2024 CVEs (page 369)
Page 369 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1406 | Medium | 4.3 | 2024-02-10 | A vulnerability was found in Linksys WRT54GL 4.30.18. It has been declared as problematic. This vulnerability affects unknown code of the file /SysInfo1.htm of… |
CVE-2024-0596 | Medium | 5.3 | 2024-02-10 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check o… |
CVE-2024-0595 | Medium | 4.3 | 2024-02-10 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp… |
CVE-2024-0594 | High | 8.8 | 2024-02-10 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to union-based SQL Injection via the 'q' parameter of the wpas_get… |
CVE-2024-1405 | Medium | 4.3 | 2024-02-10 | A vulnerability was found in Linksys WRT54GL 4.30.18. It has been classified as problematic. This affects an unknown part of the file /wlaninfo.htm of the comp… |
CVE-2024-21490 | High | 7.5 | 2024-02-10 | This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-s… |
CVE-2024-25109 | Medium | 6.5 | 2024-02-09 | ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` ke… |
CVE-2024-24828 | Medium | 6.6 | 2024-02-09 | pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by `pkg` are written to a hardcoded directory. On unix system… |
CVE-2024-23327 | High | 7.5 | 2024-02-09 | Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when at… |
CVE-2024-23325 | High | 7.5 | 2024-02-09 | Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by the OS. Envoy is susc… |
CVE-2024-23324 | High | 8.6 | 2024-02-09 | Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid… |
CVE-2024-23323 | Medium | 4.3 | 2024-02-09 | Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased reques… |
CVE-2024-23322 | High | 7.5 | 2024-02-09 | Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the follow… |
CVE-2024-21624 | Medium | 5.7 | 2024-02-09 | nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., en… |
CVE-2024-1404 | Medium | 4.3 | 2024-02-09 | A vulnerability was found in Linksys WRT54GL 4.30.18 and classified as problematic. Affected by this issue is some unknown functionality of the file /SysInfo.h… |
CVE-2024-1246 | Low | 2.0 | 2024-02-09 | Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided… |
CVE-2024-1245 | Low | 2.4 | 2024-02-09 | Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not suf… |
CVE-2024-1247 | Low | 2.0 | 2024-02-09 | Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data… |
CVE-2024-1402 | Medium | 4.3 | 2024-02-09 | Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, a… |
CVE-2024-25454 | Medium | 5.5 | 2024-02-09 | Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_DescriptorFinder::Test() function. |
CVE-2024-25453 | Medium | 5.5 | 2024-02-09 | Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_StszAtom::GetSampleSize() function. |
CVE-2024-25452 | Medium | 5.5 | 2024-02-09 | Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_UrlAtom::AP4_UrlAtom() function. |
CVE-2024-25451 | Medium | 6.5 | 2024-02-09 | Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_DataBuffer::ReallocateBuffer() function. |
CVE-2024-25450 | High | 8.8 | 2024-02-09 | imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts(). |
CVE-2024-25448 | High | 8.8 | 2024-02-09 | An issue in the imlib_free_image_and_decache function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafted image. |
CVE-2024-25447 | High | 8.8 | 2024-02-09 | An issue in the imlib_load_image_with_error_return function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafted image. |
CVE-2024-25446 | High | 7.8 | 2024-02-09 | An issue in the HuginBase::PTools::setDestImage function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a crafted image. |
CVE-2024-25445 | High | 7.8 | 2024-02-09 | Improper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure. |
CVE-2024-25443 | High | 7.8 | 2024-02-09 | An issue in the HuginBase::ImageVariable<double>::linkWith function of Hugin v2022.0.0 allows attackers to cause a heap-use-after-free via parsing a crafted im… |
CVE-2024-25442 | High | 7.8 | 2024-02-09 | An issue in the HuginBase::PanoramaMemento::loadPTScript function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a crafted ima… |
CVE-2024-24776 | Low | 3.1 | 2024-02-09 | Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a use… |
CVE-2024-24774 | Low | 3.4 | 2024-02-09 | Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription… |
CVE-2024-23319 | Low | 3.5 | 2024-02-09 | Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connec… |
CVE-2024-25318 | High | 8.8 | 2024-02-09 | Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'pid' parameter in Hotel/admin/print.php?pid=2. |
CVE-2024-25316 | Critical | 9.8 | 2024-02-09 | Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'eid' parameter in Hotel/admin/usersettingdel.php?eid=2. |
CVE-2024-25315 | Critical | 9.8 | 2024-02-09 | Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2. |
CVE-2024-25314 | Critical | 9.8 | 2024-02-09 | Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'sid' parameter in Hotel/admin/show.php?sid=2. |
CVE-2024-25310 | High | 8.8 | 2024-02-09 | Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'id' parameter at "School/delete.php?id=5." |
CVE-2024-25307 | Critical | 9.8 | 2024-02-09 | Code-projects Cinema Seat Reservation System 1.0 allows SQL Injection via the 'id' parameter at "/Cinema-Reservation/booking.php?id=1." |
CVE-2024-25302 | Critical | 9.8 | 2024-02-09 | Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter. |
CVE-2024-25313 | High | 8.8 | 2024-02-09 | Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/teacher_login.php. |
CVE-2024-25312 | High | 8.8 | 2024-02-09 | Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'id' parameter at "School/sub_delete.php?id=5." |
CVE-2024-25309 | High | 8.8 | 2024-02-09 | Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'pass' parameter at School/teacher_login.php. |
CVE-2024-25308 | High | 8.8 | 2024-02-09 | Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'name' parameter at School/teacher_login.php. |
CVE-2024-25306 | High | 8.8 | 2024-02-09 | Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'aname' parameter at "School/index.php". |
CVE-2024-25305 | High | 8.8 | 2024-02-09 | Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php. |
CVE-2024-25304 | High | 8.8 | 2024-02-09 | Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'apass' parameter at "School/index.php." |
CVE-2024-25679 | Medium | 6.5 | 2024-02-09 | In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by sending a CONNECTION_… |
CVE-2024-25678 | Critical | 9.8 | 2024-02-09 | In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled. |
CVE-2024-25677 | High | 8.8 | 2024-02-09 | In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin resources. For exa… |
CVE-2024-25675 | Critical | 9.8 | 2024-02-09 | An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/Job… |
CVE-2024-25674 | Critical | 9.8 | 2024-02-09 | An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type. |
CVE-2024-22119 | Medium | 5.5 | 2024-02-09 | The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section. |
CVE-2024-21762 | Critical | 9.8 | 2024-02-09 | A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15… |
CVE-2024-24308 | Critical | 9.8 | 2024-02-09 | SQL Injection vulnerability in Boostmyshop (boostmyshopagent) module for Prestashop versions 1.1.9 and before, allows remote attackers to escalate privileges a… |
CVE-2024-23749 | High | 7.8 | 2024-02-09 | KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation… |
CVE-2024-25004 | High | 7.8 | 2024-02-09 | KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checking and input sanit… |
CVE-2024-25003 | High | 7.8 | 2024-02-09 | KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds checking and input sanit… |
CVE-2024-0229 | High | 7.8 | 2024-02-09 | An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different… |
CVE-2024-1122 | Medium | 5.3 | 2024-02-09 | The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing… |
CVE-2024-0842 | High | 7.5 | 2024-02-09 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 1.2.6. This is… |
CVE-2024-0657 | Medium | 4.4 | 2024-02-09 | The Internal Link Juicer: SEO Auto Linker for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as 'ilj_setti… |
CVE-2024-24819 | Medium | 5.3 | 2024-02-09 | icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` is the base for vario… |
CVE-2024-23639 | Medium | 5.1 | 2024-02-09 | Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Ko… |
CVE-2024-22332 | Medium | 6.5 | 2024-02-09 | The IBM Integration Bus for z/OS 10.1 through 10.1.0.2 AdminAPI is vulnerable to a denial of service due to file system exhaustion. IBM X-Force ID: 279972. |
CVE-2024-22318 | Medium | 5.1 | 2024-02-09 | IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modif… |
CVE-2024-1353 | Medium | 6.3 | 2024-02-09 | A vulnerability, which was classified as critical, has been found in PHPEMS up to 1.0. Affected by this issue is the function index of the file app/weixin/cont… |
CVE-2024-24829 | Medium | 4.3 | 2024-02-09 | Sentry is an error tracking and performance monitoring platform. Sentry’s integration platform provides a way for external services to interact with Sentry. On… |
CVE-2024-24825 | Critical | 9.1 | 2024-02-09 | DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resou… |
CVE-2024-24821 | High | 8.8 | 2024-02-09 | Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation… |
CVE-2024-24820 | High | 8.3 | 2024-02-09 | Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monito… |
CVE-2024-25107 | Medium | 4.9 | 2024-02-08 | WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the `Language::date` function is used w… |
CVE-2024-25106 | Critical | 9.1 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability h… |
CVE-2024-24830 | Critical | 9.9 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been i… |
CVE-2024-24393 | Critical | 9.8 | 2024-02-08 | File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request. |
CVE-2024-24496 | Critical | 9.8 | 2024-02-08 | An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php… |
CVE-2024-24495 | Critical | 9.8 | 2024-02-08 | SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafted GET request. |
CVE-2024-24494 | Medium | 6.1 | 2024-02-08 | Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vita… |
CVE-2024-23756 | High | 7.5 | 2024-02-08 | The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions… |
CVE-2024-24115 | Medium | 5.4 | 2024-02-08 | A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scri… |
CVE-2024-23660 | High | 7.5 | 2024-02-08 | The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently gener… |
CVE-2024-22836 | Critical | 9.8 | 2024-02-08 | An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute s… |
CVE-2024-1329 | High | 7.7 | 2024-02-08 | HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user… |
CVE-2024-0242 | High | 7.3 | 2024-02-08 | Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings. |
CVE-2024-24215 | Medium | 5.3 | 2024-02-08 | An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information via a crafted POST r… |
CVE-2024-23764 | Medium | 6.7 | 2024-02-08 | Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15 and later, WithSecure Server Security 15 and later, Wi… |
CVE-2024-22795 | High | 7.0 | 2024-02-08 | Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Recheck Compliance Status… |
CVE-2024-24321 | Critical | 9.8 | 2024-02-08 | An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function. |
CVE-2024-24213 | Critical | 9.8 | 2024-02-08 | Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that… |
CVE-2024-25191 | Critical | 9.8 | 2024-02-08 | php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-25190 | Critical | 9.8 | 2024-02-08 | l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-25189 | Critical | 9.8 | 2024-02-08 | libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-24834 | Medium | 5.9 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR – Bulk Editor and Products Manager Profes… |
CVE-2024-24878 | High | 7.1 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Almeida | Webdados Portugal CTT Tracking for WooCom… |
CVE-2024-24877 | High | 7.1 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magic Hills Pty Ltd Wonder Slider Lite allows Reflected X… |
CVE-2024-24871 | Medium | 6.5 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy.This issue affects Block… |
CVE-2024-24836 | Medium | 6.5 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Audrasjb GDPR Data Request Form allows Stored XSS.This is… |
CVE-2024-24113 | High | 8.8 | 2024-02-08 | xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE. |
CVE-2024-1312 | Medium | 5.1 | 2024-02-08 | A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot… |
CVE-2024-1150 | High | 7.8 | 2024-02-08 | Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.T… |