2024 CVEs (page 373)
Page 373 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1200 | Medium | 5.3 | 2024-02-03 | A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /template/1/default… |
CVE-2024-1199 | Medium | 5.4 | 2024-02-03 | A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2024-1198 | Medium | 6.3 | 2024-02-03 | A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file application/controllers/User… |
CVE-2024-1197 | High | 7.3 | 2024-02-02 | A vulnerability, which was classified as critical, has been found in SourceCodester Testimonial Page Manager 1.0. This issue affects some unknown processing of… |
CVE-2024-1196 | Medium | 4.3 | 2024-02-02 | A vulnerability classified as problematic was found in SourceCodester Testimonial Page Manager 1.0. This vulnerability affects unknown code of the file add-tes… |
CVE-2024-1195 | Medium | 5.5 | 2024-02-02 | A vulnerability classified as critical was found in iTop VPN up to 4.0.0.1. Affected by this vulnerability is an unknown functionality in the library ITopVpnCa… |
CVE-2024-23553 | Low | 3.0 | 2024-02-02 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute. |
CVE-2024-1194 | Low | 3.3 | 2024-02-02 | A vulnerability classified as problematic has been found in Armcode AlienIP 2.41. Affected is an unknown function of the component Locate Host Handler. The man… |
CVE-2024-1193 | Low | 3.3 | 2024-02-02 | A vulnerability was found in Navicat 12.0.29. It has been rated as problematic. This issue affects some unknown processing of the component MySQL Conecction Ha… |
CVE-2024-1190 | Low | 3.3 | 2024-02-02 | A vulnerability was found in Global Scape CuteFTP 9.3.0.3 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation… |
CVE-2024-1189 | Medium | 5.3 | 2024-02-02 | A vulnerability has been found in AMPPS 2.7 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Encrypti… |
CVE-2024-1188 | Low | 3.3 | 2024-02-02 | A vulnerability, which was classified as problematic, was found in Rizone Soft Notepad3 1.0.2.350. Affected is an unknown function of the component Encryption… |
CVE-2024-1187 | Low | 3.3 | 2024-02-02 | A vulnerability, which was classified as problematic, has been found in Munsoft Easy Outlook Express Recovery 2.0. This issue affects some unknown processing o… |
CVE-2024-24560 | Low | 3.7 | 2024-02-02 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at… |
CVE-2024-23635 | Medium | 6.1 | 2024-02-02 | AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XS… |
CVE-2024-1186 | Low | 3.3 | 2024-02-02 | A vulnerability classified as problematic was found in Munsoft Easy Archive Recovery 2.0. This vulnerability affects unknown code of the component Registration… |
CVE-2024-24760 | High | 8.8 | 2024-02-02 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affectin… |
CVE-2024-24757 | High | 7.6 | 2024-02-02 | open-irs is an issue response robot that reponds to issues in the installed repository. The `.env` file was accidentally uploaded when working with git actions… |
CVE-2024-24470 | High | 8.8 | 2024-02-02 | Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the update_post.php component. |
CVE-2024-24161 | High | 7.5 | 2024-02-02 | MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered. |
CVE-2024-24160 | Medium | 5.4 | 2024-02-02 | MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do. |
CVE-2024-24029 | Critical | 9.8 | 2024-02-02 | JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data. |
CVE-2024-23831 | High | 7.5 | 2024-02-02 | LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick… |
CVE-2024-23824 | Medium | 4.7 | 2024-02-02 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the pa… |
CVE-2024-22108 | Critical | 9.8 | 2024-02-02 | An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method setTermsHashAction at /opt/webapp/lib/PureApi/CCApi.class.php is vulnerable to an u… |
CVE-2024-22107 | High | 7.2 | 2024-02-02 | An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSet… |
CVE-2024-1185 | Low | 3.3 | 2024-02-02 | A vulnerability classified as problematic has been found in Nsasoft NBMonitor Network Bandwidth Monitor 1.6.5.0. This affects an unknown part of the component… |
CVE-2024-1184 | Low | 3.3 | 2024-02-02 | A vulnerability was found in Nsasoft Network Sleuth 3.0.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the comp… |
CVE-2024-0269 | High | 8.3 | 2024-02-02 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown. This issue has been fixed and re… |
CVE-2024-0253 | High | 8.3 | 2024-02-02 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in home Graph-Data. |
CVE-2024-1201 | High | 7.8 | 2024-02-02 | Search path or unquoted item vulnerability in HDD Health affecting versions 4.2.0.112 and earlier. This vulnerability could allow a local attacker to store a m… |
CVE-2024-0963 | Medium | 6.4 | 2024-02-02 | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up… |
CVE-2024-0844 | Medium | 4.7 | 2024-02-02 | The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via the ycfChangeElementD… |
CVE-2024-24388 | Medium | 6.1 | 2024-02-02 | Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious… |
CVE-2024-23895 | High | 8.2 | 2024-02-02 | A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a… |
CVE-2024-0338 | High | 7.3 | 2024-02-02 | A buffer overflow vulnerability has been found in XAMPP affecting version 8.2.4 and earlier. An attacker could execute arbitrary code through a long file debug… |
CVE-2024-22851 | High | 7.5 | 2024-02-02 | Directory Traversal Vulnerability in LiveConfig before v.2.5.2 allows a remote attacker to obtain sensitive information via a crafted request to the /static/ e… |
CVE-2024-24524 | High | 8.8 | 2024-02-02 | Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add_menu.php component. |
CVE-2024-23978 | Critical | 9.8 | 2024-02-02 | Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be executed. Note that th… |
CVE-2024-21863 | Medium | 4.7 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2024-21860 | High | 8.2 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow an adjacent attacker arbitrary code execution in any apps through use after free. |
CVE-2024-21851 | Low | 2.9 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through integer overflow. |
CVE-2024-21845 | Low | 2.9 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through integer overflow. |
CVE-2024-21780 | High | 7.5 | 2024-02-02 | Stack-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. Processing a specially crafted command may result in a denial of service… |
CVE-2024-0285 | Medium | 4.7 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2024-1162 | Medium | 4.3 | 2024-02-02 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. This is due to missi… |
CVE-2024-1143 | Critical | 9.3 | 2024-02-02 | Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentic… |
CVE-2024-1047 | Medium | 5.3 | 2024-02-02 | Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on th… |
CVE-2024-24482 | Critical | 9.8 | 2024-02-02 | Aprktool before 2.9.3 on Windows allows ../ and /.. directory traversal. |
CVE-2024-21485 | Medium | 6.5 | 2024-02-02 | Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15… |
CVE-2024-1073 | Medium | 6.4 | 2024-02-02 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including… |
CVE-2024-0685 | Medium | 5.9 | 2024-02-02 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email addr… |
CVE-2024-22533 | Critical | 9.8 | 2024-02-02 | Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be… |
CVE-2024-22320 | Critical | 9.8 | 2024-02-02 | IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserializatio… |
CVE-2024-22319 | High | 8.1 | 2024-02-02 | IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injec… |
CVE-2024-23746 | Critical | 9.8 | 2024-02-02 | Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCService… |
CVE-2024-22903 | High | 8.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function. |
CVE-2024-22902 | Critical | 9.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. |
CVE-2024-22901 | Critical | 9.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials. |
CVE-2024-22900 | High | 8.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function. |
CVE-2024-22899 | High | 8.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function. |
CVE-2024-22779 | High | 8.8 | 2024-02-02 | Directory Traversal vulnerability in Kihron ServerRPExposer v.1.0.2 and before allows a remote attacker to execute arbitrary code via the loadServerPack in Ser… |
CVE-2024-21399 | High | 8.3 | 2024-02-02 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-22096 | Medium | 6.5 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific com… |
CVE-2024-22016 | High | 7.8 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may allow privilege esc… |
CVE-2024-21869 | Medium | 6.2 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an att… |
CVE-2024-21866 | Medium | 5.3 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it r… |
CVE-2024-21794 | Medium | 5.4 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page. |
CVE-2024-21764 | Critical | 9.8 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the product uses hard-coded credentials, which may allow an attacker to connect to a speci… |
CVE-2024-24756 | High | 7.5 | 2024-02-01 | Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be requested from the se… |
CVE-2024-23034 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-23033 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-23032 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-23031 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-22927 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-21852 | High | 8.8 | 2024-02-01 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can supply a malicious configuration file by utilizing a Zip Slip vulnerabilit… |
CVE-2024-24755 | Medium | 4.3 | 2024-02-01 | discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip… |
CVE-2024-1040 | Medium | 4.4 | 2024-02-01 | Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can restore the passwords by breaking the hashes stored on the devi… |
CVE-2024-1039 | Critical | 9.8 | 2024-02-01 | Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web managemen… |
CVE-2024-0325 | Low | 3.6 | 2024-02-01 | In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins. |
CVE-2024-24945 | Medium | 6.1 | 2024-02-01 | A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2024-24041 | Medium | 6.1 | 2024-02-01 | A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2024-24569 | Medium | 5.4 | 2024-02-01 | The Pixee Java Code Security Toolkit is a set of security APIs meant to help secure Java code. `ZipSecurity#isBelowCurrentDirectory` is vulnerable to a partial… |
CVE-2024-23645 | Medium | 6.5 | 2024-02-01 | GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12. |
CVE-2024-1167 | Medium | 5.5 | 2024-02-01 | When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur. |
CVE-2024-24570 | High | 8.2 | 2024-02-01 | Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end form… |
CVE-2024-24561 | Critical | 9.8 | 2024-02-01 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for… |
CVE-2024-24557 | Medium | 6.9 | 2024-02-01 | Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image… |
CVE-2024-23832 | Critical | 9.4 | 2024-02-01 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin… |
CVE-2024-24754 | Low | 3.7 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lam… |
CVE-2024-24753 | Medium | 4.8 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers… |
CVE-2024-24752 | Medium | 6.5 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lam… |
CVE-2024-1141 | Medium | 5.5 | 2024-02-01 | A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enable… |
CVE-2024-24062 | Medium | 5.4 | 2024-02-01 | springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role. |
CVE-2024-24061 | Medium | 5.4 | 2024-02-01 | springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add. |
CVE-2024-24060 | Medium | 5.4 | 2024-02-01 | springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user. |
CVE-2024-24059 | Medium | 5.4 | 2024-02-01 | springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files. |
CVE-2024-0935 | Medium | 4.4 | 2024-02-01 | Insertion of Sensitive Information into Log File vulnerabilities are affecting DELMIA Apriso Release 2019 through Release 2024 |
CVE-2024-22449 | Medium | 6.6 | 2024-02-01 | Dell PowerScale OneFS versions 9.0.0.x through 9.6.0.x contains a missing authentication for critical function vulnerability. A low privileged local malicious… |
CVE-2024-22430 | Medium | 5.5 | 2024-02-01 | Dell PowerScale OneFS versions 8.2.x through 9.6.0.x contains an incorrect default permissions vulnerability. A local low privileges malicious user could pote… |