2024 CVEs (page 362)
Page 362 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25802 | Critical | 9.8 | 2024-02-22 | SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attack payload is the file content. |
CVE-2024-24817 | Medium | 4.3 | 2024-02-22 | Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to versio… |
CVE-2024-26592 | Critical | 9.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_tcp_new_connection() The race is between the handling of a… |
CVE-2024-26591 | Medium | 5.5 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix re-attachment branch in bpf_tracing_prog_attach The following case can cause a c… |
CVE-2024-26590 | Medium | 5.5 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix inconsistent per-file compression format EROFS can select compression algorith… |
CVE-2024-26589 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS For PTR_TO_FLOW_KEYS, check_flow_keys… |
CVE-2024-26588 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Prevent out-of-bounds memory access The test_tag test triggers an unhandl… |
CVE-2024-26587 | Medium | 5.5 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: net: netdevsim: don't try to destroy PHC on VFs PHC gets initialized in nsim_init_netdevs… |
CVE-2024-26586 | High | 7.8 | 2024-02-22 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net d… |
CVE-2024-25828 | Medium | 4.9 | 2024-02-22 | cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php. |
CVE-2024-26284 | Medium | 6.1 | 2024-02-22 | Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to the attacke… |
CVE-2024-26283 | High | 7.8 | 2024-02-22 | An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This… |
CVE-2024-26282 | High | 7.1 | 2024-02-22 | Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for iO… |
CVE-2024-26281 | Medium | 4.7 | 2024-02-22 | Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar. T… |
CVE-2024-25851 | High | 8.0 | 2024-02-22 | Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config_sequence parameter in other_para of cgitest.cgi. |
CVE-2024-25850 | Critical | 9.8 | 2024-02-22 | Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter |
CVE-2024-1563 | High | 8.1 | 2024-02-22 | An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a… |
CVE-2024-26445 | Medium | 6.1 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_place.php |
CVE-2024-26352 | High | 8.8 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_places.php |
CVE-2024-26351 | Medium | 6.1 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_place.php |
CVE-2024-26350 | High | 8.8 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_contact_form_settings.php |
CVE-2024-26349 | Medium | 4.3 | 2024-02-22 | flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_translation.php |
CVE-2024-25876 | Medium | 6.1 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2024-25875 | Medium | 6.1 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2024-25874 | Medium | 5.4 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2024-25873 | Medium | 5.4 | 2024-02-22 | Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attack… |
CVE-2024-23094 | High | 8.8 | 2024-02-22 | Flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /cover/addons/info_media_gallery/action/edit_addon_post.php |
CVE-2024-25021 | High | 8.4 | 2024-02-22 | IBM AIX 7.3, VIOS 4.1's Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary commands. IBM X-Force ID… |
CVE-2024-1104 | High | 7.5 | 2024-02-22 | An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users. |
CVE-2024-0220 | High | 8.3 | 2024-02-22 | B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A n… |
CVE-2024-26578 | Medium | 5.9 | 2024-02-22 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer.This issue affects Apache Answer: th… |
CVE-2024-23349 | Medium | 5.4 | 2024-02-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: through 1… |
CVE-2024-22393 | Critical | 9.1 | 2024-02-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploadin… |
CVE-2024-26491 | Medium | 6.1 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arb… |
CVE-2024-26490 | Medium | 5.4 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the Addon JD Simple module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2024-26489 | Medium | 6.1 | 2024-02-22 | A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Social block links' module of flusity-CMS v2.33 allows attackers to execute arbitrary web s… |
CVE-2024-1053 | Medium | 4.3 | 2024-02-22 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in… |
CVE-2024-0903 | Medium | 5.4 | 2024-02-22 | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-27283 | High | 7.2 | 2024-02-22 | A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload potentially malicious files to arbitrary… |
CVE-2024-26484 | Medium | 6.1 | 2024-02-22 | A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HT… |
CVE-2024-26483 | High | 8.8 | 2024-02-22 | An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file. |
CVE-2024-26482 | High | 7.1 | 2024-02-22 | An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because… |
CVE-2024-26481 | Medium | 4.7 | 2024-02-22 | Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. |
CVE-2024-25801 | Medium | 6.1 | 2024-02-22 | SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name (not the content) of a fi… |
CVE-2024-23137 | High | 7.8 | 2024-02-22 | A maliciously crafted STP or SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can be used to uninitialized variables. This vulnerabilit… |
CVE-2024-23136 | High | 7.8 | 2024-02-22 | A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability… |
CVE-2024-23135 | High | 7.8 | 2024-02-22 | A maliciously crafted SLDPRT file in ASMkern228A.dll when parsed through Autodesk applications can be used in user-after-free vulnerability. This vulnerability… |
CVE-2024-23134 | High | 7.8 | 2024-02-22 | A maliciously crafted IGS file in tbb.dll when parsed through Autodesk AutoCAD can be used in user-after-free vulnerability. This vulnerability, along with oth… |
CVE-2024-23133 | High | 7.8 | 2024-02-22 | A maliciously crafted STP file in ASMDATAX228A.dll when parsed through Autodesk applications can lead to a memory corruption vulnerability by write access viol… |
CVE-2024-23132 | High | 7.8 | 2024-02-22 | A maliciously crafted STP file in atf_dwg_consumer.dll when parsed through Autodesk applications can lead to a memory corruption vulnerability by write access… |
CVE-2024-23131 | High | 7.8 | 2024-02-22 | A maliciously crafted STP file, when parsed in ASMIMPORT229A.dll, ASMKERN228A.dll, ASMkern229A.dll or ASMDATAX228A.dll through Autodesk applications, can lead… |
CVE-2024-23130 | High | 7.8 | 2024-02-22 | A maliciously crafted SLDASM or SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can lead to a memory corruption vulnerability by write… |
CVE-2024-23129 | High | 7.8 | 2024-02-22 | A maliciously crafted MODEL 3DM, STP, or SLDASM file, when in opennurbs.dll parsed through Autodesk applications, can lead to a memory corruption vulnerability… |
CVE-2024-23128 | High | 7.8 | 2024-02-22 | A maliciously crafted MODEL file, when parsed in libodxdll.dll and ASMDATAX229A.dll through Autodesk applications, can lead to a memory corruption vulnerabilit… |
CVE-2024-23127 | High | 7.8 | 2024-02-22 | A maliciously crafted MODEL, SLDPRT, or SLDASM file, when parsed in ODXSW_DLL.dll and libodxdll.dll through Autodesk applications, can be used to cause a Heap-… |
CVE-2024-23126 | High | 7.8 | 2024-02-22 | A maliciously crafted CATPART file when parsed CC5Dll.dll through Autodesk applications can be used to cause a Stack-based Overflow. A malicious actor can leve… |
CVE-2024-23125 | High | 7.8 | 2024-02-22 | A maliciously crafted SLDPRT file when parsed ODXSW_DLL.dll through Autodesk applications can be used to cause a Stack-based Overflow. A malicious actor can le… |
CVE-2024-23124 | High | 7.8 | 2024-02-22 | A maliciously crafted STP file, when parsed in ASMIMPORT228A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor ma… |
CVE-2024-23123 | High | 7.8 | 2024-02-22 | A maliciously crafted CATPART file, when parsed in CC5Dll.dll and ASMBASE228A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A m… |
CVE-2024-23122 | High | 7.8 | 2024-02-22 | A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may le… |
CVE-2024-23121 | High | 7.8 | 2024-02-22 | A maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may… |
CVE-2024-25423 | High | 7.0 | 2024-02-22 | An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execute arbitrary code via a crafted c4d_base.xdl64 file. |
CVE-2024-25251 | High | 8.8 | 2024-02-22 | code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control. |
CVE-2024-23120 | High | 7.8 | 2024-02-22 | A maliciously crafted STP and STEP file, when parsed in ASMIMPORT228A.dll and ASMIMPORT229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vuln… |
CVE-2024-1525 | Medium | 5.3 | 2024-02-22 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versio… |
CVE-2024-1451 | High | 8.7 | 2024-02-22 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could l… |
CVE-2024-0861 | Medium | 4.3 | 2024-02-22 | An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions… |
CVE-2024-0446 | High | 7.8 | 2024-02-22 | A maliciously crafted STP, CATPART or MODEL file, when parsed in ASMKERN228A.dll and ASMdatax229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Writ… |
CVE-2024-0410 | High | 7.7 | 2024-02-22 | An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A devel… |
CVE-2024-26148 | Medium | 6.1 | 2024-02-21 | Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to in… |
CVE-2024-26147 | High | 7.5 | 2024-02-21 | Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin… |
CVE-2024-25124 | Critical | 9.4 | 2024-02-21 | Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the appli… |
CVE-2024-23654 | Medium | 4.1 | 2024-02-21 | discourse-ai is the AI plugin for the open-source discussion platform Discourse. Prior to commit 94ba0dadc2cf38e8f81c3936974c167219878edd, interactions with di… |
CVE-2024-26311 | Medium | 5.7 | 2024-02-21 | Archer Platform 6.x before 6.14 P2 HF1 (6.14.0.2.1) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially expl… |
CVE-2024-26310 | Medium | 4.3 | 2024-02-21 | Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. A remote authenticated malicious user could potentially exploi… |
CVE-2024-25461 | High | 7.5 | 2024-02-21 | Directory Traversal vulnerability in Terrasoft, Creatio Terrasoft CRM v.7.18.4.1532 allows a remote attacker to obtain sensitive information via a crafted requ… |
CVE-2024-25249 | Critical | 9.8 | 2024-02-21 | An issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. |
CVE-2024-25381 | Medium | 6.1 | 2024-02-21 | There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content. |
CVE-2024-24479 | High | 7.5 | 2024-02-21 | A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs com… |
CVE-2024-24476 | High | 7.5 | 2024-02-21 | A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size co… |
CVE-2024-22473 | Medium | 6.8 | 2024-02-21 | TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing… |
CVE-2024-1707 | Medium | 4.3 | 2024-02-21 | A vulnerability, which was classified as problematic, was found in GARO WALLBOX GLB+ T2EV7 0.5. This affects an unknown part of the file /index.jsp#settings of… |
CVE-2024-26145 | Medium | 6.5 | 2024-02-21 | Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private… |
CVE-2024-25898 | Medium | 6.1 | 2024-02-21 | A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in the Event Sermon fiel… |
CVE-2024-25897 | Critical | 9.8 | 2024-02-21 | ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. |
CVE-2024-25896 | Medium | 5.3 | 2024-02-21 | ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EID POST parameter. |
CVE-2024-25895 | Medium | 6.1 | 2024-02-21 | A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web script or HTML via the type parameter o… |
CVE-2024-25894 | Critical | 9.8 | 2024-02-21 | ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter. |
CVE-2024-25893 | Critical | 9.1 | 2024-02-21 | ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. |
CVE-2024-25892 | High | 8.1 | 2024-02-21 | ChurchCRM 5.5.0 ConfirmReport.php is vulnerable to Blind SQL Injection (Time-based) via the familyId GET parameter. |
CVE-2024-25891 | High | 7.5 | 2024-02-21 | ChurchCRM 5.5.0 FRBidSheets.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. |
CVE-2024-1706 | Low | 3.5 | 2024-02-21 | A vulnerability was determined in ZKTeco ZKBio Access IVS up to 3.3.2. This impacts an unknown function of the component Department Name Search Bar. This manip… |
CVE-2024-1705 | Medium | 5.6 | 2024-02-21 | A vulnerability was found in Shopwind up to 4.6. It has been rated as critical. This issue affects the function actionCreate of the file /public/install/contro… |
CVE-2024-1704 | Medium | 5.5 | 2024-02-21 | A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been declared as critical. This vulnerability affects the function save/delete of the file /admi… |
CVE-2024-1212 | Critical | 10.0 | 2024-02-21 | Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. |
CVE-2024-26138 | Medium | 5.3 | 2024-02-21 | The XWiki licensor application, which manages and enforce application licenses for paid extensions, includes the document `Licenses.Code.LicenseJSON` that prov… |
CVE-2024-26133 | Medium | 5.5 | 2024-02-21 | EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to… |
CVE-2024-26130 | High | 7.5 | 2024-02-21 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4… |
CVE-2024-25288 | Medium | 4.9 | 2024-02-21 | SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php. |
CVE-2024-25117 | Medium | 6.8 | 2024-02-21 | php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't… |