2024 CVEs (page 371)
Page 371 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0977 | Medium | 4.4 | 2024-02-07 | The Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via im… |
CVE-2024-1055 | Medium | 5.4 | 2024-02-07 | The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2024-1037 | Medium | 6.1 | 2024-02-07 | The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all vers… |
CVE-2024-0628 | Low | 3.8 | 2024-02-07 | The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the RSS feed source in… |
CVE-2024-0256 | Medium | 6.4 | 2024-02-07 | The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versions up to, and inclu… |
CVE-2024-23447 | Medium | 5.3 | 2024-02-07 | An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write an… |
CVE-2024-23446 | Medium | 6.5 | 2024-02-07 | An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when q… |
CVE-2024-24810 | High | 8.2 | 2024-02-07 | WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection atta… |
CVE-2024-0849 | Medium | 5.0 | 2024-02-07 | Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR. |
CVE-2024-1269 | Low | 2.4 | 2024-02-07 | A vulnerability has been found in SourceCodester Product Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the fi… |
CVE-2024-1268 | Medium | 6.3 | 2024-02-07 | A vulnerability, which was classified as critical, was found in CodeAstro Restaurant POS System 1.0. This affects an unknown part of the file update_product.ph… |
CVE-2024-24019 | Critical | 9.8 | 2024-02-07 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform… |
CVE-2024-22022 | High | 8.8 | 2024-02-07 | Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service acco… |
CVE-2024-22021 | Medium | 4.3 | 2024-02-07 | Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the o… |
CVE-2024-1267 | Low | 3.5 | 2024-02-07 | A vulnerability, which was classified as problematic, has been found in CodeAstro Restaurant POS System 1.0. Affected by this issue is some unknown functionali… |
CVE-2024-1266 | Low | 2.4 | 2024-02-07 | A vulnerability classified as problematic was found in CodeAstro University Management System 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-24004 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail() function of js… |
CVE-2024-24002 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock() function of js… |
CVE-2024-24001 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() funct… |
CVE-2024-1284 | Critical | 9.8 | 2024-02-07 | Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-1283 | Critical | 9.8 | 2024-02-07 | Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-1265 | Low | 2.4 | 2024-02-07 | A vulnerability classified as problematic has been found in CodeAstro University Management System 1.0. Affected is an unknown function of the file /att_add.ph… |
CVE-2024-1264 | Medium | 6.3 | 2024-02-07 | A vulnerability has been found in Juanpao JPShop up to 1.5.02 and classified as critical. Affected by this vulnerability is the function actionUpdate of the fi… |
CVE-2024-0971 | Medium | 6.5 | 2024-02-07 | A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially alter scan DB content. |
CVE-2024-0955 | Medium | 4.8 | 2024-02-07 | A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy set… |
CVE-2024-24255 | Medium | 4.2 | 2024-02-06 | A Race Condition discovered in geofence.cpp and mission_feasibility_checker.cpp in PX4 Autopilot 1.14 and earlier allows attackers to send drones on unintended… |
CVE-2024-22388 | Medium | 5.9 | 2024-02-06 | Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data… |
CVE-2024-1263 | Medium | 6.3 | 2024-02-06 | A vulnerability, which was classified as critical, was found in Juanpao JPShop up to 1.5.02. Affected is the function actionUpdate of the file /api/controllers… |
CVE-2024-1262 | Medium | 6.3 | 2024-02-06 | A vulnerability, which was classified as critical, has been found in Juanpao JPShop up to 1.5.02. This issue affects the function actionUpdate of the file /api… |
CVE-2024-24680 | High | 7.5 | 2024-02-06 | An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential de… |
CVE-2024-24577 | High | 8.6 | 2024-02-06 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2024-24575 | High | 7.5 | 2024-02-06 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2024-24254 | Medium | 4.2 | 2024-02-06 | PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability in the geofence.cpp… |
CVE-2024-22520 | High | 8.2 | 2024-02-06 | An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of crafted data packets. |
CVE-2024-22519 | High | 8.2 | 2024-02-06 | An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets. |
CVE-2024-1261 | Medium | 6.3 | 2024-02-06 | A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controlle… |
CVE-2024-1260 | Medium | 6.3 | 2024-02-06 | A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/… |
CVE-2024-22515 | High | 8.8 | 2024-02-06 | Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to upload arbitrary files via the upload audio component. |
CVE-2024-22514 | High | 8.8 | 2024-02-06 | An issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files by restoring a crafted backup file. |
CVE-2024-1259 | Medium | 6.3 | 2024-02-06 | A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/… |
CVE-2024-1258 | Low | 3.1 | 2024-02-06 | A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-22241 | Medium | 4.3 | 2024-02-06 | Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the log… |
CVE-2024-22240 | Medium | 4.9 | 2024-02-06 | Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauth… |
CVE-2024-22239 | Medium | 5.3 | 2024-02-06 | Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this v… |
CVE-2024-22238 | Medium | 6.4 | 2024-02-06 | Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into u… |
CVE-2024-22237 | High | 7.8 | 2024-02-06 | Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this v… |
CVE-2024-1257 | Low | 3.5 | 2024-02-06 | A vulnerability was found in Jspxcms 10.2.0. It has been classified as problematic. Affected is an unknown function of the file /ext/collect/find_text.do. The… |
CVE-2024-1256 | Low | 3.5 | 2024-02-06 | A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. This issue affects some unknown processing of the file /ext/collect/filter_text.do… |
CVE-2024-1255 | Medium | 5.3 | 2024-02-06 | A vulnerability has been found in sepidz SepidzDigitalMenu up to 7.1.0728.1 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-1254 | Medium | 4.7 | 2024-02-06 | A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /… |
CVE-2024-1048 | Low | 3.3 | 2024-02-06 | A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grub… |
CVE-2024-22331 | Medium | 6.2 | 2024-02-06 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.19, 7.1 through 7.1.2.15, 7.2 through 7.2.3.8, 7.3 through 7.3.2.3, and IBM UrbanCode Deploy (UCD) - IBM DevOps De… |
CVE-2024-1253 | Medium | 4.7 | 2024-02-06 | A vulnerability, which was classified as critical, has been found in Byzoro Smart S40 Management Platform up to 20240126. Affected by this issue is some unknow… |
CVE-2024-1252 | Medium | 5.5 | 2024-02-06 | A vulnerability classified as critical was found in Tongda OA 2017 up to 11.9. Affected by this vulnerability is an unknown functionality of the file /general/… |
CVE-2024-24291 | Medium | 6.1 | 2024-02-06 | An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL. |
CVE-2024-24015 | Critical | 9.8 | 2024-02-06 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform… |
CVE-2024-24013 | Critical | 9.8 | 2024-02-06 | A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQ… |
CVE-2024-24000 | Critical | 9.8 | 2024-02-06 | jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter… |
CVE-2024-23344 | Medium | 5.3 | 2024-02-06 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a p… |
CVE-2024-1251 | Medium | 5.5 | 2024-02-06 | A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /general/email/outbox/delete.p… |
CVE-2024-24594 | Critical | 9.9 | 2024-02-06 | A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a J… |
CVE-2024-24593 | Critical | 9.6 | 2024-02-06 | A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote att… |
CVE-2024-24592 | Critical | 9.8 | 2024-02-06 | Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, mod… |
CVE-2024-24591 | High | 8.0 | 2024-02-06 | A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write l… |
CVE-2024-24590 | High | 8.0 | 2024-02-06 | Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded ar… |
CVE-2024-0911 | Medium | 5.5 | 2024-02-06 | A flaw was found in indent, a program for formatting C code. This issue may allow an attacker to trick a user into processing a specially crafted file to trigg… |
CVE-2024-0690 | Medium | 5.0 | 2024-02-06 | An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still i… |
CVE-2024-24943 | Medium | 5.3 | 2024-02-06 | In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image |
CVE-2024-24942 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives |
CVE-2024-24941 | Medium | 6.1 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL |
CVE-2024-24940 | Low | 2.8 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives |
CVE-2024-24939 | Low | 3.3 | 2024-02-06 | In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible |
CVE-2024-24938 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation |
CVE-2024-24937 | Medium | 4.6 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible |
CVE-2024-24936 | Medium | 4.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed |
CVE-2024-23917 | Critical | 9.8 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible |
CVE-2024-23673 | High | 8.5 | 2024-02-06 | Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlet… |
CVE-2024-25140 | Critical | 9.8 | 2024-02-06 | A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Co… |
CVE-2024-0684 | Medium | 5.5 | 2024-02-06 | A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_by… |
CVE-2024-22365 | Medium | 5.5 | 2024-02-06 | linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_di… |
CVE-2024-22433 | High | 8.8 | 2024-02-06 | Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in DP Search. A remot… |
CVE-2024-23304 | High | 7.5 | 2024-02-06 | Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operation… |
CVE-2024-24808 | Medium | 4.7 | 2024-02-06 | pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redi… |
CVE-2024-20828 | Low | 2.4 | 2024-02-06 | Improper authorization verification vulnerability in Samsung Internet prior to version 24.0 allows physical attackers to access files downloaded in SecretMode… |
CVE-2024-20827 | Medium | 4.6 | 2024-02-06 | Improper access control vulnerability in Samsung Gallery prior to version 14.5.04.4 allows physical attackers to access the picture using physical keyboard on… |
CVE-2024-20826 | Medium | 5.5 | 2024-02-06 | Implicit intent hijacking vulnerability in UPHelper library prior to version 4.0.0 allows local attackers to access sensitive information via implicit intent. |
CVE-2024-20825 | Medium | 5.5 | 2024-02-06 | Implicit intent hijacking vulnerability in IAP of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit in… |
CVE-2024-20824 | Medium | 5.5 | 2024-02-06 | Implicit intent hijacking vulnerability in VoiceSearch of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via imp… |
CVE-2024-20823 | Medium | 5.5 | 2024-02-06 | Implicit intent hijacking vulnerability in SamsungAccount of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via… |
CVE-2024-20822 | Medium | 5.5 | 2024-02-06 | Implicit intent hijacking vulnerability in AccountActivity of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via… |
CVE-2024-20820 | Medium | 4.4 | 2024-02-06 | Improper input validation in bootloader prior to SMR Feb-2024 Release 1 allows local privileged attackers to cause an Out-Of-Bounds read. |
CVE-2024-20819 | Medium | 6.6 | 2024-02-06 | Out-of-bounds Write vulnerabilities in svc1td_vld_plh_ap of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow. |
CVE-2024-20818 | Medium | 6.6 | 2024-02-06 | Out-of-bounds Write vulnerabilities in svc1td_vld_elh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow. |
CVE-2024-20817 | Medium | 6.6 | 2024-02-06 | Out-of-bounds Write vulnerabilities in svc1td_vld_slh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow. |
CVE-2024-20816 | High | 8.0 | 2024-02-06 | Improper authentication vulnerability in onCharacteristicWriteRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to vict… |
CVE-2024-20815 | High | 8.0 | 2024-02-06 | Improper authentication vulnerability in onCharacteristicReadRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to victi… |
CVE-2024-20814 | Medium | 4.0 | 2024-02-06 | Out-of-bounds Read in padmd_vld_ac_prog_refine of libpadm.so prior to SMR Feb-2024 Release 1 allows local attackers access unauthorized information. |
CVE-2024-20813 | High | 8.4 | 2024-02-06 | Out-of-bounds Write in padmd_vld_qtbl of libpadm.so prior to SMR Feb-2024 Release 1 allows local attacker to execute arbitrary code. |
CVE-2024-20812 | High | 8.4 | 2024-02-06 | Out-of-bounds Write in padmd_vld_htbl of libpadm.so prior to SMR Feb-2024 Release 1 allows local attacker to execute arbitrary code. |
CVE-2024-20811 | Medium | 5.1 | 2024-02-06 | Improper caller verification in GameOptimizer prior to SMR Feb-2024 Release 1 allows local attackers to configure GameOptimizer. |