2024 CVEs (page 370)
Page 370 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24821 | High | 8.8 | 2024-02-09 | Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation… |
CVE-2024-24820 | High | 8.3 | 2024-02-09 | Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monito… |
CVE-2024-25107 | Medium | 4.9 | 2024-02-08 | WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the `Language::date` function is used w… |
CVE-2024-25106 | Critical | 9.1 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability h… |
CVE-2024-24830 | Critical | 9.9 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been i… |
CVE-2024-24393 | Critical | 9.8 | 2024-02-08 | File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request. |
CVE-2024-24496 | Critical | 9.8 | 2024-02-08 | An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php… |
CVE-2024-24495 | Critical | 9.8 | 2024-02-08 | SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafted GET request. |
CVE-2024-24494 | Medium | 6.1 | 2024-02-08 | Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vita… |
CVE-2024-23756 | High | 7.5 | 2024-02-08 | The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions… |
CVE-2024-24115 | Medium | 5.4 | 2024-02-08 | A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scri… |
CVE-2024-23660 | High | 7.5 | 2024-02-08 | The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently gener… |
CVE-2024-22836 | Critical | 9.8 | 2024-02-08 | An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute s… |
CVE-2024-1329 | High | 7.7 | 2024-02-08 | HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user… |
CVE-2024-0242 | High | 7.3 | 2024-02-08 | Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings. |
CVE-2024-24215 | Medium | 5.3 | 2024-02-08 | An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information via a crafted POST r… |
CVE-2024-23764 | Medium | 6.7 | 2024-02-08 | Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15 and later, WithSecure Server Security 15 and later, Wi… |
CVE-2024-22795 | High | 7.0 | 2024-02-08 | Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Recheck Compliance Status… |
CVE-2024-24321 | Critical | 9.8 | 2024-02-08 | An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function. |
CVE-2024-24213 | Critical | 9.8 | 2024-02-08 | Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that… |
CVE-2024-25191 | Critical | 9.8 | 2024-02-08 | php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-25190 | Critical | 9.8 | 2024-02-08 | l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-25189 | Critical | 9.8 | 2024-02-08 | libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-24834 | Medium | 5.9 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR – Bulk Editor and Products Manager Profes… |
CVE-2024-24878 | High | 7.1 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Almeida | Webdados Portugal CTT Tracking for WooCom… |
CVE-2024-24877 | High | 7.1 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magic Hills Pty Ltd Wonder Slider Lite allows Reflected X… |
CVE-2024-24871 | Medium | 6.5 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy.This issue affects Block… |
CVE-2024-24836 | Medium | 6.5 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Audrasjb GDPR Data Request Form allows Stored XSS.This is… |
CVE-2024-24113 | High | 8.8 | 2024-02-08 | xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE. |
CVE-2024-1312 | Medium | 5.1 | 2024-02-08 | A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot… |
CVE-2024-1150 | High | 7.8 | 2024-02-08 | Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.T… |
CVE-2024-1149 | High | 7.8 | 2024-02-08 | Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Softwa… |
CVE-2024-0985 | High | 8.0 | 2024-02-08 | Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer… |
CVE-2024-24885 | Medium | 5.9 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lê Văn Toản Woocommerce Vietnam Checkout allows Stored XS… |
CVE-2024-24881 | High | 7.1 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for Word… |
CVE-2024-24880 | Medium | 6.5 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Store… |
CVE-2024-24879 | High | 7.1 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This i… |
CVE-2024-24886 | Medium | 5.9 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acowebs Product Labels For Woocommerce (Sale Badges) allo… |
CVE-2024-22464 | Medium | 6.2 | 2024-02-08 | Dell EMC AppSync, versions from 4.2.0.0 to 4.6.0.0 including all Service Pack releases, contain an exposure of sensitive information vulnerability in AppSync… |
CVE-2024-24034 | Medium | 6.1 | 2024-02-08 | Setor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary code. |
CVE-2024-23452 | High | 7.5 | 2024-02-08 | Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description… |
CVE-2024-1207 | Critical | 9.8 | 2024-02-08 | The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to… |
CVE-2024-0965 | Medium | 5.3 | 2024-02-08 | The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the RE… |
CVE-2024-24216 | Critical | 9.8 | 2024-02-08 | Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.ph… |
CVE-2024-24091 | Critical | 9.8 | 2024-02-08 | Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface. |
CVE-2024-0511 | Medium | 4.3 | 2024-02-08 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-24202 | Critical | 9.8 | 2024-02-08 | An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to e… |
CVE-2024-25148 | Medium | 5.4 | 2024-02-08 | In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported… |
CVE-2024-25146 | Medium | 5.3 | 2024-02-08 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported ve… |
CVE-2024-25144 | Medium | 4.1 | 2024-02-08 | The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 befo… |
CVE-2024-24021 | Critical | 9.8 | 2024-02-08 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform S… |
CVE-2024-24017 | Critical | 9.8 | 2024-02-08 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQ… |
CVE-2024-24014 | Critical | 9.8 | 2024-02-08 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQ… |
CVE-2024-24003 | Critical | 9.8 | 2024-02-08 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() functio… |
CVE-2024-22394 | Critical | 9.8 | 2024-02-08 | An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker t… |
CVE-2024-24350 | High | 8.8 | 2024-02-08 | File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extension filtering compo… |
CVE-2024-24026 | Critical | 9.8 | 2024-02-08 | An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg(). An a… |
CVE-2024-24025 | Critical | 9.8 | 2024-02-08 | An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload(). An attacker can pas… |
CVE-2024-24024 | Critical | 9.8 | 2024-02-08 | An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload(). An attacker… |
CVE-2024-24023 | Critical | 9.8 | 2024-02-08 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform S… |
CVE-2024-24018 | Critical | 9.8 | 2024-02-08 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform… |
CVE-2024-24806 | High | 7.3 | 2024-02-07 | libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterp… |
CVE-2024-23448 | Medium | 5.7 | 2024-02-07 | An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that respon… |
CVE-2024-1066 | Medium | 6.5 | 2024-02-07 | An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an at… |
CVE-2024-24488 | Medium | 5.5 | 2024-02-07 | An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password component. |
CVE-2024-23769 | High | 7.3 | 2024-02-07 | Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 (for Windows) allows a local attacker to read privileged data. |
CVE-2024-24824 | High | 8.8 | 2024-02-07 | Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and insta… |
CVE-2024-24823 | Medium | 5.7 | 2024-02-07 | Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session… |
CVE-2024-24822 | Medium | 6.5 | 2024-02-07 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having t… |
CVE-2024-24816 | Medium | 6.1 | 2024-02-07 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior… |
CVE-2024-24706 | Medium | 5.4 | 2024-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Forum One WP-CFM wp-cfm.This issue affects WP-CFM: from n/a through 1.7.8. |
CVE-2024-24563 | Critical | 9.8 | 2024-02-07 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned inte… |
CVE-2024-23806 | Medium | 5.3 | 2024-02-07 | Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys. |
CVE-2024-20290 | High | 7.5 | 2024-02-07 | A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an aff… |
CVE-2024-20255 | High | 8.2 | 2024-02-07 | A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to… |
CVE-2024-20254 | Critical | 9.6 | 2024-02-07 | Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to… |
CVE-2024-20252 | Critical | 9.6 | 2024-02-07 | Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to… |
CVE-2024-24815 | Medium | 6.1 | 2024-02-07 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module… |
CVE-2024-22012 | High | 7.8 | 2024-02-07 | there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges… |
CVE-2024-25145 | Critical | 9.6 | 2024-02-07 | Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported… |
CVE-2024-25143 | Medium | 6.5 | 2024-02-07 | The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix… |
CVE-2024-24812 | Medium | 5.4 | 2024-02-07 | Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to version… |
CVE-2024-24811 | Critical | 9.8 | 2024-02-07 | SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL s… |
CVE-2024-24771 | High | 7.7 | 2024-02-07 | Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication… |
CVE-2024-25201 | High | 7.5 | 2024-02-07 | Espruino 2v20 (commit fcc9ba4) was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at src/jsvar.c. |
CVE-2024-25200 | High | 7.5 | 2024-02-07 | Espruino 2v20 (commit fcc9ba4) was discovered to contain a Stack Overflow via the jspeFactorFunctionCall at src/jsparse.c. |
CVE-2024-24189 | Critical | 9.8 | 2024-02-07 | Jsish v3.5.0 (commit 42c694c) was discovered to contain a use-after-free via the SplitChar at ./src/jsiUtils.c. |
CVE-2024-24188 | Critical | 9.8 | 2024-02-07 | Jsish v3.5.0 was discovered to contain a heap-buffer-overflow in ./src/jsiUtils.c. |
CVE-2024-24186 | Critical | 9.8 | 2024-02-07 | Jsish v3.5.0 (commit 42c694c) was discovered to contain a stack-overflow via the component IterGetKeysCallback at /jsish/src/jsiValue.c. |
CVE-2024-24133 | Critical | 9.8 | 2024-02-07 | Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page. |
CVE-2024-24131 | Medium | 6.1 | 2024-02-07 | SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php. |
CVE-2024-24130 | Medium | 6.1 | 2024-02-07 | Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Usr parameter at resellercenter/l… |
CVE-2024-1118 | High | 8.8 | 2024-02-07 | The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortco… |
CVE-2024-1110 | Medium | 5.3 | 2024-02-07 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function… |
CVE-2024-1109 | Medium | 5.3 | 2024-02-07 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and in… |
CVE-2024-24311 | High | 7.5 | 2024-02-07 | Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" (lgsitemaps) module for PrestaShop before version 1.6.6, a guest… |
CVE-2024-24304 | High | 7.5 | 2024-02-07 | In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical information without restriction. |
CVE-2024-24303 | Critical | 9.8 | 2024-02-07 | SQL Injection vulnerability in HiPresta "Gift Wrapping Pro" (hiadvancedgiftwrapping) module for PrestaShop before version 1.4.1, allows remote attackers to esc… |
CVE-2024-1079 | Medium | 5.3 | 2024-02-07 | The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_show_results() function in all ve… |
CVE-2024-1078 | Medium | 4.3 | 2024-02-07 | The Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ays_quick_start() and add_quest… |