2024 CVEs (page 363)
Page 363 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24478 | High | 7.5 | 2024-02-21 | An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_t*tvb, proto_tree*tree… |
CVE-2024-23346 | Critical | 9.3 | 2024-02-21 | Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTra… |
CVE-2024-20325 | Medium | 5.1 | 2024-02-21 | A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a reposi… |
CVE-2024-1714 | High | 7.1 | 2024-02-21 | An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitesp… |
CVE-2024-1703 | Low | 3.5 | 2024-02-21 | A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been classified as problematic. This affects the function openfile of the file /adminapi/system/… |
CVE-2024-1702 | Medium | 6.3 | 2024-02-21 | A vulnerability was found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-22220 | Medium | 6.3 | 2024-02-21 | An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scr… |
CVE-2024-1709 | Critical | 10.0 | 2024-02-21 | ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an atta… |
CVE-2024-1708 | High | 8.4 | 2024-02-21 | ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or di… |
CVE-2024-1701 | Medium | 5.3 | 2024-02-21 | A vulnerability has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2024-1700 | Medium | 4.3 | 2024-02-21 | A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected is an unknown function of the file /sig… |
CVE-2024-1474 | High | 7.5 | 2024-02-21 | In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server adminis… |
CVE-2024-26585 | Critical | 9.8 | 2024-02-21 | In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, t… |
CVE-2024-26584 | Critical | 9.8 | 2024-02-21 | In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MA… |
CVE-2024-26583 | Critical | 9.8 | 2024-02-21 | In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which call… |
CVE-2024-26582 | Critical | 9.8 | 2024-02-21 | In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tls_decrypt_sg doesn't… |
CVE-2024-22778 | High | 7.5 | 2024-02-21 | HackMD CodiMD <2.5.2 is vulnerable to Denial of Service. |
CVE-2024-24837 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce, Frédéric GILLES FG Drupal to WordPress, Frédéric GILLES FG Joo… |
CVE-2024-24802 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in John Tendik JTRT Responsive Tables.This issue affects JTRT Responsive Tables: from n/a through 4.1.9. |
CVE-2024-24798 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in SoniNow Team Debug.This issue affects Debug: from n/a through 1.10. |
CVE-2024-25905 | Medium | 5.4 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form.This issue affects Multi Step Form: from n/a through 1.7.18. |
CVE-2024-25904 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in David Stockl TinyMCE and TinyMCE Advanced Professsional Formats and Styles.This issue affects TinyMCE and Ti… |
CVE-2024-24876 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12. |
CVE-2024-24872 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5. |
CVE-2024-24849 | Medium | 4.3 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: fr… |
CVE-2024-24843 | High | 7.1 | 2024-02-21 | Cross-Site Request Forgery (CSRF) vulnerability in PowerPack Addons for Elementor PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: f… |
CVE-2024-1081 | Medium | 6.4 | 2024-02-21 | The 3D FlipBook – PDF Flipbook WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bookmark feature in all versions up… |
CVE-2024-0593 | Medium | 5.3 | 2024-02-21 | The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() fun… |
CVE-2024-22235 | Medium | 6.7 | 2024-02-21 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privi… |
CVE-2024-25151 | Medium | 5.4 | 2024-02-21 | The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, a… |
CVE-2024-1676 | Medium | 5.4 | 2024-02-21 | Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chr… |
CVE-2024-1675 | High | 8.8 | 2024-02-21 | Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restrictions via a crafted H… |
CVE-2024-1674 | High | 8.8 | 2024-02-21 | Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass navigation restrictions via a crafted HT… |
CVE-2024-1673 | High | 8.8 | 2024-02-21 | Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who had compromised the renderer process to potentially explo… |
CVE-2024-1672 | Medium | 5.4 | 2024-02-21 | Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via… |
CVE-2024-1671 | Medium | 6.5 | 2024-02-21 | Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafte… |
CVE-2024-1670 | High | 8.8 | 2024-02-21 | Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2024-1669 | High | 8.8 | 2024-02-21 | Out of bounds memory access in Blink in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to perform out of bounds memory access via a crafted HTM… |
CVE-2024-1562 | Medium | 5.3 | 2024-02-21 | The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the execute… |
CVE-2024-1501 | Medium | 4.7 | 2024-02-21 | The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.22. This is due to missing or incor… |
CVE-2024-26269 | Critical | 9.6 | 2024-02-21 | Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38… |
CVE-2024-26266 | Critical | 9.0 | 2024-02-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before… |
CVE-2024-25603 | Critical | 9.0 | 2024-02-21 | Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported ver… |
CVE-2024-1631 | Critical | 9.1 | 2024-02-21 | Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, w… |
CVE-2024-1108 | Medium | 6.5 | 2024-02-21 | The Plugin Groups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_init() function in all… |
CVE-2024-25602 | Critical | 9.0 | 2024-02-21 | Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, a… |
CVE-2024-25601 | Critical | 9.0 | 2024-02-21 | Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported vers… |
CVE-2024-25152 | Critical | 9.0 | 2024-02-21 | Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP… |
CVE-2024-25147 | Critical | 9.6 | 2024-02-21 | Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 be… |
CVE-2024-0407 | Medium | 6.5 | 2024-02-21 | Certain HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to information disclosure, when connections made by the device back… |
CVE-2024-23758 | High | 7.5 | 2024-02-20 | An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstaller_msi.log file. |
CVE-2024-26140 | Medium | 4.6 | 2024-02-20 | com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI… |
CVE-2024-26136 | High | 7.5 | 2024-02-20 | kedi ElectronCord is a bot management tool for Discord. Commit aaaeaf4e6c99893827b2eea4dd02f755e1e24041 exposes an account access token in the `config.json` fi… |
CVE-2024-25428 | Medium | 6.5 | 2024-02-20 | SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter. |
CVE-2024-23830 | High | 8.3 | 2024-02-20 | MantisBT is an open source issue tracker. Prior to version 2.26.1, an unauthenticated attacker who knows a user's email address and username can hijack the use… |
CVE-2024-25141 | Critical | 9.1 | 2024-02-20 | When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undo… |
CVE-2024-26135 | High | 8.3 | 2024-02-20 | MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx end… |
CVE-2024-25631 | Medium | 6.1 | 2024-02-20 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard… |
CVE-2024-25630 | Medium | 6.1 | 2024-02-20 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the defau… |
CVE-2024-25260 | Medium | 4.0 | 2024-02-20 | elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c. |
CVE-2024-24763 | Medium | 4.3 | 2024-02-20 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerabi… |
CVE-2024-24474 | High | 8.8 | 2024-02-20 | QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of… |
CVE-2024-22250 | High | 7.8 | 2024-02-20 | Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows ope… |
CVE-2024-22245 | Critical | 9.6 | 2024-02-20 | Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor… |
CVE-2024-22054 | High | 7.5 | 2024-02-20 | A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discov… |
CVE-2024-21682 | High | 7.2 | 2024-02-20 | This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). Assets Discovery, which can be downloaded via Atlas… |
CVE-2024-21678 | High | 8.5 | 2024-02-20 | This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8… |
CVE-2024-0794 | Critical | 9.8 | 2024-02-20 | Certain HP LaserJet Pro, HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to Remote Code Execution due to buffer overflow wh… |
CVE-2024-25366 | Medium | 6.2 | 2024-02-20 | Buffer Overflow vulnerability in mz-automation.de libiec61859 v.1.4.0 allows a remote attacker to cause a denial of service via the mmsServer_handleGetNameList… |
CVE-2024-25274 | Critical | 9.8 | 2024-02-20 | An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a cra… |
CVE-2024-23809 | Critical | 9.8 | 2024-02-20 | A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A… |
CVE-2024-23606 | Critical | 9.8 | 2024-02-20 | An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A special… |
CVE-2024-23313 | Critical | 9.8 | 2024-02-20 | An integer underflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially… |
CVE-2024-23310 | Critical | 9.8 | 2024-02-20 | A use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially cra… |
CVE-2024-23305 | Critical | 9.8 | 2024-02-20 | An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111)… |
CVE-2024-22097 | Critical | 9.8 | 2024-02-20 | A double-free vulnerability exists in the BrainVision Header Parsing functionality of The Biosig Project libbiosig Master Branch (ab0ee111) and 2.5.0. A specia… |
CVE-2024-21812 | Critical | 9.8 | 2024-02-20 | An integer overflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially… |
CVE-2024-21795 | Critical | 9.8 | 2024-02-20 | A heap-based buffer overflow vulnerability exists in the .egi parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A speci… |
CVE-2024-23114 | Critical | 9.8 | 2024-02-20 | Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Unde… |
CVE-2024-22824 | Critical | 9.8 | 2024-02-20 | An issue in Timo v.2.0.3 allows a remote attacker to execute arbitrary code via the filetype restrictions in the UploadController.java component. |
CVE-2024-22369 | High | 7.8 | 2024-02-20 | Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22… |
CVE-2024-1156 | High | 7.8 | 2024-02-20 | Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentia… |
CVE-2024-1155 | High | 7.8 | 2024-02-20 | Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalat… |
CVE-2024-26270 | Medium | 6.5 | 2024-02-20 | The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s h… |
CVE-2024-26268 | Medium | 5.3 | 2024-02-20 | User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before updat… |
CVE-2024-25199 | High | 8.1 | 2024-02-20 | Inappropriate pointer order of map_sub_ and map_free(map_) (amcl_node.cpp) in Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions leads t… |
CVE-2024-25198 | Critical | 9.1 | 2024-02-20 | Inappropriate pointer order of laser_scan_filter_.reset() and tf_listener_.reset() (amcl_node.cpp) in Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2… |
CVE-2024-25197 | Medium | 6.5 | 2024-02-20 | Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions were discovered to contain a NULL pointer dereference via the isCurrent() function at… |
CVE-2024-25196 | Low | 3.3 | 2024-02-20 | Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_controller process. This vu… |
CVE-2024-1557 | High | 8.1 | 2024-02-20 | Memory safety bugs present in Firefox 122. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2024-1556 | Medium | 6.5 | 2024-02-20 | The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and undefined behavior. *Note:* This issue onl… |
CVE-2024-1555 | High | 8.3 | 2024-02-20 | When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected. This vulnerability affects Firefox < 123. |
CVE-2024-1554 | Critical | 9.8 | 2024-02-20 | The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain. Under the cor… |
CVE-2024-1553 | High | 8.1 | 2024-02-20 | Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-1552 | High | 7.5 | 2024-02-20 | Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices… |
CVE-2024-1551 | Medium | 6.1 | 2024-02-20 | Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well… |
CVE-2024-1550 | Medium | 6.1 | 2024-02-20 | A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedl… |
CVE-2024-1549 | Medium | 6.1 | 2024-02-20 | If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and un… |
CVE-2024-1548 | Medium | 4.3 | 2024-02-20 | A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion and possible spoofing… |
CVE-2024-1547 | Medium | 6.5 | 2024-02-20 | Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL sh… |