2024 CVEs (page 371)
Page 371 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24575 | High | 7.5 | 2024-02-06 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2024-24254 | Medium | 4.2 | 2024-02-06 | PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability in the geofence.cpp… |
CVE-2024-22520 | High | 8.2 | 2024-02-06 | An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of crafted data packets. |
CVE-2024-22519 | High | 8.2 | 2024-02-06 | An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets. |
CVE-2024-1261 | Medium | 6.3 | 2024-02-06 | A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controlle… |
CVE-2024-1260 | Medium | 6.3 | 2024-02-06 | A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/… |
CVE-2024-22515 | High | 8.8 | 2024-02-06 | Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to upload arbitrary files via the upload audio component. |
CVE-2024-22514 | High | 8.8 | 2024-02-06 | An issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files by restoring a crafted backup file. |
CVE-2024-1259 | Medium | 6.3 | 2024-02-06 | A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/… |
CVE-2024-1258 | Low | 3.1 | 2024-02-06 | A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-22241 | Medium | 4.3 | 2024-02-06 | Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the log… |
CVE-2024-22240 | Medium | 4.9 | 2024-02-06 | Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauth… |
CVE-2024-22239 | Medium | 5.3 | 2024-02-06 | Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this v… |
CVE-2024-22238 | Medium | 6.4 | 2024-02-06 | Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into u… |
CVE-2024-22237 | High | 7.8 | 2024-02-06 | Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this v… |
CVE-2024-1257 | Low | 3.5 | 2024-02-06 | A vulnerability was found in Jspxcms 10.2.0. It has been classified as problematic. Affected is an unknown function of the file /ext/collect/find_text.do. The… |
CVE-2024-1256 | Low | 3.5 | 2024-02-06 | A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. This issue affects some unknown processing of the file /ext/collect/filter_text.do… |
CVE-2024-1255 | Medium | 5.3 | 2024-02-06 | A vulnerability has been found in sepidz SepidzDigitalMenu up to 7.1.0728.1 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-1254 | Medium | 4.7 | 2024-02-06 | A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /… |
CVE-2024-1048 | Low | 3.3 | 2024-02-06 | A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grub… |
CVE-2024-22331 | Medium | 6.2 | 2024-02-06 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.19, 7.1 through 7.1.2.15, 7.2 through 7.2.3.8, 7.3 through 7.3.2.3, and IBM UrbanCode Deploy (UCD) - IBM DevOps De… |
CVE-2024-1253 | Medium | 4.7 | 2024-02-06 | A vulnerability, which was classified as critical, has been found in Byzoro Smart S40 Management Platform up to 20240126. Affected by this issue is some unknow… |
CVE-2024-1252 | Medium | 5.5 | 2024-02-06 | A vulnerability classified as critical was found in Tongda OA 2017 up to 11.9. Affected by this vulnerability is an unknown functionality of the file /general/… |
CVE-2024-24291 | Medium | 6.1 | 2024-02-06 | An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL. |
CVE-2024-24015 | Critical | 9.8 | 2024-02-06 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform… |
CVE-2024-24013 | Critical | 9.8 | 2024-02-06 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQ… |
CVE-2024-24000 | Critical | 9.8 | 2024-02-06 | jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter… |
CVE-2024-23344 | Medium | 5.3 | 2024-02-06 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a p… |
CVE-2024-1251 | Medium | 5.5 | 2024-02-06 | A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /general/email/outbox/delete.p… |
CVE-2024-24594 | Critical | 9.9 | 2024-02-06 | A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a J… |
CVE-2024-24593 | Critical | 9.6 | 2024-02-06 | A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote att… |
CVE-2024-24592 | Critical | 9.8 | 2024-02-06 | Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, mod… |
CVE-2024-24591 | High | 8.0 | 2024-02-06 | A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write l… |
CVE-2024-24590 | High | 8.0 | 2024-02-06 | Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded ar… |
CVE-2024-0911 | Medium | 5.5 | 2024-02-06 | A flaw was found in indent, a program for formatting C code. This issue may allow an attacker to trick a user into processing a specially crafted file to trigg… |
CVE-2024-0690 | Medium | 5.0 | 2024-02-06 | An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still i… |
CVE-2024-24943 | Medium | 5.3 | 2024-02-06 | In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image |
CVE-2024-24942 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives |
CVE-2024-24941 | Medium | 6.1 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL |
CVE-2024-24940 | Low | 2.8 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives |
CVE-2024-24939 | Low | 3.3 | 2024-02-06 | In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible |
CVE-2024-24938 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation |
CVE-2024-24937 | Medium | 4.6 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible |
CVE-2024-24936 | Medium | 4.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed |
CVE-2024-23917 | Critical | 9.8 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible |
CVE-2024-23673 | High | 8.5 | 2024-02-06 | Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlet… |
CVE-2024-25140 | Critical | 9.8 | 2024-02-06 | A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Co… |
CVE-2024-0684 | Medium | 5.5 | 2024-02-06 | A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_by… |
CVE-2024-22365 | Medium | 5.5 | 2024-02-06 | linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_di… |
CVE-2024-22433 | High | 8.8 | 2024-02-06 | Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in DP Search. A remot… |
CVE-2024-23304 | High | 7.5 | 2024-02-06 | Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operation… |
CVE-2024-24808 | Medium | 4.7 | 2024-02-06 | pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redi… |
CVE-2024-20828 | Low | 2.4 | 2024-02-06 | Improper authorization verification vulnerability in Samsung Internet prior to version 24.0 allows physical attackers to access files downloaded in SecretMode… |
CVE-2024-20827 | Medium | 4.6 | 2024-02-06 | Improper access control vulnerability in Samsung Gallery prior to version 14.5.04.4 allows physical attackers to access the picture using physical keyboard on… |
CVE-2024-20826 | Medium | 5.5 | 2024-02-06 | Implicit intent hijacking vulnerability in UPHelper library prior to version 4.0.0 allows local attackers to access sensitive information via implicit intent. |
CVE-2024-20825 | Medium | 5.5 | 2024-02-06 | Implicit intent hijacking vulnerability in IAP of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit in… |
CVE-2024-20824 | Medium | 5.5 | 2024-02-06 | Implicit intent hijacking vulnerability in VoiceSearch of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via imp… |
CVE-2024-20823 | Medium | 5.5 | 2024-02-06 | Implicit intent hijacking vulnerability in SamsungAccount of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via… |
CVE-2024-20822 | Medium | 5.5 | 2024-02-06 | Implicit intent hijacking vulnerability in AccountActivity of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via… |
CVE-2024-20820 | Medium | 4.4 | 2024-02-06 | Improper input validation in bootloader prior to SMR Feb-2024 Release 1 allows local privileged attackers to cause an Out-Of-Bounds read. |
CVE-2024-20819 | Medium | 6.6 | 2024-02-06 | Out-of-bounds Write vulnerabilities in svc1td_vld_plh_ap of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow. |
CVE-2024-20818 | Medium | 6.6 | 2024-02-06 | Out-of-bounds Write vulnerabilities in svc1td_vld_elh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow. |
CVE-2024-20817 | Medium | 6.6 | 2024-02-06 | Out-of-bounds Write vulnerabilities in svc1td_vld_slh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow. |
CVE-2024-20816 | High | 8.0 | 2024-02-06 | Improper authentication vulnerability in onCharacteristicWriteRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to vict… |
CVE-2024-20815 | High | 8.0 | 2024-02-06 | Improper authentication vulnerability in onCharacteristicReadRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to victi… |
CVE-2024-20814 | Medium | 4.0 | 2024-02-06 | Out-of-bounds Read in padmd_vld_ac_prog_refine of libpadm.so prior to SMR Feb-2024 Release 1 allows local attackers access unauthorized information. |
CVE-2024-20813 | High | 8.4 | 2024-02-06 | Out-of-bounds Write in padmd_vld_qtbl of libpadm.so prior to SMR Feb-2024 Release 1 allows local attacker to execute arbitrary code. |
CVE-2024-20812 | High | 8.4 | 2024-02-06 | Out-of-bounds Write in padmd_vld_htbl of libpadm.so prior to SMR Feb-2024 Release 1 allows local attacker to execute arbitrary code. |
CVE-2024-20811 | Medium | 5.1 | 2024-02-06 | Improper caller verification in GameOptimizer prior to SMR Feb-2024 Release 1 allows local attackers to configure GameOptimizer. |
CVE-2024-20810 | Low | 3.3 | 2024-02-06 | Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-22853 | Critical | 9.8 | 2024-02-06 | D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a te… |
CVE-2024-22852 | Critical | 9.8 | 2024-02-06 | D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to enable… |
CVE-2024-24112 | Critical | 9.8 | 2024-02-06 | xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter. |
CVE-2024-22773 | High | 8.1 | 2024-02-06 | Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass. |
CVE-2024-0244 | Critical | 9.8 | 2024-02-06 | Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigg… |
CVE-2024-24398 | Critical | 9.8 | 2024-02-06 | Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted… |
CVE-2024-23049 | Critical | 9.8 | 2024-02-05 | An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component. |
CVE-2024-0964 | Critical | 9.4 | 2024-02-05 | A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request. |
CVE-2024-24595 | Medium | 6.0 | 2024-02-05 | Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user email… |
CVE-2024-1210 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it poss… |
CVE-2024-1209 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due… |
CVE-2024-1208 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it poss… |
CVE-2024-1177 | Medium | 5.3 | 2024-02-05 | The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-1121 | Medium | 5.3 | 2024-02-05 | The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_json_file() functi… |
CVE-2024-1092 | Medium | 4.3 | 2024-02-05 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized data modifi… |
CVE-2024-1075 | Low | 3.7 | 2024-02-05 | The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all versions up to, and… |
CVE-2024-1072 | High | 8.2 | 2024-02-05 | The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized mo… |
CVE-2024-1046 | Medium | 6.4 | 2024-02-05 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-0969 | Medium | 5.3 | 2024-02-05 | The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it… |
CVE-2024-0961 | Medium | 6.4 | 2024-02-05 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the code editor in all versions up to, and including, 1.58… |
CVE-2024-0954 | Medium | 6.4 | 2024-02-05 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-0869 | High | 8.8 | 2024-02-05 | The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options… |
CVE-2024-0859 | Medium | 4.3 | 2024-02-05 | The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or… |
CVE-2024-0835 | Medium | 4.3 | 2024-02-05 | The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissed_handler… |
CVE-2024-0834 | Medium | 6.4 | 2024-02-05 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_to parameter in all versions up to, and including… |
CVE-2024-0823 | Medium | 5.4 | 2024-02-05 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' url in carousels in all versions up to… |
CVE-2024-0797 | Medium | 4.3 | 2024-02-05 | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized access of fun… |
CVE-2024-0796 | Medium | 4.3 | 2024-02-05 | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Cross-Site Request Forgery… |
CVE-2024-0791 | Medium | 4.3 | 2024-02-05 | The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to… |
CVE-2024-0790 | Medium | 5.4 | 2024-02-05 | The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc… |