2024 CVEs (page 356)
Page 356 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25016 | High | 7.5 | 2024-03-03 | IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffe… |
CVE-2024-2135 | Low | 2.4 | 2024-03-03 | A vulnerability was found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This issue affects some unknown processing of the file /h… |
CVE-2024-2134 | Medium | 4.3 | 2024-03-03 | A vulnerability has been found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-2133 | Low | 2.4 | 2024-03-03 | A vulnerability, which was classified as problematic, was found in Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 4.0. This affects an unknown part… |
CVE-2024-26621 | High | 8.2 | 2024-03-02 | In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: don't force huge page alignment on 32 bit commit efa7df3e3bb5 ("mm: alig… |
CVE-2024-25865 | Medium | 6.1 | 2024-03-02 | Cross Site Scripting (XSS) vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia search function. |
CVE-2024-0795 | High | 7.2 | 2024-03-02 | If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating… |
CVE-2024-1398 | Medium | 6.4 | 2024-03-02 | The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_title_tag’ and ’heading_sub_ti… |
CVE-2024-1449 | Medium | 6.4 | 2024-03-02 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slide shortcode in all versio… |
CVE-2024-0611 | Medium | 4.4 | 2024-03-02 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slides callback functionality in all vers… |
CVE-2024-0378 | Medium | 6.5 | 2024-03-02 | The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when di… |
CVE-2024-1775 | Medium | 5.4 | 2024-03-02 | The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the ‘error_description’ parameter i… |
CVE-2024-1592 | Medium | 4.3 | 2024-03-02 | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.6. This is… |
CVE-2024-25064 | Medium | 4.3 | 2024-03-02 | Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by cha… |
CVE-2024-25063 | High | 7.5 | 2024-03-02 | Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker… |
CVE-2024-27355 | High | 7.5 | 2024-03-01 | An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate… |
CVE-2024-27354 | High | 7.5 | 2024-03-01 | An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing… |
CVE-2024-25438 | Medium | 6.1 | 2024-03-01 | A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted pay… |
CVE-2024-25436 | Medium | 6.1 | 2024-03-01 | A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted pay… |
CVE-2024-25434 | Medium | 5.4 | 2024-03-01 | A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Pu… |
CVE-2024-24512 | Medium | 6.1 | 2024-03-01 | Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component. |
CVE-2024-24511 | Medium | 6.1 | 2024-03-01 | Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component. |
CVE-2024-27747 | Critical | 9.8 | 2024-03-01 | File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image paramet… |
CVE-2024-27746 | Critical | 9.8 | 2024-03-01 | SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address par… |
CVE-2024-27744 | Medium | 6.1 | 2024-03-01 | Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image para… |
CVE-2024-27743 | Medium | 6.1 | 2024-03-01 | Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the Address pa… |
CVE-2024-1869 | High | 7.5 | 2024-03-01 | Certain HP DesignJet print products are potentially vulnerable to information disclosure related to accessing memory out-of-bounds when using the general-purpo… |
CVE-2024-27101 | High | 7.3 | 2024-03-01 | SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking… |
CVE-2024-23492 | Medium | 5.7 | 2024-03-01 | A weak encoding is used to transmit credentials for WS203VICM. |
CVE-2024-22182 | High | 8.6 | 2024-03-01 | A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to restart, interruptin… |
CVE-2024-21767 | Critical | 9.4 | 2024-03-01 | A remote attacker may be able to bypass access control of Commend WS203VICM by creating a malicious request. |
CVE-2024-20328 | Medium | 5.3 | 2024-03-01 | A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service ac… |
CVE-2024-1174 | High | 8.2 | 2024-03-01 | Previous versions of HP ThinPro (prior to HP ThinPro 8.0 SP 8) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.0 SP 8, which i… |
CVE-2024-2077 | Medium | 6.3 | 2024-03-01 | A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file index.php. T… |
CVE-2024-2076 | Medium | 5.3 | 2024-03-01 | A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionali… |
CVE-2024-1453 | High | 7.8 | 2024-03-01 | In Sante DICOM Viewer Pro versions 14.0.3 and prior, a user must open a malicious DICOM file, which could allow a local attacker to disclose information or ex… |
CVE-2024-2075 | Low | 3.5 | 2024-03-01 | A vulnerability was found in SourceCodester Daily Habit Tracker 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown function… |
CVE-2024-2074 | Medium | 6.3 | 2024-03-01 | A vulnerability was found in Mini-Tmall up to 20231017 and classified as critical. This issue affects some unknown processing of the file ?r=tmall/admin/user/1… |
CVE-2024-27298 | Critical | 10.0 | 2024-03-01 | parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. T… |
CVE-2024-2073 | Medium | 6.3 | 2024-03-01 | A vulnerability has been found in SourceCodester Block Inserter for Dynamic Content 1.0 and classified as critical. This vulnerability affects unknown code of… |
CVE-2024-2072 | Low | 3.5 | 2024-03-01 | A vulnerability, which was classified as problematic, was found in SourceCodester Flashcard Quiz App 1.0. This affects an unknown part of the file /endpoint/up… |
CVE-2024-2071 | Low | 3.5 | 2024-03-01 | A vulnerability, which was classified as problematic, has been found in SourceCodester FAQ Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2024-27734 | Medium | 6.1 | 2024-03-01 | A Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name fields of the Site S… |
CVE-2024-27689 | High | 8.8 | 2024-03-01 | Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via /update-article.php. |
CVE-2024-27559 | Medium | 6.3 | 2024-03-01 | Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /save_settings.php |
CVE-2024-27558 | Medium | 6.1 | 2024-03-01 | Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings. |
CVE-2024-2070 | Low | 3.5 | 2024-03-01 | A vulnerability classified as problematic was found in SourceCodester FAQ Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-2069 | Medium | 6.3 | 2024-03-01 | A vulnerability classified as critical has been found in SourceCodester FAQ Management System 1.0. Affected is an unknown function of the file /endpoint/delete… |
CVE-2024-2068 | Low | 3.5 | 2024-03-01 | A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been rated as problematic. This issue affects some unknown processing of the… |
CVE-2024-27499 | Medium | 6.5 | 2024-03-01 | Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. |
CVE-2024-27296 | Medium | 5.3 | 2024-03-01 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped i… |
CVE-2024-27295 | High | 8.2 | 2024-03-01 | Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to recei… |
CVE-2024-27140 | Medium | 5.4 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This is… |
CVE-2024-27139 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker… |
CVE-2024-27138 | High | 7.5 | 2024-03-01 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however th… |
CVE-2024-1624 | Critical | 9.4 | 2024-03-01 | An OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x, SIMU… |
CVE-2024-2067 | Medium | 6.3 | 2024-03-01 | A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-2066 | Low | 2.4 | 2024-03-01 | A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been classified as problematic. This affects an unknown part of the file /end… |
CVE-2024-2065 | Low | 3.5 | 2024-03-01 | A vulnerability was found in SourceCodester Barangay Population Monitoring System up to 1.0 and classified as problematic. Affected by this issue is some unkno… |
CVE-2024-27497 | High | 8.8 | 2024-03-01 | Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file. |
CVE-2024-0967 | Medium | 4.3 | 2024-03-01 | A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Enterprise Security Manager (ESM). The vulnerability could be remotely exploit… |
CVE-2024-2064 | Medium | 4.3 | 2024-03-01 | A vulnerability has been found in rahman SelectCours 1.0 and classified as problematic. Affected by this vulnerability is the function getCacheNames of the fil… |
CVE-2024-27572 | High | 7.5 | 2024-03-01 | LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the updateCurAPlist function. This vulnerability allows attac… |
CVE-2024-27571 | High | 7.5 | 2024-03-01 | LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the makeCurRemoteApList function. This vulnerability allows a… |
CVE-2024-27570 | High | 7.5 | 2024-03-01 | LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the generate_conf_router function. This vulnerability allows… |
CVE-2024-27569 | Medium | 6.5 | 2024-03-01 | LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the init_nvram function. This vulnerability allows attackers… |
CVE-2024-27568 | Medium | 6.5 | 2024-03-01 | LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the apn_name_3g parameter in the setupEC20Apn function. This vulnerability allows attack… |
CVE-2024-27567 | Medium | 6.5 | 2024-03-01 | LBT T300- T390 v2.2.1.8 were discovered to contain a stack overflow via the vpn_client_ip parameter in the config_vpn_pptp function. This vulnerability allows… |
CVE-2024-24907 | High | 7.6 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. An adjacent network… |
CVE-2024-24905 | High | 7.6 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged att… |
CVE-2024-24904 | High | 7.6 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged att… |
CVE-2024-24903 | High | 8.0 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low pr… |
CVE-2024-2063 | Low | 2.4 | 2024-03-01 | A vulnerability, which was classified as problematic, was found in SourceCodester Petrol Pump Management Software 1.0. Affected is an unknown function of the f… |
CVE-2024-2062 | Medium | 4.7 | 2024-03-01 | A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. This issue affects some unknown proces… |
CVE-2024-2061 | Medium | 4.7 | 2024-03-01 | A vulnerability classified as critical was found in SourceCodester Petrol Pump Management Software 1.0. This vulnerability affects unknown code of the file /ad… |
CVE-2024-2060 | Medium | 4.7 | 2024-03-01 | A vulnerability classified as critical has been found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /admin/ap… |
CVE-2024-24906 | High | 7.6 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page. An adjacent network high… |
CVE-2024-24900 | Medium | 5.8 | 2024-03-01 | Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low privileged attacker co… |
CVE-2024-2078 | Medium | 4.6 | 2024-03-01 | A Cross-Site Scripting (XSS) vulnerability has been found in HelpDeskZ affecting version 2.0.2 and earlier. This vulnerability could allow an attacker to send… |
CVE-2024-2059 | Medium | 4.7 | 2024-03-01 | A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2024-2057 | Medium | 6.3 | 2024-03-01 | A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/… |
CVE-2024-2058 | Medium | 4.7 | 2024-03-01 | A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2024-26280 | Medium | 4.7 | 2024-03-01 | Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag… |
CVE-2024-22458 | Low | 3.7 | 2024-03-01 | Dell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this… |
CVE-2024-22457 | High | 7.1 | 2024-03-01 | Dell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path. A remote low privileged attacker could po… |
CVE-2024-25972 | High | 8.3 | 2024-03-01 | Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd. allows a network-adjacent unaut… |
CVE-2024-1120 | Medium | 5.3 | 2024-03-01 | The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to u… |
CVE-2024-25091 | Critical | 9.1 | 2024-03-01 | Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feature) and RevoWorks… |
CVE-2024-0692 | High | 8.8 | 2024-03-01 | The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarW… |
CVE-2024-27950 | Medium | 5.4 | 2024-03-01 | Missing Authorization vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.0. |
CVE-2024-27949 | Medium | 5.4 | 2024-03-01 | Server-Side Request Forgery (SSRF) vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.0. |
CVE-2024-25552 | High | 7.8 | 2024-03-01 | A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product. |
CVE-2024-1859 | High | 8.8 | 2024-03-01 | The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includi… |
CVE-2024-25386 | High | 8.8 | 2024-03-01 | Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the f… |
CVE-2024-25293 | Critical | 9.3 | 2024-03-01 | mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute. |
CVE-2024-22891 | Critical | 9.8 | 2024-03-01 | Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. |
CVE-2024-25578 | High | 7.8 | 2024-03-01 | MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior contain a lack of proper validation of user-supplied data, which could result in memory corru… |
CVE-2024-22100 | High | 7.8 | 2024-03-01 | MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker t… |
CVE-2024-1941 | High | 7.8 | 2024-03-01 | Delta Electronics CNCSoft-B versions 1.0.0.4 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code… |
CVE-2024-2045 | Medium | 5.5 | 2024-03-01 | Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible becau… |