2024 CVEs (page 366)
Page 366 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20743 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2024-20742 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read… |
CVE-2024-20741 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by a Write-what-where Condition vulnerability that could result in arbitrary code execution in th… |
CVE-2024-20740 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2024-20725 | Medium | 5.5 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An atta… |
CVE-2024-20724 | Medium | 5.5 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An atta… |
CVE-2024-20723 | High | 7.8 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context o… |
CVE-2024-20722 | Medium | 5.5 | 2024-02-15 | Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An atta… |
CVE-2024-0390 | Critical | 9.8 | 2024-02-15 | INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation dev… |
CVE-2024-24386 | High | 7.2 | 2024-02-15 | An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder. |
CVE-2024-24256 | Medium | 5.9 | 2024-02-15 | SQL Injection vulnerability in Yonyou space-time enterprise information integration platform v.9.0 and before allows an attacker to obtain sensitive informatio… |
CVE-2024-0353 | High | 7.8 | 2024-02-15 | Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission. |
CVE-2024-21727 | Medium | 6.1 | 2024-02-15 | XSS vulnerability in DP Calendar component for Joomla. |
CVE-2024-0708 | Medium | 5.3 | 2024-02-15 | The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2024-25941 | Low | 3.3 | 2024-02-15 | The jail(2) system call has not limited a visiblity of allocated TTYs (the kern.ttys sysctl). This gives rise to an information leak about processes outside t… |
CVE-2024-25940 | Medium | 6.3 | 2024-02-15 | `bhyveload -h <host-path>` may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any… |
CVE-2024-25559 | Medium | 4.7 | 2024-02-15 | URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may… |
CVE-2024-1488 | High | 8.0 | 2024-02-15 | A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configu… |
CVE-2024-26264 | Critical | 9.8 | 2024-02-15 | EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allo… |
CVE-2024-26263 | Medium | 5.3 | 2024-02-15 | EBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse specific pages and query sensitive data with… |
CVE-2024-26262 | High | 8.8 | 2024-02-15 | EBM Technologies Uniweb/SoliPACS WebServer's query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular us… |
CVE-2024-26261 | Critical | 9.8 | 2024-02-15 | The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in… |
CVE-2024-26260 | Critical | 9.8 | 2024-02-15 | The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system… |
CVE-2024-1523 | High | 8.8 | 2024-02-15 | EC-WEB FS-EZViewer(Web)'s query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL co… |
CVE-2024-25620 | Medium | 6.4 | 2024-02-15 | Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whos… |
CVE-2024-24301 | High | 8.8 | 2024-02-14 | Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to… |
CVE-2024-24300 | Critical | 9.8 | 2024-02-14 | 4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, th… |
CVE-2024-1471 | Medium | 5.9 | 2024-02-14 | An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify R… |
CVE-2024-1367 | High | 7.2 | 2024-02-14 | A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify… |
CVE-2024-25619 | Low | 3.1 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed… |
CVE-2024-25618 | Medium | 4.2 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML… |
CVE-2024-25617 | Medium | 5.3 | 2024-02-14 | Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerab… |
CVE-2024-25165 | High | 7.8 | 2024-02-14 | A global-buffer-overflow vulnerability was found in SWFTools v0.9.2, in the function LineText at lib/swf5compiler.flex. |
CVE-2024-1482 | High | 7.1 | 2024-02-14 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and… |
CVE-2024-25301 | High | 7.2 | 2024-02-14 | Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php. |
CVE-2024-25300 | Medium | 4.8 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-0011 | Medium | 4.3 | 2024-02-14 | A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScr… |
CVE-2024-0010 | Medium | 4.3 | 2024-02-14 | A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious J… |
CVE-2024-0009 | Medium | 6.3 | 2024-02-14 | An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credenti… |
CVE-2024-0008 | Medium | 6.6 | 2024-02-14 | Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized acces… |
CVE-2024-0007 | Medium | 6.8 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScri… |
CVE-2024-24990 | High | 7.5 | 2024-02-14 | When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/… |
CVE-2024-24989 | High | 7.5 | 2024-02-14 | When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/… |
CVE-2024-24966 | Medium | 6.2 | 2024-02-14 | When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized. Note: Software versions which h… |
CVE-2024-24775 | High | 7.5 | 2024-02-14 | When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to ter… |
CVE-2024-23982 | High | 7.5 | 2024-02-14 | When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to t… |
CVE-2024-23979 | High | 7.5 | 2024-02-14 | When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual server, undisclos… |
CVE-2024-23976 | Medium | 6.0 | 2024-02-14 | When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX t… |
CVE-2024-23805 | High | 7.5 | 2024-02-14 | Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. For the Application Visibility and Reporting module, this may occur when… |
CVE-2024-23607 | Medium | 5.5 | 2024-02-14 | A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read files outside the QKView directory. Note… |
CVE-2024-23603 | Low | 3.8 | 2024-02-14 | An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Note: Software versions which have reached End of Techn… |
CVE-2024-23314 | High | 7.5 | 2024-02-14 | When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: S… |
CVE-2024-23308 | High | 7.5 | 2024-02-14 | When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, undisclosed requests can cause the BD pro… |
CVE-2024-23306 | High | 7.1 | 2024-02-14 | A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files. Note: Software versions which have reached End… |
CVE-2024-22389 | High | 7.2 | 2024-02-14 | When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software ve… |
CVE-2024-22093 | High | 8.7 | 2024-02-14 | When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems… |
CVE-2024-21849 | High | 7.5 | 2024-02-14 | When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management M… |
CVE-2024-21789 | High | 7.5 | 2024-02-14 | When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization… |
CVE-2024-21782 | Medium | 6.7 | 2024-02-14 | BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (ba… |
CVE-2024-21771 | High | 7.5 | 2024-02-14 | For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the traffic against signatures, resulting in Traffic Ma… |
CVE-2024-21763 | High | 7.5 | 2024-02-14 | When BIG-IP AFM Device DoS or DoS profile is configured with NXDOMAIN attack vector and bad actor detection, undisclosed queries can cause the Traffic Managem… |
CVE-2024-0568 | High | 8.8 | 2024-02-14 | CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration over NFC communication. |
CVE-2024-25226 | Medium | 6.1 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injec… |
CVE-2024-25225 | Medium | 5.4 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injec… |
CVE-2024-25224 | Medium | 5.4 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injec… |
CVE-2024-25223 | Critical | 9.8 | 2024-02-14 | Simple Admin Panel App v1.0 was discovered to contain a SQL injection vulnerability via the orderID parameter at /adminView/viewEachOrder.php. |
CVE-2024-25222 | Critical | 9.8 | 2024-02-14 | Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the projectID parameter at /TaskManager/EditProject.php. |
CVE-2024-25221 | Medium | 6.1 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2024-25220 | Critical | 9.8 | 2024-02-14 | Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the taskID parameter at /TaskManager/EditTask.php. |
CVE-2024-25219 | Medium | 6.1 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2024-25218 | Medium | 6.1 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2024-25217 | Critical | 9.8 | 2024-02-14 | Online Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /omos/?p=products/view_product. |
CVE-2024-25216 | Critical | 9.8 | 2024-02-14 | Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the mailud parameter at /aprocess.php. |
CVE-2024-25215 | Critical | 9.8 | 2024-02-14 | Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the pwd parameter at /aprocess.php. |
CVE-2024-25214 | Critical | 9.8 | 2024-02-14 | An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at… |
CVE-2024-25213 | High | 7.2 | 2024-02-14 | Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /edit.php. |
CVE-2024-25212 | High | 7.2 | 2024-02-14 | Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /delete.php. |
CVE-2024-25211 | Critical | 9.8 | 2024-02-14 | Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the category parameter at /endpoint/delete_category.php. |
CVE-2024-25210 | Critical | 9.8 | 2024-02-14 | Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the expense parameter at /endpoint/delete_expense.php. |
CVE-2024-25209 | Critical | 9.8 | 2024-02-14 | Barangay Population Monitoring System 1.0 was discovered to contain a SQL injection vulnerability via the resident parameter at /endpoint/delete-resident.php. |
CVE-2024-25208 | Medium | 5.4 | 2024-02-14 | Barangay Population Monitoring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Resident function at /barangay-popul… |
CVE-2024-25207 | Medium | 5.4 | 2024-02-14 | Barangay Population Monitoring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Resident function at /barangay-popul… |
CVE-2024-23952 | Medium | 6.5 | 2024-02-14 | This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by a… |
CVE-2024-23789 | High | 8.8 | 2024-02-14 | Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arb… |
CVE-2024-23788 | High | 8.1 | 2024-02-14 | Server-side request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjace… |
CVE-2024-23787 | Medium | 6.5 | 2024-02-14 | Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenti… |
CVE-2024-23786 | Critical | 9.3 | 2024-02-14 | Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unau… |
CVE-2024-23785 | Medium | 6.5 | 2024-02-14 | Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthen… |
CVE-2024-23784 | Medium | 6.5 | 2024-02-14 | Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a n… |
CVE-2024-23783 | High | 8.8 | 2024-02-14 | Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent u… |
CVE-2024-22455 | Medium | 4.4 | 2024-02-14 | Dell Mobility - E-Lab Navigator, version(s) 3.1.9, 3.2.0, contain(s) an Authorization Bypass Through User-Controlled Key vulnerability. An unauthenticated atta… |
CVE-2024-25125 | Medium | 5.3 | 2024-02-14 | Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's digdag workload au… |
CVE-2024-24699 | Medium | 6.5 | 2024-02-14 | Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access. |
CVE-2024-24698 | Medium | 4.9 | 2024-02-14 | Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access. |
CVE-2024-24697 | High | 7.2 | 2024-02-14 | Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access. |
CVE-2024-24696 | Medium | 6.8 | 2024-02-14 | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to… |
CVE-2024-24695 | Medium | 6.8 | 2024-02-14 | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to… |
CVE-2024-24691 | Critical | 9.6 | 2024-02-14 | Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user t… |
CVE-2024-24690 | Medium | 5.4 | 2024-02-14 | Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-1485 | High | 8.0 | 2024-02-14 | A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsin… |