2024 CVEs (page 356)
Page 356 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20328 | Medium | 5.3 | 2024-03-01 | A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service ac… |
CVE-2024-1174 | High | 8.2 | 2024-03-01 | Previous versions of HP ThinPro (prior to HP ThinPro 8.0 SP 8) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.0 SP 8, which i… |
CVE-2024-2077 | Medium | 6.3 | 2024-03-01 | A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file index.php. T… |
CVE-2024-2076 | Medium | 5.3 | 2024-03-01 | A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionali… |
CVE-2024-1453 | High | 7.8 | 2024-03-01 | In Sante DICOM Viewer Pro versions 14.0.3 and prior, a user must open a malicious DICOM file, which could allow a local attacker to disclose information or ex… |
CVE-2024-2075 | Low | 3.5 | 2024-03-01 | A vulnerability was found in SourceCodester Daily Habit Tracker 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown function… |
CVE-2024-2074 | Medium | 6.3 | 2024-03-01 | A vulnerability was found in Mini-Tmall up to 20231017 and classified as critical. This issue affects some unknown processing of the file ?r=tmall/admin/user/1… |
CVE-2024-27298 | Critical | 10.0 | 2024-03-01 | parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. T… |
CVE-2024-2073 | Medium | 6.3 | 2024-03-01 | A vulnerability has been found in SourceCodester Block Inserter for Dynamic Content 1.0 and classified as critical. This vulnerability affects unknown code of… |
CVE-2024-2072 | Low | 3.5 | 2024-03-01 | A vulnerability, which was classified as problematic, was found in SourceCodester Flashcard Quiz App 1.0. This affects an unknown part of the file /endpoint/up… |
CVE-2024-2071 | Low | 3.5 | 2024-03-01 | A vulnerability, which was classified as problematic, has been found in SourceCodester FAQ Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2024-27734 | Medium | 6.1 | 2024-03-01 | A Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name fields of the Site S… |
CVE-2024-27689 | High | 8.8 | 2024-03-01 | Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via /update-article.php. |
CVE-2024-27559 | Medium | 6.3 | 2024-03-01 | Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /save_settings.php |
CVE-2024-27558 | Medium | 6.1 | 2024-03-01 | Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings. |
CVE-2024-2070 | Low | 3.5 | 2024-03-01 | A vulnerability classified as problematic was found in SourceCodester FAQ Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-2069 | Medium | 6.3 | 2024-03-01 | A vulnerability classified as critical has been found in SourceCodester FAQ Management System 1.0. Affected is an unknown function of the file /endpoint/delete… |
CVE-2024-2068 | Low | 3.5 | 2024-03-01 | A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been rated as problematic. This issue affects some unknown processing of the… |
CVE-2024-27499 | Medium | 6.5 | 2024-03-01 | Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. |
CVE-2024-27296 | Medium | 5.3 | 2024-03-01 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped i… |
CVE-2024-27295 | High | 8.2 | 2024-03-01 | Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to recei… |
CVE-2024-27140 | Medium | 5.4 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This is… |
CVE-2024-27139 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker… |
CVE-2024-27138 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however th… |
CVE-2024-1624 | Critical | 9.4 | 2024-03-01 | An OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x, SIMU… |
CVE-2024-2067 | Medium | 6.3 | 2024-03-01 | A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-2066 | Low | 2.4 | 2024-03-01 | A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been classified as problematic. This affects an unknown part of the file /end… |
CVE-2024-2065 | Low | 3.5 | 2024-03-01 | A vulnerability was found in SourceCodester Barangay Population Monitoring System up to 1.0 and classified as problematic. Affected by this issue is some unkno… |
CVE-2024-27497 | High | 8.8 | 2024-03-01 | Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file. |
CVE-2024-0967 | Medium | 4.3 | 2024-03-01 | A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Enterprise Security Manager (ESM). The vulnerability could be remotely exploit… |
CVE-2024-2064 | Medium | 4.3 | 2024-03-01 | A vulnerability has been found in rahman SelectCours 1.0 and classified as problematic. Affected by this vulnerability is the function getCacheNames of the fil… |
CVE-2024-27572 | High | 7.5 | 2024-03-01 | LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the updateCurAPlist function. This vulnerability allows attac… |
CVE-2024-27571 | High | 7.5 | 2024-03-01 | LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the makeCurRemoteApList function. This vulnerability allows a… |
CVE-2024-27570 | High | 7.5 | 2024-03-01 | LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the generate_conf_router function. This vulnerability allows… |
CVE-2024-27569 | Medium | 6.5 | 2024-03-01 | LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the init_nvram function. This vulnerability allows attackers… |
CVE-2024-27568 | Medium | 6.5 | 2024-03-01 | LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the apn_name_3g parameter in the setupEC20Apn function. This vulnerability allows attack… |
CVE-2024-27567 | Medium | 6.5 | 2024-03-01 | LBT T300- T390 v2.2.1.8 were discovered to contain a stack overflow via the vpn_client_ip parameter in the config_vpn_pptp function. This vulnerability allows… |
CVE-2024-24907 | High | 7.6 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. An adjacent network… |
CVE-2024-24905 | High | 7.6 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged att… |
CVE-2024-24904 | High | 7.6 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged att… |
CVE-2024-24903 | High | 8.0 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low pr… |
CVE-2024-2063 | Low | 2.4 | 2024-03-01 | A vulnerability, which was classified as problematic, was found in SourceCodester Petrol Pump Management Software 1.0. Affected is an unknown function of the f… |
CVE-2024-2062 | Medium | 4.7 | 2024-03-01 | A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. This issue affects some unknown proces… |
CVE-2024-2061 | Medium | 4.7 | 2024-03-01 | A vulnerability classified as critical was found in SourceCodester Petrol Pump Management Software 1.0. This vulnerability affects unknown code of the file /ad… |
CVE-2024-2060 | Medium | 4.7 | 2024-03-01 | A vulnerability classified as critical has been found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /admin/ap… |
CVE-2024-24906 | High | 7.6 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page. An adjacent network high… |
CVE-2024-24900 | Medium | 5.8 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low privileged attacker co… |
CVE-2024-2078 | Medium | 4.6 | 2024-03-01 | A Cross-Site Scripting (XSS) vulnerability has been found in HelpDeskZ affecting version 2.0.2 and earlier. This vulnerability could allow an attacker to send… |
CVE-2024-2059 | Medium | 4.7 | 2024-03-01 | A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2024-2057 | Medium | 6.3 | 2024-03-01 | A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/… |
CVE-2024-2058 | Medium | 4.7 | 2024-03-01 | A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2024-26280 | Medium | 4.7 | 2024-03-01 | Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag… |
CVE-2024-22458 | Low | 3.7 | 2024-03-01 | Dell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this… |
CVE-2024-22457 | High | 7.1 | 2024-03-01 | Dell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path. A remote low privileged attacker could po… |
CVE-2024-25972 | High | 8.3 | 2024-03-01 | Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd. allows a network-adjacent unaut… |
CVE-2024-1120 | Medium | 5.3 | 2024-03-01 | The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to u… |
CVE-2024-25091 | Critical | 9.1 | 2024-03-01 | Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feature) and RevoWorks… |
CVE-2024-0692 | High | 8.8 | 2024-03-01 | The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarW… |
CVE-2024-27950 | Medium | 5.4 | 2024-03-01 | Missing Authorization vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.0. |
CVE-2024-27949 | Medium | 5.4 | 2024-03-01 | Server-Side Request Forgery (SSRF) vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.0. |
CVE-2024-25552 | High | 7.8 | 2024-03-01 | A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product. |
CVE-2024-1859 | High | 8.8 | 2024-03-01 | The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includi… |
CVE-2024-25386 | High | 8.8 | 2024-03-01 | Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the f… |
CVE-2024-25293 | Critical | 9.3 | 2024-03-01 | mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute. |
CVE-2024-22891 | Critical | 9.8 | 2024-03-01 | Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. |
CVE-2024-25578 | High | 7.8 | 2024-03-01 | MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior contain a lack of proper validation of user-supplied data, which could result in memory corru… |
CVE-2024-22100 | High | 7.8 | 2024-03-01 | MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker t… |
CVE-2024-1941 | High | 7.8 | 2024-03-01 | Delta Electronics CNCSoft-B versions 1.0.0.4 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code… |
CVE-2024-2045 | Medium | 5.5 | 2024-03-01 | Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible becau… |
CVE-2024-2022 | Medium | 6.3 | 2024-03-01 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2024-2021 | Medium | 6.3 | 2024-03-01 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. Affected is an unknown function of the file… |
CVE-2024-0403 | Medium | 6.5 | 2024-03-01 | Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. This is possible because the application is vulnerable to SSRF. |
CVE-2024-27294 | High | 7.3 | 2024-02-29 | dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership wh… |
CVE-2024-2009 | Medium | 5.3 | 2024-02-29 | A vulnerability was found in Nway Pro 9. It has been rated as problematic. Affected by this issue is the function ajax_login_submit_form of the file login\inde… |
CVE-2024-27662 | Medium | 6.5 | 2024-02-29 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a Null-pointer dereferences in sub_4110f4(). This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2024-27661 | Medium | 6.5 | 2024-02-29 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain Null-pointer dereferences in sub_4484A8(). This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2024-27660 | Medium | 6.5 | 2024-02-29 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a Null-pointer dereferences in sub_41C488(). This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2024-27659 | Medium | 6.5 | 2024-02-29 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain Null-pointer dereferences in sub_42AF30(). This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2024-27658 | Medium | 6.5 | 2024-02-29 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain Null-pointer dereferences in sub_4484A8(). This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2024-27657 | High | 8.8 | 2024-02-29 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the User-Agent parameter. This vulnerability allows attackers to cause a Denial of… |
CVE-2024-27656 | High | 8.8 | 2024-02-29 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Cookie parameter. This vulnerability allows attackers to cause a Denial of Serv… |
CVE-2024-27655 | High | 8.8 | 2024-02-29 | D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the SOAPACTION parameter. This vulnerability allows attackers to cause a Denial of… |
CVE-2024-26548 | Critical | 9.8 | 2024-02-29 | An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the upload_file.cgi compone… |
CVE-2024-24246 | Medium | 5.5 | 2024-02-29 | Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h. |
CVE-2024-1595 | High | 7.8 | 2024-02-29 | Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82 insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system… |
CVE-2024-0068 | Medium | 5.5 | 2024-02-29 | Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows File Manipulation.This issue affects Work… |
CVE-2024-25180 | Critical | 9.8 | 2024-02-29 | An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. NOTE: this is disputed becaus… |
CVE-2024-20765 | High | 7.8 | 2024-02-29 | Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2024-2001 | Medium | 5.5 | 2024-02-29 | A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF fil… |
CVE-2024-0864 | Critical | 9.8 | 2024-02-29 | Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation… |
CVE-2024-26607 | Medium | 4.7 | 2024-02-29 | In the Linux kernel, the following vulnerability has been resolved: drm/bridge: sii902x: Fix probing race issue A null pointer dereference crash has been obs… |
CVE-2024-27906 | Medium | 5.9 | 2024-02-29 | Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permissi… |
CVE-2024-1953 | Medium | 4.3 | 2024-02-29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowi… |
CVE-2024-1952 | Low | 3.1 | 2024-02-29 | Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated atta… |
CVE-2024-1949 | Low | 2.6 | 2024-02-29 | A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual p… |
CVE-2024-1942 | Medium | 4.3 | 2024-02-29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, w… |
CVE-2024-1619 | Medium | 6.1 | 2024-02-29 | Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially force an administrat… |
CVE-2024-1888 | Medium | 4.3 | 2024-02-29 | Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members… |
CVE-2024-24988 | Medium | 4.3 | 2024-02-29 | Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string a… |
CVE-2024-23493 | Medium | 4.3 | 2024-02-29 | Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that… |