2024 CVEs (page 360)
Page 360 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25711 | High | 7.5 | 2024-02-27 | diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an a… |
CVE-2024-24100 | High | 8.3 | 2024-02-27 | Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via PublisherID. |
CVE-2024-24099 | Medium | 5.4 | 2024-02-27 | Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Employment Status Information Update. |
CVE-2024-24096 | High | 7.8 | 2024-02-27 | Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via BookSBIN. |
CVE-2024-24095 | Critical | 9.8 | 2024-02-27 | Code-projects Simple Stock System 1.0 is vulnerable to SQL Injection. |
CVE-2024-22917 | High | 8.6 | 2024-02-27 | SQL injection vulnerability in Dynamic Lab Management System Project in PHP v.1.0 allows a remote attacker to execute arbitrary code via a crafted script. |
CVE-2024-27356 | High | 7.5 | 2024-02-27 | An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. Th… |
CVE-2024-25166 | Medium | 6.1 | 2024-02-27 | Cross Site Scripting vulnerability in 71CMS v.1.0.0 allows a remote attacker to execute arbitrary code via the uploadfile action parameter in the controller.ph… |
CVE-2024-24720 | Medium | 5.3 | 2024-02-27 | An issue was discovered in the Forgot password function in Innovaphone PBX before 14r1 devices. It provides information about whether a user exists on a system. |
CVE-2024-22544 | High | 8.0 | 2024-02-27 | An issue was discovered in Linksys Router E1700 version 1.0.04 (build 3), allows authenticated attackers to execute arbitrary code via the setDateTime function. |
CVE-2024-22543 | Medium | 6.1 | 2024-02-27 | An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges via a crafted GET request to the /gofor… |
CVE-2024-24721 | Medium | 6.5 | 2024-02-27 | An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker… |
CVE-2024-25247 | Critical | 9.8 | 2024-02-26 | SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latitude and longitude para… |
CVE-2024-27093 | Medium | 4.6 | 2024-02-26 | Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or d… |
CVE-2024-25751 | Critical | 9.8 | 2024-02-26 | A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via… |
CVE-2024-25248 | Critical | 9.8 | 2024-02-26 | SQL Injection vulnerability in the orderGoodsDelivery() function in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via the order_id parameter. |
CVE-2024-26149 | Low | 3.7 | 2024-02-26 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in… |
CVE-2024-24564 | Low | 3.7 | 2024-02-26 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has… |
CVE-2024-1899 | Medium | 5.3 | 2024-02-26 | An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions. |
CVE-2024-26455 | High | 7.5 | 2024-02-26 | fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom_calyptia/calyptia.c. |
CVE-2024-25770 | Medium | 4.3 | 2024-02-26 | libming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c. |
CVE-2024-25768 | High | 7.5 | 2024-02-26 | OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c. |
CVE-2024-27088 | Unrated | | 2024-02-26 | es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTo… |
CVE-2024-27087 | Medium | 4.6 | 2024-02-26 | Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the r… |
CVE-2024-27081 | High | 7.2 | 2024-02-26 | ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version… |
CVE-2024-25767 | Medium | 6.5 | 2024-02-26 | nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c. |
CVE-2024-24402 | Critical | 9.8 | 2024-02-26 | An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component. |
CVE-2024-24401 | Critical | 9.8 | 2024-02-26 | SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php compone… |
CVE-2024-27456 | Critical | 9.1 | 2024-02-26 | rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files. |
CVE-2024-27455 | Critical | 9.1 | 2024-02-26 | In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files… |
CVE-2024-27454 | High | 7.5 | 2024-02-26 | orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. |
CVE-2024-27447 | Critical | 9.8 | 2024-02-26 | pretix before 2024.1.1 mishandles file validation. |
CVE-2024-27444 | Critical | 9.8 | 2024-02-26 | langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code vi… |
CVE-2024-27359 | High | 7.5 | 2024-02-26 | Certain WithSecure products allow a Denial of Service because the engine scanner can go into an infinite loop when processing an archive file. This affects Wit… |
CVE-2024-27350 | Medium | 5.9 | 2024-02-26 | Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB (Android Debug Bridge) connections. NOTE: some third pa… |
CVE-2024-26606 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend on I/O ev… |
CVE-2024-26605 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix deadlock when enabling ASPM A last minute revert in 6.7-final introduced a… |
CVE-2024-26604 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: Revert "kobject: Remove redundant checks for whether ktype is NULL" This reverts commit 1… |
CVE-2024-26603 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Stop relying on userspace for info to fault in xsave buffer Before this change… |
CVE-2024-26602 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_mem… |
CVE-2024-26601 | High | 7.8 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts… |
CVE-2024-26600 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP If the external phy working… |
CVE-2024-26468 | Medium | 6.1 | 2024-02-26 | A DOM based cross-site scripting (XSS) vulnerability in the component index.html of jstrieb/urlpages before commit 035b647 allows attackers to execute arbitrar… |
CVE-2024-26467 | Medium | 6.1 | 2024-02-26 | A DOM based cross-site scripting (XSS) vulnerability in the component generator.html of tabatkins/railroad-diagrams before commit ea9a123 allows attackers to e… |
CVE-2024-26466 | Medium | 6.1 | 2024-02-26 | A DOM based cross-site scripting (XSS) vulnerability in the component /dom/ranges/Range-test-iframe.html of web-platform-tests/wpt before commit 938e843 allows… |
CVE-2024-26465 | Medium | 6.1 | 2024-02-26 | A DOM based cross-site scripting (XSS) vulnerability in the component /beep/Beep.Instrument.js of stewdio beep.js before commit ef22ad7 allows attackers to exe… |
CVE-2024-25925 | Critical | 10.0 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in SYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Discounts.This issue affects WooComme… |
CVE-2024-25913 | Critical | 10.0 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2. |
CVE-2024-25909 | Critical | 9.9 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2. |
CVE-2024-25763 | Medium | 5.5 | 2024-02-26 | openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c. |
CVE-2024-25410 | Medium | 6.5 | 2024-02-26 | flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php. |
CVE-2024-25344 | Medium | 6.1 | 2024-02-26 | Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execute arbitrary code an… |
CVE-2024-25082 | Medium | 6.5 | 2024-02-26 | Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. |
CVE-2024-25081 | Medium | 4.2 | 2024-02-26 | Splinefont in FontForge through 20230101 allows command injection via crafted filenames. |
CVE-2024-24714 | High | 7.2 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4. |
CVE-2024-24568 | Medium | 5.3 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTT… |
CVE-2024-23839 | High | 7.1 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, specially crafted traffi… |
CVE-2024-23837 | High | 7.5 | 2024-02-26 | LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. Thi… |
CVE-2024-23836 | High | 7.5 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an at… |
CVE-2024-23835 | High | 7.5 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.3, excessive memory… |
CVE-2024-23605 | High | 8.8 | 2024-02-26 | A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can… |
CVE-2024-23496 | High | 8.8 | 2024-02-26 | A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file… |
CVE-2024-22873 | High | 8.1 | 2024-02-26 | Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscriptio… |
CVE-2024-22371 | Low | 2.9 | 2024-02-26 | Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Ap… |
CVE-2024-22201 | High | 7.5 | 2024-02-26 | Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attack… |
CVE-2024-21836 | High | 8.8 | 2024-02-26 | A heap-based buffer overflow vulnerability exists in the GGUF library header.n_tensors functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf fil… |
CVE-2024-21825 | High | 8.8 | 2024-02-26 | A heap-based buffer overflow vulnerability exists in the GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality of llama.cpp Commit 18c2e17. A spe… |
CVE-2024-21802 | High | 8.8 | 2024-02-26 | A heap-based buffer overflow vulnerability exists in the GGUF library info->ne functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can… |
CVE-2024-1890 | Medium | 6.4 | 2024-02-26 | Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack… |
CVE-2024-1889 | High | 8.8 | 2024-02-26 | Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker to send a maliciou… |
CVE-2024-1886 | Low | 3.0 | 2024-02-26 | This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage. |
CVE-2024-1885 | Medium | 6.3 | 2024-02-26 | This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage. |
CVE-2024-1878 | Medium | 6.3 | 2024-02-26 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-1877 | Medium | 6.3 | 2024-02-26 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-1876 | High | 7.3 | 2024-02-26 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ps… |
CVE-2024-1875 | Medium | 6.3 | 2024-02-26 | A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-1871 | Low | 3.5 | 2024-02-26 | A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. Affected is an unknown function of the file /… |
CVE-2024-1758 | Medium | 5.4 | 2024-02-26 | The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 via the wc_sf_url_c… |
CVE-2024-1735 | Critical | 9.1 | 2024-02-26 | A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users… |
CVE-2024-1710 | High | 8.8 | 2024-02-26 | The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in al… |
CVE-2024-1622 | High | 7.5 | 2024-02-26 | Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening. |
CVE-2024-1436 | Medium | 5.3 | 2024-02-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiloke WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit.This issue affects… |
CVE-2024-1165 | Medium | 4.3 | 2024-02-26 | The Brizy – Page Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.39 via the 'id'. This makes it pos… |
CVE-2024-0798 | Medium | 6.5 | 2024-02-26 | A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with 'default' role to delete documents uploaded by 'admin'. Despite… |
CVE-2024-0455 | High | 7.5 | 2024-02-26 | The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in… |
CVE-2024-0440 | Medium | 6.5 | 2024-02-26 | Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and ot… |
CVE-2024-0439 | High | 8.8 | 2024-02-26 | As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would no… |
CVE-2024-0436 | Medium | 5.9 | 2024-02-26 | Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack giv… |
CVE-2024-0435 | Medium | 5.4 | 2024-02-26 | User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Given the minimum requirement for… |
CVE-2024-0387 | Medium | 6.5 | 2024-02-26 | The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to th… |
CVE-2024-0243 | High | 8.1 | 2024-02-26 | With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=ur… |
CVE-2024-21502 | High | 7.5 | 2024-02-24 | Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c… |
CVE-2024-21501 | Medium | 5.3 | 2024-02-24 | Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allow… |
CVE-2024-1810 | Medium | 6.1 | 2024-02-24 | The Archivist – Custom Archive Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode_attributes' parameter in all v… |
CVE-2024-22395 | Medium | 6.3 | 2024-02-24 | Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a… |
CVE-2024-26192 | High | 8.2 | 2024-02-23 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-26188 | Medium | 4.3 | 2024-02-23 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-25469 | High | 7.5 | 2024-02-23 | SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude and longitude para… |
CVE-2024-24681 | Critical | 9.8 | 2024-02-23 | An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2). There is a single… |
CVE-2024-22988 | Critical | 9.8 | 2024-02-23 | ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based o… |