2024 CVEs (page 360)
Page 360 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25399 | Medium | 6.1 | 2024-02-27 | Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php. |
CVE-2024-25398 | High | 7.5 | 2024-02-27 | In Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt the service. |
CVE-2024-1923 | Medium | 6.3 | 2024-02-27 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as critical. Affected by this issue is the function delete_clas… |
CVE-2024-1922 | Low | 3.5 | 2024-02-27 | A vulnerability has been found in SourceCodester Online Job Portal 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-1403 | Critical | 10.0 | 2024-02-27 | In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypa… |
CVE-2024-27905 | Critical | 9.1 | 2024-02-27 | ** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to u… |
CVE-2024-27507 | High | 7.5 | 2024-02-27 | libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp. |
CVE-2024-25723 | High | 8.8 | 2024-02-27 | ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/acti… |
CVE-2024-1921 | Medium | 4.7 | 2024-02-27 | A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Set… |
CVE-2024-1920 | Medium | 5.6 | 2024-02-27 | A vulnerability, which was classified as critical, has been found in osuuu LightPicture up to 1.2.2. This issue affects the function handle of the file /app/mi… |
CVE-2024-1919 | Low | 3.5 | 2024-02-27 | A vulnerability classified as problematic was found in SourceCodester Online Job Portal 1.0. This vulnerability affects unknown code of the file /Employer/Mana… |
CVE-2024-0819 | High | 7.3 | 2024-02-27 | Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and macOS, allow a low privileged user to ele… |
CVE-2024-0551 | High | 7.1 | 2024-02-27 | Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access… |
CVE-2024-1918 | Medium | 4.7 | 2024-02-27 | A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2024-0197 | High | 7.8 | 2024-02-27 | A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access. |
CVE-2024-1912 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1910 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1909 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1907 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1906 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1653 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxUpdateFolderPosit… |
CVE-2024-1652 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxClearCategory fun… |
CVE-2024-1650 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxRenameCategory fu… |
CVE-2024-1649 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxDeleteCategory fu… |
CVE-2024-1106 | Medium | 6.1 | 2024-02-27 | The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-0855 | Medium | 5.3 | 2024-02-27 | The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to… |
CVE-2024-1698 | Critical | 9.8 | 2024-02-27 | The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injecti… |
CVE-2024-1687 | Medium | 5.4 | 2024-02-27 | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing… |
CVE-2024-1686 | Medium | 4.3 | 2024-02-27 | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and in… |
CVE-2024-0759 | High | 7.5 | 2024-02-27 | Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could li… |
CVE-2024-1323 | Medium | 6.4 | 2024-02-27 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Type Grid Widget Title in all versions up to… |
CVE-2024-25711 | High | 7.5 | 2024-02-27 | diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an a… |
CVE-2024-24100 | High | 8.3 | 2024-02-27 | Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via PublisherID. |
CVE-2024-24099 | Medium | 5.4 | 2024-02-27 | Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Employment Status Information Update. |
CVE-2024-24096 | High | 7.8 | 2024-02-27 | Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via BookSBIN. |
CVE-2024-24095 | Critical | 9.8 | 2024-02-27 | Code-projects Simple Stock System 1.0 is vulnerable to SQL Injection. |
CVE-2024-22917 | High | 8.6 | 2024-02-27 | SQL injection vulnerability in Dynamic Lab Management System Project in PHP v.1.0 allows a remote attacker to execute arbitrary code via a crafted script. |
CVE-2024-27356 | High | 7.5 | 2024-02-27 | An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. Th… |
CVE-2024-25166 | Medium | 6.1 | 2024-02-27 | Cross Site Scripting vulnerability in 71CMS v.1.0.0 allows a remote attacker to execute arbitrary code via the uploadfile action parameter in the controller.ph… |
CVE-2024-24720 | Medium | 5.3 | 2024-02-27 | An issue was discovered in the Forgot password function in Innovaphone PBX before 14r1 devices. It provides information about whether a user exists on a system. |
CVE-2024-22544 | High | 8.0 | 2024-02-27 | An issue was discovered in Linksys Router E1700 version 1.0.04 (build 3), allows authenticated attackers to execute arbitrary code via the setDateTime function. |
CVE-2024-22543 | Medium | 6.1 | 2024-02-27 | An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges via a crafted GET request to the /gofor… |
CVE-2024-24721 | Medium | 6.5 | 2024-02-27 | An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker… |
CVE-2024-25247 | Critical | 9.8 | 2024-02-26 | SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latitude and longitude para… |
CVE-2024-27093 | Medium | 4.6 | 2024-02-26 | Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or d… |
CVE-2024-25751 | Critical | 9.8 | 2024-02-26 | A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via… |
CVE-2024-25248 | Critical | 9.8 | 2024-02-26 | SQL Injection vulnerability in the orderGoodsDelivery() function in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via the order_id parameter. |
CVE-2024-26149 | Low | 3.7 | 2024-02-26 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in… |
CVE-2024-24564 | Low | 3.7 | 2024-02-26 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has… |
CVE-2024-1899 | Medium | 5.3 | 2024-02-26 | An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions. |
CVE-2024-26455 | High | 7.5 | 2024-02-26 | fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom_calyptia/calyptia.c. |
CVE-2024-25770 | Medium | 4.3 | 2024-02-26 | libming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c. |
CVE-2024-25768 | High | 7.5 | 2024-02-26 | OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c. |
CVE-2024-27088 | Unrated | | 2024-02-26 | es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTo… |
CVE-2024-27087 | Medium | 4.6 | 2024-02-26 | Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the r… |
CVE-2024-27081 | High | 7.2 | 2024-02-26 | ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version… |
CVE-2024-25767 | Medium | 6.5 | 2024-02-26 | nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c. |
CVE-2024-24402 | Critical | 9.8 | 2024-02-26 | An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component. |
CVE-2024-24401 | Critical | 9.8 | 2024-02-26 | SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php compone… |
CVE-2024-27456 | Critical | 9.1 | 2024-02-26 | rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files. |
CVE-2024-27455 | Critical | 9.1 | 2024-02-26 | In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files… |
CVE-2024-27454 | High | 7.5 | 2024-02-26 | orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. |
CVE-2024-27447 | Critical | 9.8 | 2024-02-26 | pretix before 2024.1.1 mishandles file validation. |
CVE-2024-27444 | Critical | 9.8 | 2024-02-26 | langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code vi… |
CVE-2024-27359 | High | 7.5 | 2024-02-26 | Certain WithSecure products allow a Denial of Service because the engine scanner can go into an infinite loop when processing an archive file. This affects Wit… |
CVE-2024-27350 | Medium | 5.9 | 2024-02-26 | Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB (Android Debug Bridge) connections. NOTE: some third pa… |
CVE-2024-26606 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend on I/O ev… |
CVE-2024-26605 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix deadlock when enabling ASPM A last minute revert in 6.7-final introduced a… |
CVE-2024-26604 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: Revert "kobject: Remove redundant checks for whether ktype is NULL" This reverts commit 1… |
CVE-2024-26603 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Stop relying on userspace for info to fault in xsave buffer Before this change… |
CVE-2024-26602 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_mem… |
CVE-2024-26601 | High | 7.8 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts… |
CVE-2024-26600 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP If the external phy working… |
CVE-2024-26468 | Medium | 6.1 | 2024-02-26 | A DOM based cross-site scripting (XSS) vulnerability in the component index.html of jstrieb/urlpages before commit 035b647 allows attackers to execute arbitrar… |
CVE-2024-26467 | Medium | 6.1 | 2024-02-26 | A DOM based cross-site scripting (XSS) vulnerability in the component generator.html of tabatkins/railroad-diagrams before commit ea9a123 allows attackers to e… |
CVE-2024-26466 | Medium | 6.1 | 2024-02-26 | A DOM based cross-site scripting (XSS) vulnerability in the component /dom/ranges/Range-test-iframe.html of web-platform-tests/wpt before commit 938e843 allows… |
CVE-2024-26465 | Medium | 6.1 | 2024-02-26 | A DOM based cross-site scripting (XSS) vulnerability in the component /beep/Beep.Instrument.js of stewdio beep.js before commit ef22ad7 allows attackers to exe… |
CVE-2024-25925 | Critical | 10.0 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in SYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Discounts.This issue affects WooComme… |
CVE-2024-25913 | Critical | 10.0 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2. |
CVE-2024-25909 | Critical | 9.9 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2. |
CVE-2024-25763 | Medium | 5.5 | 2024-02-26 | openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c. |
CVE-2024-25410 | Medium | 6.5 | 2024-02-26 | flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php. |
CVE-2024-25344 | Medium | 6.1 | 2024-02-26 | Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execute arbitrary code an… |
CVE-2024-25082 | Medium | 6.5 | 2024-02-26 | Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. |
CVE-2024-25081 | Medium | 4.2 | 2024-02-26 | Splinefont in FontForge through 20230101 allows command injection via crafted filenames. |
CVE-2024-24714 | High | 7.2 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4. |
CVE-2024-24568 | Medium | 5.3 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTT… |
CVE-2024-23839 | High | 7.1 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, specially crafted traffi… |
CVE-2024-23837 | High | 7.5 | 2024-02-26 | LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. Thi… |
CVE-2024-23836 | High | 7.5 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an at… |
CVE-2024-23835 | High | 7.5 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.3, excessive memory… |
CVE-2024-23605 | High | 8.8 | 2024-02-26 | A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can… |
CVE-2024-23496 | High | 8.8 | 2024-02-26 | A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file… |
CVE-2024-22873 | High | 8.1 | 2024-02-26 | Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscriptio… |
CVE-2024-22371 | Low | 2.9 | 2024-02-26 | Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Ap… |
CVE-2024-22201 | High | 7.5 | 2024-02-26 | Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attack… |
CVE-2024-21836 | High | 8.8 | 2024-02-26 | A heap-based buffer overflow vulnerability exists in the GGUF library header.n_tensors functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf fil… |
CVE-2024-21825 | High | 8.8 | 2024-02-26 | A heap-based buffer overflow vulnerability exists in the GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality of llama.cpp Commit 18c2e17. A spe… |
CVE-2024-21802 | High | 8.8 | 2024-02-26 | A heap-based buffer overflow vulnerability exists in the GGUF library info->ne functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can… |
CVE-2024-1890 | Medium | 6.4 | 2024-02-26 | Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack… |