2024 CVEs (page 364)
Page 364 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1644 | Critical | 9.9 | 2024-02-20 | Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI. |
CVE-2024-1297 | High | 7.2 | 2024-02-20 | Loomio version 2.22.0 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to OS Command Injection. |
CVE-2024-26134 | High | 7.5 | 2024-02-19 | cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior t… |
CVE-2024-26129 | Medium | 5.8 | 2024-02-19 | PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaSc… |
CVE-2024-1638 | High | 8.2 | 2024-02-19 | The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission… |
CVE-2024-1635 | High | 7.5 | 2024-02-19 | A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and… |
CVE-2024-25640 | Medium | 4.6 | 2024-02-19 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerab… |
CVE-2024-25636 | High | 7.1 | 2024-02-19 | Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objec… |
CVE-2024-25635 | High | 8.8 | 2024-02-19 | alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organiz… |
CVE-2024-25634 | High | 7.2 | 2024-02-19 | alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attacker can use a spe… |
CVE-2024-25626 | High | 8.8 | 2024-02-19 | Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware architecture. In Yocto… |
CVE-2024-25983 | Low | 3.5 | 2024-02-19 | Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e… |
CVE-2024-25982 | Medium | 4.3 | 2024-02-19 | The link to update all installed language packs did not include the necessary token to prevent a CSRF risk. |
CVE-2024-25981 | Medium | 4.3 | 2024-02-19 | Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided… |
CVE-2024-25980 | Medium | 4.3 | 2024-02-19 | Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided addit… |
CVE-2024-25979 | Medium | 5.3 | 2024-02-19 | The URL parameters accepted by forum search were not limited to the allowed parameters. |
CVE-2024-25978 | High | 7.5 | 2024-02-19 | Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality. |
CVE-2024-1633 | Low | 2.0 | 2024-02-19 | During the secure boot, bl2 (the second stage of the bootloader) loops over images defined in the table “bl2_mem_params_descs”. For each image, the bl2 reads t… |
CVE-2024-25625 | High | 8.1 | 2024-02-19 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` p… |
CVE-2024-25623 | High | 8.5 | 2024-02-19 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses… |
CVE-2024-1597 | Critical | 10.0 | 2024-02-19 | pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is n… |
CVE-2024-1346 | Medium | 6.8 | 2024-02-19 | Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to calculate the root password of the MySQL d… |
CVE-2024-1345 | Medium | 6.8 | 2024-02-19 | Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to perform a brute force attack and easily di… |
CVE-2024-1344 | Medium | 6.8 | 2024-02-19 | Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password… |
CVE-2024-1343 | Medium | 4.7 | 2024-02-19 | A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup… |
CVE-2024-1580 | Medium | 5.9 | 2024-02-19 | An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder… |
CVE-2024-26308 | Medium | 5.5 | 2024-02-19 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26… |
CVE-2024-25710 | High | 8.1 | 2024-02-19 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1… |
CVE-2024-24722 | Critical | 9.1 | 2024-02-19 | An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an attacker to gain elevated privileges via t… |
CVE-2024-26328 | Medium | 6.0 | 2024-02-19 | An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with h… |
CVE-2024-26327 | Medium | 5.3 | 2024-02-19 | An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than Tota… |
CVE-2024-26318 | Medium | 6.1 | 2024-02-19 | Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character. |
CVE-2024-22337 | Medium | 5.1 | 2024-02-17 | IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files th… |
CVE-2024-22336 | Medium | 5.1 | 2024-02-17 | IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files th… |
CVE-2024-22335 | Medium | 5.1 | 2024-02-17 | IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files th… |
CVE-2024-1512 | Critical | 9.8 | 2024-02-17 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' paramete… |
CVE-2024-0610 | Critical | 9.8 | 2024-02-17 | The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'MerchantReference' parameter in all… |
CVE-2024-25468 | High | 7.5 | 2024-02-17 | An issue in TOTOLINK X5000R V.9.1.0u.6369_B20230113 allows a remote attacker to cause a denial of service via the host_time parameter of the NTPSyncWithHost co… |
CVE-2024-25298 | High | 7.2 | 2024-02-17 | An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php. |
CVE-2024-25297 | Medium | 4.8 | 2024-02-17 | Cross Site Scripting (XSS) vulnerability in Bludit CMS version 3.15, allows remote attackers to execute arbitrary code and obtain sensitive information via edi… |
CVE-2024-21500 | Medium | 4.8 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor a… |
CVE-2024-21499 | Medium | 4.3 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to t… |
CVE-2024-21498 | Medium | 5.3 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation. A… |
CVE-2024-21497 | Medium | 5.4 | 2024-02-17 | Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker could perform a phishin… |
CVE-2024-21496 | Medium | 6.1 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to improper input sanit… |
CVE-2024-21495 | Medium | 6.5 | 2024-02-17 | Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generatio… |
CVE-2024-21494 | Medium | 5.4 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For header due to improp… |
CVE-2024-21493 | Medium | 5.3 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a Caddyfile. Multiple parsing… |
CVE-2024-21492 | Medium | 4.8 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon… |
CVE-2024-22727 | High | 8.3 | 2024-02-17 | Teltonika TRB1-series devices with firmware before TRB1_R_00.07.05.2 allow attackers to exploit a firmware vulnerability via Ethernet LAN or USB. |
CVE-2024-20986 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-20984 | Medium | 4.4 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server : Security : Firewall). Supported versions that are affected are 8.0.35 and prior… |
CVE-2024-20982 | Medium | 4.9 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20980 | Medium | 5.4 | 2024-02-17 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0… |
CVE-2024-20978 | Medium | 4.9 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20976 | Medium | 4.9 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20974 | Medium | 4.9 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20972 | Medium | 4.9 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20970 | Medium | 4.9 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20968 | Medium | 4.4 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.34 and prior and 8.1.0… |
CVE-2024-20966 | Medium | 4.9 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20964 | Medium | 5.3 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.35 and prior… |
CVE-2024-20962 | Medium | 6.5 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20960 | Medium | 6.5 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: RAPID). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and… |
CVE-2024-20958 | Medium | 5.4 | 2024-02-17 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are… |
CVE-2024-20956 | High | 7.3 | 2024-02-17 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). Supported versions that a… |
CVE-2024-20953 | High | 8.8 | 2024-02-17 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable… |
CVE-2024-20951 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected… |
CVE-2024-20949 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected… |
CVE-2024-20947 | Medium | 5.4 | 2024-02-17 | Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are aff… |
CVE-2024-20945 | Medium | 4.7 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2024-20943 | Medium | 5.4 | 2024-02-17 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are… |
CVE-2024-20941 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: HTML UI). Supported versions that are affected are 12.2.3-12.2.13. E… |
CVE-2024-20939 | Medium | 4.3 | 2024-02-17 | Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Admin Console). Supported versions that are affected are 1… |
CVE-2024-20937 | Medium | 4.3 | 2024-02-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affe… |
CVE-2024-20935 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are… |
CVE-2024-20933 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are… |
CVE-2024-20931 | High | 7.5 | 2024-02-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-20929 | Medium | 6.5 | 2024-02-17 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are… |
CVE-2024-20927 | High | 8.6 | 2024-02-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-20925 | Low | 3.1 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-20923 | Low | 3.1 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-20921 | Medium | 5.9 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-20919 | Medium | 5.9 | 2024-02-17 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-20917 | High | 7.5 | 2024-02-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Log Management). The supported version that is… |
CVE-2024-20915 | Medium | 5.3 | 2024-02-17 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO). Supported versions that are affected are 1… |
CVE-2024-20913 | Medium | 5.4 | 2024-02-17 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). The supported version tha… |
CVE-2024-20911 | Low | 2.6 | 2024-02-17 | Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Difficult to exploit vuln… |
CVE-2024-20909 | High | 7.5 | 2024-02-17 | Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Easily exploitable vulner… |
CVE-2024-20907 | Medium | 6.1 | 2024-02-17 | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). Supported versions that are aff… |
CVE-2024-20905 | Low | 2.7 | 2024-02-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affec… |
CVE-2024-20903 | Medium | 6.5 | 2024-02-17 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.21 and 21.3-21.12. Easily exploitable vuln… |
CVE-2024-21984 | Medium | 5.9 | 2024-02-16 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a difficult to exploit Reflected Cross-Site Scripting (XSS) vulnerabili… |
CVE-2024-21983 | Medium | 6.5 | 2024-02-16 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authe… |
CVE-2024-24758 | Low | 3.9 | 2024-02-16 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Prox… |
CVE-2024-24750 | Medium | 6.5 | 2024-02-16 | Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it… |
CVE-2024-25628 | High | 7.6 | 2024-02-16 | Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalida… |
CVE-2024-25627 | Low | 3.5 | 2024-02-16 | Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaS… |
CVE-2024-25083 | Medium | 6.3 | 2024-02-16 | An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low-privileged user initiates a repair, there is an attack vector… |
CVE-2024-21987 | Medium | 5.4 | 2024-02-16 | SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging co… |