2024 CVEs (page 361)
Page 361 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27133 | High | 7.5 | 2024-02-23 | Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the r… |
CVE-2024-27132 | High | 7.5 | 2024-02-23 | Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RCE when running an untrusted recipe in J… |
CVE-2024-25730 | Critical | 9.8 | 2024-02-23 | Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insuff… |
CVE-2024-24310 | High | 8.8 | 2024-02-23 | In the module "Generate barcode on invoice / delivery slip" (ecgeneratebarcode) from Ether Creation <= 1.2.0 for PrestaShop, a guest can perform SQL injection. |
CVE-2024-24309 | High | 7.5 | 2024-02-23 | In the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information without restriction. |
CVE-2024-21423 | Medium | 4.8 | 2024-02-23 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-1834 | Low | 3.5 | 2024-02-23 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been classified as problematic. This affects an unknown part of the fi… |
CVE-2024-1833 | High | 7.3 | 2024-02-23 | A vulnerability was found in SourceCodester Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2024-1832 | High | 7.3 | 2024-02-23 | A vulnerability has been found in SourceCodester Complete File Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown f… |
CVE-2024-1831 | High | 7.3 | 2024-02-23 | A vulnerability, which was classified as critical, was found in SourceCodester Complete File Management System 1.0. Affected is an unknown function of the file… |
CVE-2024-1830 | High | 7.3 | 2024-02-23 | A vulnerability was found in code-projects Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-27319 | Medium | 4.4 | 2024-02-23 | Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one… |
CVE-2024-27318 | High | 7.5 | 2024-02-23 | Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path t… |
CVE-2024-1829 | High | 7.3 | 2024-02-23 | A vulnerability was found in code-projects Library System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-1828 | High | 7.3 | 2024-02-23 | A vulnerability was found in code-projects Library System 1.0. It has been classified as critical. Affected is an unknown function of the file Source/librarian… |
CVE-2024-1827 | High | 7.3 | 2024-02-23 | A vulnerability was found in code-projects Library System 1.0 and classified as critical. This issue affects some unknown processing of the file Source/librari… |
CVE-2024-23320 | High | 8.8 | 2024-02-23 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2024-1826 | High | 7.3 | 2024-02-23 | A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file Source/libra… |
CVE-2024-1825 | Medium | 4.3 | 2024-02-23 | A vulnerability, which was classified as problematic, was found in CodeAstro House Rental Management System 1.0. This affects an unknown part of the component… |
CVE-2024-26150 | High | 8.7 | 2024-02-23 | `@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backe… |
CVE-2024-1824 | High | 7.3 | 2024-02-23 | A vulnerability, which was classified as critical, has been found in CodeAstro House Rental Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2024-1823 | Medium | 5.3 | 2024-02-23 | A vulnerability classified as critical was found in CodeAstro Simple Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-1822 | Low | 2.4 | 2024-02-23 | A vulnerability classified as problematic has been found in PHPGurukul Tourism Management System 1.0. Affected is an unknown function of the file user-bookings… |
CVE-2024-1821 | Medium | 5.5 | 2024-02-23 | A vulnerability was found in code-projects Crime Reporting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file po… |
CVE-2024-1820 | High | 7.3 | 2024-02-23 | A vulnerability was found in code-projects Crime Reporting System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file in… |
CVE-2024-26599 | High | 7.8 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: pwm: Fix out-of-bounds access in of_pwm_single_xlate() With args->args_count == 2 args->a… |
CVE-2024-26598 | High | 8.8 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential U… |
CVE-2024-26597 | High | 7.8 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob in rmnet_policy The variable rmnet_link_ops assign a… |
CVE-2024-26596 | Medium | 5.5 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events After th… |
CVE-2024-26595 | Medium | 5.5 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path When calling mlxsw_s… |
CVE-2024-25629 | Medium | 4.4 | 2024-02-23 | c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch… |
CVE-2024-22776 | Medium | 4.7 | 2024-02-23 | Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats lik… |
CVE-2024-1819 | Medium | 4.7 | 2024-02-23 | A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the component Add… |
CVE-2024-1818 | Medium | 4.7 | 2024-02-23 | A vulnerability was found in CodeAstro Membership Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-26594 | Critical | 9.1 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mech token in session… |
CVE-2024-1817 | High | 7.3 | 2024-02-23 | A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical. Affected by this vulnerability is the… |
CVE-2024-25928 | High | 7.1 | 2024-02-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sitepact.This issue affects Sitepact: from n/a through 1… |
CVE-2024-25915 | Medium | 4.9 | 2024-02-23 | Server-Side Request Forgery (SSRF) vulnerability in Raaj Trambadia Pexels: Free Stock Photos.This issue affects Pexels: Free Stock Photos: from n/a through 1.2… |
CVE-2024-1362 | Medium | 4.3 | 2024-02-23 | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing… |
CVE-2024-1361 | Medium | 4.3 | 2024-02-23 | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing… |
CVE-2024-1360 | Medium | 4.3 | 2024-02-23 | The Colibri WP theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.94. This is due to missing or incorrec… |
CVE-2024-26593 | High | 7.1 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions According to the Intel datasheets, softwar… |
CVE-2024-1590 | Medium | 4.6 | 2024-02-23 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget in… |
CVE-2024-0563 | Medium | 4.3 | 2024-02-23 | Denial of service condition in M-Files Server in versions before 24.2 (excluding 23.2 SR7 and 23.8 SR5) allows anonymous user to cause denial of service agains… |
CVE-2024-1779 | Medium | 5.3 | 2024-02-23 | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-1778 | Medium | 4.3 | 2024-02-23 | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-1777 | Medium | 4.3 | 2024-02-23 | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. Th… |
CVE-2024-1776 | High | 7.2 | 2024-02-23 | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'form-id' parameter in all versions up to, and inclu… |
CVE-2024-22243 | High | 8.1 | 2024-02-23 | Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of th… |
CVE-2024-1786 | High | 7.5 | 2024-02-23 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DIR-600M C1 3.08. Affected by this issue is some un… |
CVE-2024-1784 | Low | 3.9 | 2024-02-23 | A vulnerability classified as problematic was found in Limbas 5.2.14. Affected by this vulnerability is an unknown functionality of the file main_admin.php. Th… |
CVE-2024-1783 | Critical | 9.8 | 2024-02-23 | A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the function loginAuth of t… |
CVE-2024-1781 | Medium | 6.3 | 2024-02-23 | A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the fi… |
CVE-2024-1683 | High | 7.3 | 2024-02-23 | A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application files on the TIE Secure Relay host, which… |
CVE-2024-25756 | High | 8.0 | 2024-02-22 | A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via… |
CVE-2024-25753 | High | 8.8 | 2024-02-22 | Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via t… |
CVE-2024-25748 | High | 8.8 | 2024-02-22 | A Stack Based Buffer Overflow vulnerability in tenda AC9 AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code… |
CVE-2024-26152 | Medium | 4.7 | 2024-02-22 | ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Ch… |
CVE-2024-25746 | High | 8.8 | 2024-02-22 | Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via t… |
CVE-2024-25369 | Medium | 5.4 | 2024-02-22 | A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter. |
CVE-2024-1750 | Medium | 5.6 | 2024-02-22 | A vulnerability, which was classified as critical, was found in TemmokuMVC up to 2.3. Affected is the function get_img_url/img_replace in the library lib/image… |
CVE-2024-1749 | Low | 2.4 | 2024-02-22 | A vulnerability, which was classified as problematic, has been found in Bdtask Bhojon Best Restaurant Management Software 2.9. This issue affects some unknown… |
CVE-2024-1748 | Medium | 5.0 | 2024-02-22 | A vulnerability classified as critical was found in van_der_Schaar LAB AutoPrognosis 0.1.21. This vulnerability affects the function load_model_from_file of th… |
CVE-2024-26151 | High | 8.2 | 2024-02-22 | The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All u… |
CVE-2024-26128 | Medium | 5.4 | 2024-02-22 | baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the content management feature. Version 5… |
CVE-2024-25385 | Medium | 6.2 | 2024-02-22 | An issue in flvmeta v.1.2.2 allows a local attacker to cause a denial of service via the flvmeta/src/flv.c:375:21 function in flv_close. |
CVE-2024-25130 | Medium | 5.4 | 2024-02-22 | Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and pr… |
CVE-2024-25129 | Low | 2.7 | 2024-02-22 | The CodeQL CLI repo holds binaries for the CodeQL command line interface (CLI). Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various a… |
CVE-2024-22547 | Medium | 4.7 | 2024-02-22 | WayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS). |
CVE-2024-25802 | Critical | 9.8 | 2024-02-22 | SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attack payload is the file content. |
CVE-2024-24817 | Medium | 4.3 | 2024-02-22 | Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to versio… |
CVE-2024-26592 | Critical | 9.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_tcp_new_connection() The race is between the handling of a… |
CVE-2024-26591 | Medium | 5.5 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix re-attachment branch in bpf_tracing_prog_attach The following case can cause a c… |
CVE-2024-26590 | Medium | 5.5 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix inconsistent per-file compression format EROFS can select compression algorith… |
CVE-2024-26589 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS For PTR_TO_FLOW_KEYS, check_flow_keys… |
CVE-2024-26588 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Prevent out-of-bounds memory access The test_tag test triggers an unhandl… |
CVE-2024-26587 | Medium | 5.5 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: net: netdevsim: don't try to destroy PHC on VFs PHC gets initialized in nsim_init_netdevs… |
CVE-2024-26586 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net d… |
CVE-2024-25828 | Medium | 4.9 | 2024-02-22 | cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php. |
CVE-2024-26284 | Medium | 6.1 | 2024-02-22 | Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to the attacke… |
CVE-2024-26283 | High | 7.8 | 2024-02-22 | An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This… |
CVE-2024-26282 | High | 7.1 | 2024-02-22 | Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for iO… |
CVE-2024-26281 | Medium | 4.7 | 2024-02-22 | Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar. T… |
CVE-2024-25851 | High | 8.0 | 2024-02-22 | Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config_sequence parameter in other_para of cgitest.cgi. |
CVE-2024-25850 | Critical | 9.8 | 2024-02-22 | Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter |
CVE-2024-1563 | High | 8.1 | 2024-02-22 | An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a… |
CVE-2024-26445 | Medium | 6.1 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_place.php |
CVE-2024-26352 | High | 8.8 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_places.php |
CVE-2024-26351 | Medium | 6.1 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_place.php |
CVE-2024-26350 | High | 8.8 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_contact_form_settings.php |
CVE-2024-26349 | Medium | 4.3 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_translation.php |
CVE-2024-25876 | Medium | 6.1 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2024-25875 | Medium | 6.1 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2024-25874 | Medium | 5.4 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2024-25873 | Medium | 5.4 | 2024-02-22 | Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attack… |
CVE-2024-23094 | High | 8.8 | 2024-02-22 | Flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /cover/addons/info_media_gallery/action/edit_addon_post.php |
CVE-2024-25021 | High | 8.4 | 2024-02-22 | IBM AIX 7.3, VIOS 4.1's Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary commands. IBM X-Force ID… |
CVE-2024-1104 | High | 7.5 | 2024-02-22 | An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users. |
CVE-2024-0220 | High | 8.3 | 2024-02-22 | B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A n… |
CVE-2024-26578 | Medium | 5.9 | 2024-02-22 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer.This issue affects Apache Answer: th… |