2024 CVEs (page 355)
Page 355 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27718 | High | 7.8 | 2024-03-05 | SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privi… |
CVE-2024-25731 | High | 7.5 | 2024-03-05 | The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file. Thus… |
CVE-2024-25164 | High | 7.5 | 2024-03-05 | iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality. |
CVE-2024-1936 | High | 7.5 | 2024-03-04 | The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Conse… |
CVE-2024-2168 | Medium | 4.7 | 2024-03-04 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function o… |
CVE-2024-1319 | Medium | 4.3 | 2024-03-04 | The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post typ… |
CVE-2024-1316 | Medium | 6.5 | 2024-03-04 | The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the co… |
CVE-2024-2048 | High | 8.1 | 2024-03-04 | Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as tr… |
CVE-2024-27889 | High | 8.8 | 2024-03-04 | Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advance… |
CVE-2024-27199 | High | 7.3 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible |
CVE-2024-27198 | Critical | 9.8 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible |
CVE-2024-27694 | High | 7.4 | 2024-03-04 | FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the /system/share/ztree_category_edit. |
CVE-2024-27680 | Medium | 6.1 | 2024-03-04 | Flusity-CMS v2.33 is vulnerable to Cross Site Scripting (XSS) in the "Contact form." |
CVE-2024-27668 | Medium | 6.1 | 2024-03-04 | Flusity-CMS v2.33 is affected by: Cross Site Scripting (XSS) in 'Custom Blocks.' |
CVE-2024-27684 | Medium | 6.1 | 2024-03-04 | A Cross-site scripting (XSS) vulnerability in dlapn.cgi, dldongle.cgi, dlcfg.cgi, fwup.cgi and seama.cgi in D-Link GORTAC750_A1_FW_v101b03 allows remote attack… |
CVE-2024-24901 | Low | 3.0 | 2024-03-04 | Dell PowerScale OneFS 8.2.x through 9.6.0.x contain an insufficient logging vulnerability. A local malicious user with high privileges could potentially exploi… |
CVE-2024-22463 | High | 7.4 | 2024-03-04 | Dell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unprivileged attacker could pot… |
CVE-2024-22452 | High | 7.3 | 2024-03-04 | Dell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access control vulnerability. A low privilege user could potentially exploit th… |
CVE-2024-0156 | High | 7.0 | 2024-03-04 | Dell Digital Delivery, versions prior to 5.2.0.0, contain a Buffer Overflow Vulnerability. A local low privileged attacker could potentially exploit this vulne… |
CVE-2024-0155 | High | 7.0 | 2024-03-04 | Dell Digital Delivery, versions prior to 5.2.0.0, contain a Use After Free Vulnerability. A local low privileged attacker could potentially exploit this vulner… |
CVE-2024-26622 | High | 7.8 | 2024-03-04 | In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyo_write_control() Since tomoyo_write_control() updates… |
CVE-2024-21826 | Medium | 4.3 | 2024-03-04 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause sensitive information leak through insecure storage. |
CVE-2024-21816 | Medium | 4.0 | 2024-03-04 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through improper preservation of permissions. |
CVE-2024-20038 | Low | 3.4 | 2024-03-04 | In pq, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privilege… |
CVE-2024-20037 | Medium | 6.7 | 2024-03-04 | In pq, there is a possible write-what-where condition due to an incorrect bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2024-20036 | Medium | 4.4 | 2024-03-04 | In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges ne… |
CVE-2024-20034 | High | 7.2 | 2024-03-04 | In battery, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2024-20033 | Medium | 4.4 | 2024-03-04 | In nvram, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2024-20032 | Medium | 6.7 | 2024-03-04 | In aee, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privile… |
CVE-2024-20031 | Medium | 6.7 | 2024-03-04 | In da, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2024-20030 | Medium | 4.4 | 2024-03-04 | In da, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privi… |
CVE-2024-20029 | High | 8.4 | 2024-03-04 | In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execut… |
CVE-2024-20028 | Medium | 6.6 | 2024-03-04 | In da, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2024-20027 | High | 7.9 | 2024-03-04 | In da, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privile… |
CVE-2024-20026 | Medium | 4.2 | 2024-03-04 | In da, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privi… |
CVE-2024-20025 | Medium | 6.7 | 2024-03-04 | In da, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2024-20024 | Medium | 6.0 | 2024-03-04 | In flashc, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges… |
CVE-2024-20023 | Medium | 6.7 | 2024-03-04 | In flashc, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges… |
CVE-2024-20022 | Medium | 6.7 | 2024-03-04 | In lk, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2024-20020 | Medium | 4.4 | 2024-03-04 | In OPTEE, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2024-20019 | Medium | 5.9 | 2024-03-04 | In wlan driver, there is a possible memory leak due to improper input handling. This could lead to remote denial of service with no additional execution privil… |
CVE-2024-20018 | Critical | 9.8 | 2024-03-04 | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional e… |
CVE-2024-20017 | Critical | 9.8 | 2024-03-04 | In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional executio… |
CVE-2024-20005 | High | 8.2 | 2024-03-04 | In da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2024-2156 | Medium | 6.3 | 2024-03-04 | A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. Affected is an unknown function of the file adm… |
CVE-2024-2155 | Medium | 4.3 | 2024-03-04 | A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown processing of the fil… |
CVE-2024-2154 | Medium | 6.3 | 2024-03-04 | A vulnerability has been found in SourceCodester Online Mobile Management Store 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-2153 | Medium | 6.3 | 2024-03-04 | A vulnerability, which was classified as critical, was found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /ad… |
CVE-2024-2152 | Medium | 4.7 | 2024-03-04 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Mobile Management Store 1.0. Affected by this issue is some unknown… |
CVE-2024-2151 | Medium | 4.3 | 2024-03-04 | A vulnerability classified as problematic was found in SourceCodester Online Mobile Management Store 1.0. Affected by this vulnerability is an unknown function… |
CVE-2024-28088 | High | 8.1 | 2024-03-04 | LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypa… |
CVE-2024-28084 | High | 7.5 | 2024-03-03 | p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact bec… |
CVE-2024-2150 | Medium | 5.3 | 2024-03-03 | A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. This issue affects some unknown processing… |
CVE-2024-2149 | Medium | 4.7 | 2024-03-03 | A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file settings.ph… |
CVE-2024-2148 | Medium | 6.3 | 2024-03-03 | A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/U… |
CVE-2024-2147 | High | 7.3 | 2024-03-03 | A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. Affected by this issue is some unknown functiona… |
CVE-2024-2146 | Low | 3.5 | 2024-03-03 | A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been declared as problematic. Affected by this vulnerability is an unkno… |
CVE-2024-0765 | Medium | 6.5 | 2024-03-03 | As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that e… |
CVE-2024-2145 | Low | 3.5 | 2024-03-03 | A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been classified as problematic. Affected is an unknown function of the f… |
CVE-2024-22355 | Medium | 5.9 | 2024-03-03 | IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not require that users should have strong… |
CVE-2024-27255 | Medium | 5.9 | 2024-03-03 | IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker t… |
CVE-2024-26469 | High | 8.1 | 2024-03-03 | Server-Side Request Forgery (SSRF) vulnerability in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remot… |
CVE-2024-25847 | Critical | 9.8 | 2024-03-03 | SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, al… |
CVE-2024-25842 | High | 7.5 | 2024-03-03 | An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" (prestasalesmanager) module for PrestaShop before version 9.0… |
CVE-2024-25839 | High | 7.5 | 2024-03-03 | An issue was discovered in Webbax "Super Newsletter" (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate pri… |
CVE-2024-24302 | Critical | 9.8 | 2024-03-03 | An issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute ar… |
CVE-2024-25844 | High | 7.5 | 2024-03-03 | An issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop before version 4.1.26, allows remote attackers to escalate pr… |
CVE-2024-25551 | Medium | 6.1 | 2024-03-03 | Cross Site Scripting (XSS) vulnerability in sourcecodester Simple Student Attendance System v1.0 allows attackers to execute arbitrary code via crafted GET req… |
CVE-2024-24307 | High | 7.5 | 2024-03-03 | Path Traversal vulnerability in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows a remote attacker to esca… |
CVE-2024-25016 | High | 7.5 | 2024-03-03 | IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffe… |
CVE-2024-2135 | Low | 2.4 | 2024-03-03 | A vulnerability was found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This issue affects some unknown processing of the file /h… |
CVE-2024-2134 | Medium | 4.3 | 2024-03-03 | A vulnerability has been found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-2133 | Low | 2.4 | 2024-03-03 | A vulnerability, which was classified as problematic, was found in Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 4.0. This affects an unknown part… |
CVE-2024-26621 | High | 8.2 | 2024-03-02 | In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: don't force huge page alignment on 32 bit commit efa7df3e3bb5 ("mm: alig… |
CVE-2024-25865 | Medium | 6.1 | 2024-03-02 | Cross Site Scripting (XSS) vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia search function. |
CVE-2024-0795 | High | 7.2 | 2024-03-02 | If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating… |
CVE-2024-1398 | Medium | 6.4 | 2024-03-02 | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_title_tag’ and ’heading_sub_ti… |
CVE-2024-1449 | Medium | 6.4 | 2024-03-02 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slide shortcode in all versio… |
CVE-2024-0611 | Medium | 4.4 | 2024-03-02 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slides callback functionality in all vers… |
CVE-2024-0378 | Medium | 6.5 | 2024-03-02 | The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when di… |
CVE-2024-1775 | Medium | 5.4 | 2024-03-02 | The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the ‘error_description’ parameter i… |
CVE-2024-1592 | Medium | 4.3 | 2024-03-02 | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.6. This is… |
CVE-2024-25064 | Medium | 4.3 | 2024-03-02 | Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by cha… |
CVE-2024-25063 | High | 7.5 | 2024-03-02 | Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker… |
CVE-2024-27355 | High | 7.5 | 2024-03-01 | An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate… |
CVE-2024-27354 | High | 7.5 | 2024-03-01 | An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing… |
CVE-2024-25438 | Medium | 6.1 | 2024-03-01 | A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted pay… |
CVE-2024-25436 | Medium | 6.1 | 2024-03-01 | A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted pay… |
CVE-2024-25434 | Medium | 5.4 | 2024-03-01 | A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Pu… |
CVE-2024-24512 | Medium | 6.1 | 2024-03-01 | Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component. |
CVE-2024-24511 | Medium | 6.1 | 2024-03-01 | Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component. |
CVE-2024-27747 | Critical | 9.8 | 2024-03-01 | File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image paramet… |
CVE-2024-27746 | Critical | 9.8 | 2024-03-01 | SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address par… |
CVE-2024-27744 | Medium | 6.1 | 2024-03-01 | Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image para… |
CVE-2024-27743 | Medium | 6.1 | 2024-03-01 | Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the Address pa… |
CVE-2024-1869 | High | 7.5 | 2024-03-01 | Certain HP DesignJet print products are potentially vulnerable to information disclosure related to accessing memory out-of-bounds when using the general-purpo… |
CVE-2024-27101 | High | 7.3 | 2024-03-01 | SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking… |
CVE-2024-23492 | Medium | 5.7 | 2024-03-01 | A weak encoding is used to transmit credentials for WS203VICM. |
CVE-2024-22182 | High | 8.6 | 2024-03-01 | A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to restart, interruptin… |
CVE-2024-21767 | Critical | 9.4 | 2024-03-01 | A remote attacker may be able to bypass access control of Commend WS203VICM by creating a malicious request. |