2024 CVEs (page 362)
Page 362 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23349 | Medium | 5.4 | 2024-02-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: through 1… |
CVE-2024-22393 | Critical | 9.1 | 2024-02-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploadin… |
CVE-2024-26491 | Medium | 6.1 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arb… |
CVE-2024-26490 | Medium | 5.4 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the Addon JD Simple module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2024-26489 | Medium | 6.1 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Social block links' module of flusity-CMS v2.33 allows attackers to execute arbitrary web s… |
CVE-2024-1053 | Medium | 4.3 | 2024-02-22 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in… |
CVE-2024-0903 | Medium | 5.4 | 2024-02-22 | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-27283 | High | 7.2 | 2024-02-22 | A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload potentially malicious files to arbitrary… |
CVE-2024-26484 | Medium | 6.1 | 2024-02-22 | A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HT… |
CVE-2024-26483 | High | 8.8 | 2024-02-22 | An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file. |
CVE-2024-26482 | High | 7.1 | 2024-02-22 | An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because… |
CVE-2024-26481 | Medium | 4.7 | 2024-02-22 | Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. |
CVE-2024-25801 | Medium | 6.1 | 2024-02-22 | SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name (not the content) of a fi… |
CVE-2024-23137 | High | 7.8 | 2024-02-22 | A maliciously crafted STP or SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can be used to uninitialized variables. This vulnerabilit… |
CVE-2024-23136 | High | 7.8 | 2024-02-22 | A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability… |
CVE-2024-23135 | High | 7.8 | 2024-02-22 | A maliciously crafted SLDPRT file in ASMkern228A.dll when parsed through Autodesk applications can be used in user-after-free vulnerability. This vulnerability… |
CVE-2024-23134 | High | 7.8 | 2024-02-22 | A maliciously crafted IGS file in tbb.dll when parsed through Autodesk AutoCAD can be used in user-after-free vulnerability. This vulnerability, along with oth… |
CVE-2024-23133 | High | 7.8 | 2024-02-22 | A maliciously crafted STP file in ASMDATAX228A.dll when parsed through Autodesk applications can lead to a memory corruption vulnerability by write access viol… |
CVE-2024-23132 | High | 7.8 | 2024-02-22 | A maliciously crafted STP file in atf_dwg_consumer.dll when parsed through Autodesk applications can lead to a memory corruption vulnerability by write access… |
CVE-2024-23131 | High | 7.8 | 2024-02-22 | A maliciously crafted STP file, when parsed in ASMIMPORT229A.dll, ASMKERN228A.dll, ASMkern229A.dll or ASMDATAX228A.dll through Autodesk applications, can lead… |
CVE-2024-23130 | High | 7.8 | 2024-02-22 | A maliciously crafted SLDASM or SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can lead to a memory corruption vulnerability by write… |
CVE-2024-23129 | High | 7.8 | 2024-02-22 | A maliciously crafted MODEL 3DM, STP, or SLDASM file, when in opennurbs.dll parsed through Autodesk applications, can lead to a memory corruption vulnerability… |
CVE-2024-23128 | High | 7.8 | 2024-02-22 | A maliciously crafted MODEL file, when parsed in libodxdll.dll and ASMDATAX229A.dll through Autodesk applications, can lead to a memory corruption vulnerabilit… |
CVE-2024-23127 | High | 7.8 | 2024-02-22 | A maliciously crafted MODEL, SLDPRT, or SLDASM file, when parsed in ODXSW_DLL.dll and libodxdll.dll through Autodesk applications, can be used to cause a Heap-… |
CVE-2024-23126 | High | 7.8 | 2024-02-22 | A maliciously crafted CATPART file when parsed CC5Dll.dll through Autodesk applications can be used to cause a Stack-based Overflow. A malicious actor can leve… |
CVE-2024-23125 | High | 7.8 | 2024-02-22 | A maliciously crafted SLDPRT file when parsed ODXSW_DLL.dll through Autodesk applications can be used to cause a Stack-based Overflow. A malicious actor can le… |
CVE-2024-23124 | High | 7.8 | 2024-02-22 | A maliciously crafted STP file, when parsed in ASMIMPORT228A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor ma… |
CVE-2024-23123 | High | 7.8 | 2024-02-22 | A maliciously crafted CATPART file, when parsed in CC5Dll.dll and ASMBASE228A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A m… |
CVE-2024-23122 | High | 7.8 | 2024-02-22 | A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may le… |
CVE-2024-23121 | High | 7.8 | 2024-02-22 | A maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may… |
CVE-2024-25423 | High | 7.0 | 2024-02-22 | An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execute arbitrary code via a crafted c4d_base.xdl64 file. |
CVE-2024-25251 | High | 8.8 | 2024-02-22 | code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control. |
CVE-2024-23120 | High | 7.8 | 2024-02-22 | A maliciously crafted STP and STEP file, when parsed in ASMIMPORT228A.dll and ASMIMPORT229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vuln… |
CVE-2024-1525 | Medium | 5.3 | 2024-02-22 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versio… |
CVE-2024-1451 | High | 8.7 | 2024-02-22 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could l… |
CVE-2024-0861 | Medium | 4.3 | 2024-02-22 | An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions… |
CVE-2024-0446 | High | 7.8 | 2024-02-22 | A maliciously crafted STP, CATPART or MODEL file, when parsed in ASMKERN228A.dll and ASMdatax229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Writ… |
CVE-2024-0410 | High | 7.7 | 2024-02-22 | An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A devel… |
CVE-2024-26148 | Medium | 6.1 | 2024-02-21 | Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to in… |
CVE-2024-26147 | High | 7.5 | 2024-02-21 | Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin… |
CVE-2024-25124 | Critical | 9.4 | 2024-02-21 | Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the appli… |
CVE-2024-23654 | Medium | 4.1 | 2024-02-21 | discourse-ai is the AI plugin for the open-source discussion platform Discourse. Prior to commit 94ba0dadc2cf38e8f81c3936974c167219878edd, interactions with di… |
CVE-2024-26311 | Medium | 5.7 | 2024-02-21 | Archer Platform 6.x before 6.14 P2 HF1 (6.14.0.2.1) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially expl… |
CVE-2024-26310 | Medium | 4.3 | 2024-02-21 | Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. A remote authenticated malicious user could potentially exploi… |
CVE-2024-25461 | High | 7.5 | 2024-02-21 | Directory Traversal vulnerability in Terrasoft, Creatio Terrasoft CRM v.7.18.4.1532 allows a remote attacker to obtain sensitive information via a crafted requ… |
CVE-2024-25249 | Critical | 9.8 | 2024-02-21 | An issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. |
CVE-2024-25381 | Medium | 6.1 | 2024-02-21 | There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content. |
CVE-2024-24479 | High | 7.5 | 2024-02-21 | A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs com… |
CVE-2024-24476 | High | 7.5 | 2024-02-21 | A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size co… |
CVE-2024-22473 | Medium | 6.8 | 2024-02-21 | TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing… |
CVE-2024-1707 | Medium | 4.3 | 2024-02-21 | A vulnerability, which was classified as problematic, was found in GARO WALLBOX GLB+ T2EV7 0.5. This affects an unknown part of the file /index.jsp#settings of… |
CVE-2024-26145 | Medium | 6.5 | 2024-02-21 | Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private… |
CVE-2024-25898 | Medium | 6.1 | 2024-02-21 | A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in the Event Sermon fiel… |
CVE-2024-25897 | Critical | 9.8 | 2024-02-21 | ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. |
CVE-2024-25896 | Medium | 5.3 | 2024-02-21 | ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EID POST parameter. |
CVE-2024-25895 | Medium | 6.1 | 2024-02-21 | A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web script or HTML via the type parameter o… |
CVE-2024-25894 | Critical | 9.8 | 2024-02-21 | ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter. |
CVE-2024-25893 | Critical | 9.1 | 2024-02-21 | ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. |
CVE-2024-25892 | High | 8.1 | 2024-02-21 | ChurchCRM 5.5.0 ConfirmReport.php is vulnerable to Blind SQL Injection (Time-based) via the familyId GET parameter. |
CVE-2024-25891 | High | 7.5 | 2024-02-21 | ChurchCRM 5.5.0 FRBidSheets.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. |
CVE-2024-1706 | Low | 3.5 | 2024-02-21 | A vulnerability was determined in ZKTeco ZKBio Access IVS up to 3.3.2. This impacts an unknown function of the component Department Name Search Bar. This manip… |
CVE-2024-1705 | Medium | 5.6 | 2024-02-21 | A vulnerability was found in Shopwind up to 4.6. It has been rated as critical. This issue affects the function actionCreate of the file /public/install/contro… |
CVE-2024-1704 | Medium | 5.5 | 2024-02-21 | A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been declared as critical. This vulnerability affects the function save/delete of the file /admi… |
CVE-2024-1212 | Critical | 10.0 | 2024-02-21 | Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. |
CVE-2024-26138 | Medium | 5.3 | 2024-02-21 | The XWiki licensor application, which manages and enforce application licenses for paid extensions, includes the document `Licenses.Code.LicenseJSON` that prov… |
CVE-2024-26133 | Medium | 5.5 | 2024-02-21 | EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to… |
CVE-2024-26130 | High | 7.5 | 2024-02-21 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4… |
CVE-2024-25288 | Medium | 4.9 | 2024-02-21 | SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php. |
CVE-2024-25117 | Medium | 6.8 | 2024-02-21 | php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't… |
CVE-2024-24478 | High | 7.5 | 2024-02-21 | An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_t*tvb, proto_tree*tree… |
CVE-2024-23346 | Critical | 9.3 | 2024-02-21 | Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTra… |
CVE-2024-20325 | Medium | 5.1 | 2024-02-21 | A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a reposi… |
CVE-2024-1714 | High | 7.1 | 2024-02-21 | An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitesp… |
CVE-2024-1703 | Low | 3.5 | 2024-02-21 | A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been classified as problematic. This affects the function openfile of the file /adminapi/system/… |
CVE-2024-1702 | Medium | 6.3 | 2024-02-21 | A vulnerability was found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-22220 | Medium | 6.3 | 2024-02-21 | An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scr… |
CVE-2024-1709 | Critical | 10.0 | 2024-02-21 | ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an atta… |
CVE-2024-1708 | High | 8.4 | 2024-02-21 | ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or di… |
CVE-2024-1701 | Medium | 5.3 | 2024-02-21 | A vulnerability has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2024-1700 | Medium | 4.3 | 2024-02-21 | A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected is an unknown function of the file /sig… |
CVE-2024-1474 | High | 7.5 | 2024-02-21 | In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server adminis… |
CVE-2024-26585 | Critical | 9.8 | 2024-02-21 | In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, t… |
CVE-2024-26584 | Critical | 9.8 | 2024-02-21 | In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MA… |
CVE-2024-26583 | Critical | 9.8 | 2024-02-21 | In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which call… |
CVE-2024-26582 | Critical | 9.8 | 2024-02-21 | In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tls_decrypt_sg doesn't… |
CVE-2024-22778 | High | 7.5 | 2024-02-21 | HackMD CodiMD <2.5.2 is vulnerable to Denial of Service. |
CVE-2024-24837 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce, Frédéric GILLES FG Drupal to WordPress, Frédéric GILLES FG Joo… |
CVE-2024-24802 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in John Tendik JTRT Responsive Tables.This issue affects JTRT Responsive Tables: from n/a through 4.1.9. |
CVE-2024-24798 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in SoniNow Team Debug.This issue affects Debug: from n/a through 1.10. |
CVE-2024-25905 | Medium | 5.4 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form.This issue affects Multi Step Form: from n/a through 1.7.18. |
CVE-2024-25904 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in David Stockl TinyMCE and TinyMCE Advanced Professsional Formats and Styles.This issue affects TinyMCE and Ti… |
CVE-2024-24876 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12. |
CVE-2024-24872 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5. |
CVE-2024-24849 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: fr… |
CVE-2024-24843 | High | 7.1 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in PowerPack Addons for Elementor PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: f… |
CVE-2024-1081 | Medium | 6.4 | 2024-02-21 | The 3D FlipBook – PDF Flipbook WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bookmark feature in all versions up… |
CVE-2024-0593 | Medium | 5.3 | 2024-02-21 | The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() fun… |
CVE-2024-22235 | Medium | 6.7 | 2024-02-21 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privi… |
CVE-2024-25151 | Medium | 5.4 | 2024-02-21 | The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, a… |
CVE-2024-1676 | Medium | 5.4 | 2024-02-21 | Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chr… |