2024 CVEs (page 361)
Page 361 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1889 | High | 8.8 | 2024-02-26 | Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker to send a maliciou… |
CVE-2024-1886 | Low | 3.0 | 2024-02-26 | This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage. |
CVE-2024-1885 | Medium | 6.3 | 2024-02-26 | This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage. |
CVE-2024-1878 | Medium | 6.3 | 2024-02-26 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-1877 | Medium | 6.3 | 2024-02-26 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-1876 | High | 7.3 | 2024-02-26 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ps… |
CVE-2024-1875 | Medium | 6.3 | 2024-02-26 | A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-1871 | Low | 3.5 | 2024-02-26 | A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. Affected is an unknown function of the file /… |
CVE-2024-1758 | Medium | 5.4 | 2024-02-26 | The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 via the wc_sf_url_c… |
CVE-2024-1735 | Critical | 9.1 | 2024-02-26 | A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users… |
CVE-2024-1710 | High | 8.8 | 2024-02-26 | The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in al… |
CVE-2024-1622 | High | 7.5 | 2024-02-26 | Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening. |
CVE-2024-1436 | Medium | 5.3 | 2024-02-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiloke WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit.This issue affects… |
CVE-2024-1165 | Medium | 4.3 | 2024-02-26 | The Brizy – Page Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.39 via the 'id'. This makes it pos… |
CVE-2024-0798 | Medium | 6.5 | 2024-02-26 | A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with 'default' role to delete documents uploaded by 'admin'. Despite… |
CVE-2024-0455 | High | 7.5 | 2024-02-26 | The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in… |
CVE-2024-0440 | Medium | 6.5 | 2024-02-26 | Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and ot… |
CVE-2024-0439 | High | 8.8 | 2024-02-26 | As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would no… |
CVE-2024-0436 | Medium | 5.9 | 2024-02-26 | Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack giv… |
CVE-2024-0435 | Medium | 5.4 | 2024-02-26 | User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Given the minimum requirement for… |
CVE-2024-0387 | Medium | 6.5 | 2024-02-26 | The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to th… |
CVE-2024-0243 | High | 8.1 | 2024-02-26 | With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=ur… |
CVE-2024-21502 | High | 7.5 | 2024-02-24 | Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c… |
CVE-2024-21501 | Medium | 5.3 | 2024-02-24 | Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allow… |
CVE-2024-1810 | Medium | 6.1 | 2024-02-24 | The Archivist – Custom Archive Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode_attributes' parameter in all v… |
CVE-2024-22395 | Medium | 6.3 | 2024-02-24 | Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a… |
CVE-2024-26192 | High | 8.2 | 2024-02-23 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-26188 | Medium | 4.3 | 2024-02-23 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-25469 | High | 7.5 | 2024-02-23 | SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude and longitude para… |
CVE-2024-24681 | Critical | 9.8 | 2024-02-23 | An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2). There is a single… |
CVE-2024-22988 | Critical | 9.8 | 2024-02-23 | ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based o… |
CVE-2024-27133 | High | 7.5 | 2024-02-23 | Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the r… |
CVE-2024-27132 | High | 7.5 | 2024-02-23 | Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RCE when running an untrusted recipe in J… |
CVE-2024-25730 | Critical | 9.8 | 2024-02-23 | Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insuff… |
CVE-2024-24310 | High | 8.8 | 2024-02-23 | In the module "Generate barcode on invoice / delivery slip" (ecgeneratebarcode) from Ether Creation <= 1.2.0 for PrestaShop, a guest can perform SQL injection. |
CVE-2024-24309 | High | 7.5 | 2024-02-23 | In the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information without restriction. |
CVE-2024-21423 | Medium | 4.8 | 2024-02-23 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-1834 | Low | 3.5 | 2024-02-23 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been classified as problematic. This affects an unknown part of the fi… |
CVE-2024-1833 | High | 7.3 | 2024-02-23 | A vulnerability was found in SourceCodester Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2024-1832 | High | 7.3 | 2024-02-23 | A vulnerability has been found in SourceCodester Complete File Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown f… |
CVE-2024-1831 | High | 7.3 | 2024-02-23 | A vulnerability, which was classified as critical, was found in SourceCodester Complete File Management System 1.0. Affected is an unknown function of the file… |
CVE-2024-1830 | High | 7.3 | 2024-02-23 | A vulnerability was found in code-projects Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-27319 | Medium | 4.4 | 2024-02-23 | Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one… |
CVE-2024-27318 | High | 7.5 | 2024-02-23 | Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path t… |
CVE-2024-1829 | High | 7.3 | 2024-02-23 | A vulnerability was found in code-projects Library System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-1828 | High | 7.3 | 2024-02-23 | A vulnerability was found in code-projects Library System 1.0. It has been classified as critical. Affected is an unknown function of the file Source/librarian… |
CVE-2024-1827 | High | 7.3 | 2024-02-23 | A vulnerability was found in code-projects Library System 1.0 and classified as critical. This issue affects some unknown processing of the file Source/librari… |
CVE-2024-23320 | High | 8.8 | 2024-02-23 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2024-1826 | High | 7.3 | 2024-02-23 | A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file Source/libra… |
CVE-2024-1825 | Medium | 4.3 | 2024-02-23 | A vulnerability, which was classified as problematic, was found in CodeAstro House Rental Management System 1.0. This affects an unknown part of the component… |
CVE-2024-26150 | High | 8.7 | 2024-02-23 | `@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backe… |
CVE-2024-1824 | High | 7.3 | 2024-02-23 | A vulnerability, which was classified as critical, has been found in CodeAstro House Rental Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2024-1823 | Medium | 5.3 | 2024-02-23 | A vulnerability classified as critical was found in CodeAstro Simple Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-1822 | Low | 2.4 | 2024-02-23 | A vulnerability classified as problematic has been found in PHPGurukul Tourism Management System 1.0. Affected is an unknown function of the file user-bookings… |
CVE-2024-1821 | Medium | 5.5 | 2024-02-23 | A vulnerability was found in code-projects Crime Reporting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file po… |
CVE-2024-1820 | High | 7.3 | 2024-02-23 | A vulnerability was found in code-projects Crime Reporting System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file in… |
CVE-2024-26599 | High | 7.8 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: pwm: Fix out-of-bounds access in of_pwm_single_xlate() With args->args_count == 2 args->a… |
CVE-2024-26598 | High | 8.8 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential U… |
CVE-2024-26597 | High | 7.8 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob in rmnet_policy The variable rmnet_link_ops assign a… |
CVE-2024-26596 | Medium | 5.5 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events After th… |
CVE-2024-26595 | Medium | 5.5 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path When calling mlxsw_s… |
CVE-2024-25629 | Medium | 4.4 | 2024-02-23 | c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch… |
CVE-2024-22776 | Medium | 4.7 | 2024-02-23 | Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats lik… |
CVE-2024-1819 | Medium | 4.7 | 2024-02-23 | A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the component Add… |
CVE-2024-1818 | Medium | 4.7 | 2024-02-23 | A vulnerability was found in CodeAstro Membership Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-26594 | Critical | 9.1 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mech token in session… |
CVE-2024-1817 | High | 7.3 | 2024-02-23 | A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical. Affected by this vulnerability is the… |
CVE-2024-25928 | High | 7.1 | 2024-02-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sitepact.This issue affects Sitepact: from n/a through 1… |
CVE-2024-25915 | Medium | 4.9 | 2024-02-23 | Server-Side Request Forgery (SSRF) vulnerability in Raaj Trambadia Pexels: Free Stock Photos.This issue affects Pexels: Free Stock Photos: from n/a through 1.2… |
CVE-2024-1362 | Medium | 4.3 | 2024-02-23 | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing… |
CVE-2024-1361 | Medium | 4.3 | 2024-02-23 | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing… |
CVE-2024-1360 | Medium | 4.3 | 2024-02-23 | The Colibri WP theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.94. This is due to missing or incorrec… |
CVE-2024-26593 | High | 7.1 | 2024-02-23 | In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions According to the Intel datasheets, softwar… |
CVE-2024-1590 | Medium | 4.6 | 2024-02-23 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Widget in… |
CVE-2024-0563 | Medium | 4.3 | 2024-02-23 | Denial of service condition in M-Files Server in versions before 24.2 (excluding 23.2 SR7 and 23.8 SR5) allows anonymous user to cause denial of service agains… |
CVE-2024-1779 | Medium | 5.3 | 2024-02-23 | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-1778 | Medium | 4.3 | 2024-02-23 | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-1777 | Medium | 4.3 | 2024-02-23 | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. Th… |
CVE-2024-1776 | High | 7.2 | 2024-02-23 | The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'form-id' parameter in all versions up to, and inclu… |
CVE-2024-22243 | High | 8.1 | 2024-02-23 | Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of th… |
CVE-2024-1786 | High | 7.5 | 2024-02-23 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DIR-600M C1 3.08. Affected by this issue is some un… |
CVE-2024-1784 | Low | 3.9 | 2024-02-23 | A vulnerability classified as problematic was found in Limbas 5.2.14. Affected by this vulnerability is an unknown functionality of the file main_admin.php. Th… |
CVE-2024-1783 | Critical | 9.8 | 2024-02-23 | A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the function loginAuth of t… |
CVE-2024-1781 | Medium | 6.3 | 2024-02-23 | A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the fi… |
CVE-2024-1683 | High | 7.3 | 2024-02-23 | A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application files on the TIE Secure Relay host, which… |
CVE-2024-25756 | High | 8.0 | 2024-02-22 | A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via… |
CVE-2024-25753 | High | 8.8 | 2024-02-22 | Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via t… |
CVE-2024-25748 | High | 8.8 | 2024-02-22 | A Stack Based Buffer Overflow vulnerability in tenda AC9 AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code… |
CVE-2024-26152 | Medium | 4.7 | 2024-02-22 | ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Ch… |
CVE-2024-25746 | High | 8.8 | 2024-02-22 | Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via t… |
CVE-2024-25369 | Medium | 5.4 | 2024-02-22 | A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter. |
CVE-2024-1750 | Medium | 5.6 | 2024-02-22 | A vulnerability, which was classified as critical, was found in TemmokuMVC up to 2.3. Affected is the function get_img_url/img_replace in the library lib/image… |
CVE-2024-1749 | Low | 2.4 | 2024-02-22 | A vulnerability, which was classified as problematic, has been found in Bdtask Bhojon Best Restaurant Management Software 2.9. This issue affects some unknown… |
CVE-2024-1748 | Medium | 5.0 | 2024-02-22 | A vulnerability classified as critical was found in van_der_Schaar LAB AutoPrognosis 0.1.21. This vulnerability affects the function load_model_from_file of th… |
CVE-2024-26151 | High | 8.2 | 2024-02-22 | The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All u… |
CVE-2024-26128 | Medium | 5.4 | 2024-02-22 | baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the content management feature. Version 5… |
CVE-2024-25385 | Medium | 6.2 | 2024-02-22 | An issue in flvmeta v.1.2.2 allows a local attacker to cause a denial of service via the flvmeta/src/flv.c:375:21 function in flv_close. |
CVE-2024-25130 | Medium | 5.4 | 2024-02-22 | Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and pr… |
CVE-2024-25129 | Low | 2.7 | 2024-02-22 | The CodeQL CLI repo holds binaries for the CodeQL command line interface (CLI). Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various a… |
CVE-2024-22547 | Medium | 4.7 | 2024-02-22 | WayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS). |