 | Critical | 9.8 | 2024-03-05 | Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. In particular, the "tailon" service… |
CVE-2024-2055 | Critical | 9.8 | 2024-03-05 | The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not requir… |
CVE-2024-23296 | High | 7.8 | 2024-03-05 | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey… |
CVE-2024-23256 | Low | 3.3 | 2024-03-05 | A logic issue was addressed with improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4. A user's locked tabs may be briefly visible while… |
CVE-2024-23243 | Low | 3.3 | 2024-03-05 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.4 and iPadOS 17.4. An app may be able to read… |
CVE-2024-23225 | High | 7.8 | 2024-03-05 | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Monterey… |
CVE-2024-22255 | High | 7.1 | 2024-03-05 | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access t… |
CVE-2024-22254 | High | 7.9 | 2024-03-05 | VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading… |
CVE-2024-22253 | Critical | 9.3 | 2024-03-05 | VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges… |
CVE-2024-22252 | Critical | 9.3 | 2024-03-05 | VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges… |
CVE-2024-27931 | Medium | 5.8 | 2024-03-05 | Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in `Deno.makeTemp*` APIs would allow for… |
CVE-2024-27929 | High | 7.1 | 2024-03-05 | ImageSharp is a managed, cross-platform, 2D graphics library. A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore… |
CVE-2024-27565 | Critical | 9.8 | 2024-03-05 | A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary reques… |
CVE-2024-27564 | Medium | 5.8 | 2024-03-05 | pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of picturepro… |
CVE-2024-27563 | Medium | 5.3 | 2024-03-05 | A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests v… |
CVE-2024-27561 | High | 8.1 | 2024-03-05 | A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbit… |
CVE-2024-24098 | High | 7.8 | 2024-03-05 | Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection via the News Feed. |
CVE-2024-27627 | Medium | 6.1 | 2024-03-05 | A reflected cross-site scripting (XSS) vulnerability exists in SuperCali version 1.1.0, allowing remote attackers to execute arbitrary JavaScript code via the… |
CVE-2024-27625 | Medium | 4.8 | 2024-03-05 | CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifica… |
CVE-2024-27623 | Medium | 5.9 | 2024-03-05 | CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within the Design Manager, particularly when ed… |
CVE-2024-27622 | High | 7.2 | 2024-03-05 | A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises… |
CVE-2024-2188 | Medium | 6.1 | 2024-03-05 | Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability could allow an unaut… |
CVE-2024-26339 | Critical | 9.1 | 2024-03-05 | swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a. |
CVE-2024-26337 | Medium | 4.3 | 2024-03-05 | swftools v0.9.2 was discovered to contain a segmentation violation via the function s_font at swftools/src/swfc.c. |
CVE-2024-26335 | Medium | 5.5 | 2024-03-05 | swftools v0.9.2 was discovered to contain a segmentation violation via the function state_free at swftools/src/swfc-history.c. |
CVE-2024-26334 | Medium | 6.2 | 2024-03-05 | swftools v0.9.2 was discovered to contain a segmentation violation via the function compileSWFActionCode at swftools/lib/action/actioncompiler.c. |
CVE-2024-26333 | Medium | 5.5 | 2024-03-05 | swftools v0.9.2 was discovered to contain a segmentation violation via the function free_lines at swftools/lib/modules/swfshape.c. |
CVE-2024-20833 | Medium | 4.1 | 2024-03-05 | Use after free vulnerability in pub_crypto_recv_msg prior to SMR Mar-2024 Release 1 due to race condition allows local attackers with system privilege to cause… |
CVE-2024-20841 | Medium | 5.1 | 2024-03-05 | Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to access data. |
CVE-2024-20840 | Medium | 5.7 | 2024-03-05 | Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02 in Android 14 allows physical attackers… |
CVE-2024-20839 | Medium | 4.6 | 2024-03-05 | Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02 in Android 14 allows physical attackers… |
CVE-2024-20838 | Medium | 6.8 | 2024-03-05 | Improper validation vulnerability in Samsung Internet prior to version 24.0.3.2 allows local attackers to execute arbitrary code. |
CVE-2024-20837 | Medium | 5.3 | 2024-03-05 | Improper handling of granting permission for Trusted Web Activities in Samsung Internet prior to version 24.0.0.41 allows local attackers to grant permission t… |
CVE-2024-20836 | Low | 3.3 | 2024-03-05 | Out of bounds Read vulnerability in ssmis_get_frm in libsubextractor.so prior to SMR Mar-2024 Release 1 allows local attackers to read out of bounds memory. |
CVE-2024-20835 | Medium | 4.0 | 2024-03-05 | Improper access control vulnerability in CustomFrequencyManagerService prior to SMR Mar-2024 Release 1 allows local attackers to execute privileged behaviors. |
CVE-2024-20834 | Low | 3.3 | 2024-03-05 | The sensitive information exposure vulnerability in WlanTest prior to SMR Mar-2024 Release 1 allows local attackers to access MAC address without proper permis… |
CVE-2024-20832 | Medium | 6.4 | 2024-03-05 | Heap overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2024-20831 | Medium | 6.4 | 2024-03-05 | Stack overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows local privileged attackers to execute arbitrary code. |
CVE-2024-20830 | Medium | 5.3 | 2024-03-05 | Incorrect default permission in AppLock prior to SMR MAr-2024 Release 1 allows local attackers to configure AppLock settings. |
CVE-2024-20829 | Medium | 5.4 | 2024-03-05 | Missing proper interaction for opening deeplink in Samsung Internet prior to version v24.0.0.0 allows remote attackers to open an application without proper in… |
CVE-2024-22383 | Medium | 6.2 | 2024-03-05 | Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover… |
CVE-2024-21838 | Medium | 6.8 | 2024-03-05 | Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injec… |
CVE-2024-21815 | Critical | 9.1 | 2024-03-05 | Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged… |
CVE-2024-22188 | High | 7.2 | 2024-03-05 | TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web… |
CVE-2024-1782 | Medium | 6.1 | 2024-03-05 | The Blue Triad EZAnalytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'bt_webid' parameter in all versions up to, and includi… |
CVE-2024-1769 | Medium | 5.3 | 2024-03-05 | The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 14 via the meta description data. This ma… |
CVE-2024-1731 | High | 8.8 | 2024-03-05 | The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrus… |
CVE-2024-1478 | Medium | 5.3 | 2024-03-05 | The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.1 via the REST API. This ma… |
CVE-2024-1381 | Medium | 6.5 | 2024-03-05 | The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2024-1285 | Medium | 6.5 | 2024-03-05 | The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca… |
CVE-2024-1178 | Medium | 5.3 | 2024-03-05 | The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-1095 | Medium | 5.3 | 2024-03-05 | The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch… |
CVE-2024-1093 | Medium | 5.3 | 2024-03-05 | The Change Memory Limit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_logic() function… |
CVE-2024-1088 | Medium | 5.3 | 2024-03-05 | The Password Protected Store for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via… |
CVE-2024-0825 | High | 8.8 | 2024-03-05 | The Vimeography: Vimeo Video Gallery WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.2 vi… |
CVE-2024-0698 | Medium | 6.4 | 2024-03-05 | The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, an… |
CVE-2024-25269 | High | 7.5 | 2024-03-05 | libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack. |