2024 CVEs (page 366)
Page 366 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25617 | Medium | 5.3 | 2024-02-14 | Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerab… |
CVE-2024-25165 | High | 7.8 | 2024-02-14 | A global-buffer-overflow vulnerability was found in SWFTools v0.9.2, in the function LineText at lib/swf5compiler.flex. |
CVE-2024-1482 | High | 7.1 | 2024-02-14 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and… |
CVE-2024-25301 | High | 7.2 | 2024-02-14 | Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php. |
CVE-2024-25300 | Medium | 4.8 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-0011 | Medium | 4.3 | 2024-02-14 | A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScr… |
CVE-2024-0010 | Medium | 4.3 | 2024-02-14 | A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious J… |
CVE-2024-0009 | Medium | 6.3 | 2024-02-14 | An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credenti… |
CVE-2024-0008 | Medium | 6.6 | 2024-02-14 | Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized acces… |
CVE-2024-0007 | Medium | 6.8 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScri… |
CVE-2024-24990 | High | 7.5 | 2024-02-14 | When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/… |
CVE-2024-24989 | High | 7.5 | 2024-02-14 | When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/… |
CVE-2024-24966 | Medium | 6.2 | 2024-02-14 | When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized. Note: Software versions which h… |
CVE-2024-24775 | High | 7.5 | 2024-02-14 | When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to ter… |
CVE-2024-23982 | High | 7.5 | 2024-02-14 | When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to t… |
CVE-2024-23979 | High | 7.5 | 2024-02-14 | When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual server, undisclos… |
CVE-2024-23976 | Medium | 6.0 | 2024-02-14 | When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX t… |
CVE-2024-23805 | High | 7.5 | 2024-02-14 | Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. For the Application Visibility and Reporting module, this may occur when… |
CVE-2024-23607 | Medium | 5.5 | 2024-02-14 | A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read files outside the QKView directory. Note… |
CVE-2024-23603 | Low | 3.8 | 2024-02-14 | An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Note: Software versions which have reached End of Techn… |
CVE-2024-23314 | High | 7.5 | 2024-02-14 | When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: S… |
CVE-2024-23308 | High | 7.5 | 2024-02-14 | When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, undisclosed requests can cause the BD pro… |
CVE-2024-23306 | High | 7.1 | 2024-02-14 | A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files. Note: Software versions which have reached End… |
CVE-2024-22389 | High | 7.2 | 2024-02-14 | When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software ve… |
CVE-2024-22093 | High | 8.7 | 2024-02-14 | When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems… |
CVE-2024-21849 | High | 7.5 | 2024-02-14 | When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management M… |
CVE-2024-21789 | High | 7.5 | 2024-02-14 | When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization… |
CVE-2024-21782 | Medium | 6.7 | 2024-02-14 | BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (ba… |
CVE-2024-21771 | High | 7.5 | 2024-02-14 | For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the traffic against signatures, resulting in Traffic Ma… |
CVE-2024-21763 | High | 7.5 | 2024-02-14 | When BIG-IP AFM Device DoS or DoS profile is configured with NXDOMAIN attack vector and bad actor detection, undisclosed queries can cause the Traffic Managem… |
CVE-2024-0568 | High | 8.8 | 2024-02-14 | CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration over NFC communication. |
CVE-2024-25226 | Medium | 6.1 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injec… |
CVE-2024-25225 | Medium | 5.4 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injec… |
CVE-2024-25224 | Medium | 5.4 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injec… |
CVE-2024-25223 | Critical | 9.8 | 2024-02-14 | Simple Admin Panel App v1.0 was discovered to contain a SQL injection vulnerability via the orderID parameter at /adminView/viewEachOrder.php. |
CVE-2024-25222 | Critical | 9.8 | 2024-02-14 | Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the projectID parameter at /TaskManager/EditProject.php. |
CVE-2024-25221 | Medium | 6.1 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2024-25220 | Critical | 9.8 | 2024-02-14 | Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the taskID parameter at /TaskManager/EditTask.php. |
CVE-2024-25219 | Medium | 6.1 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2024-25218 | Medium | 6.1 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2024-25217 | Critical | 9.8 | 2024-02-14 | Online Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /omos/?p=products/view_product. |
CVE-2024-25216 | Critical | 9.8 | 2024-02-14 | Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the mailud parameter at /aprocess.php. |
CVE-2024-25215 | Critical | 9.8 | 2024-02-14 | Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the pwd parameter at /aprocess.php. |
CVE-2024-25214 | Critical | 9.8 | 2024-02-14 | An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at… |
CVE-2024-25213 | High | 7.2 | 2024-02-14 | Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /edit.php. |
CVE-2024-25212 | High | 7.2 | 2024-02-14 | Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /delete.php. |
CVE-2024-25211 | Critical | 9.8 | 2024-02-14 | Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the category parameter at /endpoint/delete_category.php. |
CVE-2024-25210 | Critical | 9.8 | 2024-02-14 | Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the expense parameter at /endpoint/delete_expense.php. |
CVE-2024-25209 | Critical | 9.8 | 2024-02-14 | Barangay Population Monitoring System 1.0 was discovered to contain a SQL injection vulnerability via the resident parameter at /endpoint/delete-resident.php. |
CVE-2024-25208 | Medium | 5.4 | 2024-02-14 | Barangay Population Monitoring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Resident function at /barangay-popul… |
CVE-2024-25207 | Medium | 5.4 | 2024-02-14 | Barangay Population Monitoring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Resident function at /barangay-popul… |
CVE-2024-23952 | Medium | 6.5 | 2024-02-14 | This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by a… |
CVE-2024-23789 | High | 8.8 | 2024-02-14 | Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arb… |
CVE-2024-23788 | High | 8.1 | 2024-02-14 | Server-side request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjace… |
CVE-2024-23787 | Medium | 6.5 | 2024-02-14 | Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenti… |
CVE-2024-23786 | Critical | 9.3 | 2024-02-14 | Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unau… |
CVE-2024-23785 | Medium | 6.5 | 2024-02-14 | Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthen… |
CVE-2024-23784 | Medium | 6.5 | 2024-02-14 | Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a n… |
CVE-2024-23783 | High | 8.8 | 2024-02-14 | Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent u… |
CVE-2024-22455 | Medium | 4.4 | 2024-02-14 | Dell Mobility - E-Lab Navigator, version(s) 3.1.9, 3.2.0, contain(s) an Authorization Bypass Through User-Controlled Key vulnerability. An unauthenticated atta… |
CVE-2024-25125 | Medium | 5.3 | 2024-02-14 | Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's digdag workload au… |
CVE-2024-24699 | Medium | 6.5 | 2024-02-14 | Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access. |
CVE-2024-24698 | Medium | 4.9 | 2024-02-14 | Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access. |
CVE-2024-24697 | High | 7.2 | 2024-02-14 | Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access. |
CVE-2024-24696 | Medium | 6.8 | 2024-02-14 | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to… |
CVE-2024-24695 | Medium | 6.8 | 2024-02-14 | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to… |
CVE-2024-24691 | Critical | 9.6 | 2024-02-14 | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user t… |
CVE-2024-24690 | Medium | 5.4 | 2024-02-14 | Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-1485 | High | 8.0 | 2024-02-14 | A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsin… |
CVE-2024-25121 | High | 7.1 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Laye… |
CVE-2024-25120 | Medium | 4.3 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resou… |
CVE-2024-25119 | Medium | 4.9 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displ… |
CVE-2024-25118 | Medium | 4.3 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TY… |
CVE-2024-24142 | Critical | 9.8 | 2024-02-13 | Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter. |
CVE-2024-25122 | High | 7.1 | 2024-02-13 | sidekiq-unique-jobs is an open source project which prevents simultaneous Sidekiq jobs with the same unique arguments to run. Specially crafted GET request par… |
CVE-2024-24814 | High | 7.5 | 2024-02-13 | mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Part… |
CVE-2024-24751 | Medium | 4.3 | 2024-02-13 | sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control c… |
CVE-2024-1378 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1374 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1372 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1369 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1359 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1355 | Critical | 9.1 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1354 | High | 8.0 | 2024-02-13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain adm… |
CVE-2024-1084 | Medium | 6.5 | 2024-02-13 | Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user interact… |
CVE-2024-1082 | Medium | 6.3 | 2024-02-13 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker to gain unauthorized read permission to files by deploying a… |
CVE-2024-21420 | High | 8.8 | 2024-02-13 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2024-21413 | Critical | 9.8 | 2024-02-13 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2024-21412 | High | 8.1 | 2024-02-13 | Internet Shortcut Files Security Feature Bypass Vulnerability |
CVE-2024-21410 | Critical | 9.8 | 2024-02-13 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2024-21406 | High | 7.5 | 2024-02-13 | Windows Printing Service Spoofing Vulnerability |
CVE-2024-21405 | High | 7.0 | 2024-02-13 | Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability |
CVE-2024-21404 | High | 7.5 | 2024-02-13 | .NET Denial of Service Vulnerability |
CVE-2024-21403 | Critical | 9.0 | 2024-02-13 | Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability |
CVE-2024-21402 | High | 7.1 | 2024-02-13 | Microsoft Outlook Elevation of Privilege Vulnerability |
CVE-2024-21401 | Critical | 9.8 | 2024-02-13 | Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability |
CVE-2024-21397 | Medium | 5.3 | 2024-02-13 | Microsoft Azure File Sync Elevation of Privilege Vulnerability |
CVE-2024-21396 | High | 7.6 | 2024-02-13 | Dynamics 365 Sales Spoofing Vulnerability |
CVE-2024-21395 | High | 8.2 | 2024-02-13 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability |
CVE-2024-21394 | High | 7.6 | 2024-02-13 | Dynamics 365 Field Service Spoofing Vulnerability |