2024 CVEs (page 373)
Page 373 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22386 | Medium | 5.3 | 2024-02-05 | A race condition was found in the Linux kernel's drm/exynos device driver in exynos_drm_crtc_atomic_disable() function. This can result in a null pointer deref… |
CVE-2024-24865 | Medium | 6.5 | 2024-02-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Kagan Scroll Triggered Box allows Stored XSS.This is… |
CVE-2024-24848 | High | 7.1 | 2024-02-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MJS Software PT Sign Ups – Beautiful volunteer sign ups a… |
CVE-2024-24847 | High | 7.1 | 2024-02-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgadbois CalculatorPro Calculators allows Reflected XSS.T… |
CVE-2024-24846 | High | 7.1 | 2024-02-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MightyThemes Mighty Addons for Elementor allows Reflected… |
CVE-2024-24841 | Medium | 5.9 | 2024-02-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan's Art Add Customer for WooCommerce allows Stored XSS… |
CVE-2024-24839 | Medium | 6.5 | 2024-02-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD… |
CVE-2024-24838 | Medium | 6.5 | 2024-02-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Five Star Plugins Five Star Restaurant Reviews allows Sto… |
CVE-2024-24870 | Medium | 6.5 | 2024-02-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This is… |
CVE-2024-24866 | High | 7.1 | 2024-02-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reg… |
CVE-2024-20016 | Medium | 4.4 | 2024-02-05 | In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service with System execution privileges needed… |
CVE-2024-20015 | High | 7.8 | 2024-02-05 | In telephony, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege with no additional exec… |
CVE-2024-20013 | Medium | 6.7 | 2024-02-05 | In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2024-20012 | Medium | 6.7 | 2024-02-05 | In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with System execution privil… |
CVE-2024-20011 | Critical | 9.8 | 2024-02-05 | In alac decoder, there is a possible information disclosure due to an incorrect bounds check. This could lead to remote code execution with no additional execu… |
CVE-2024-20010 | Medium | 6.7 | 2024-02-05 | In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with System execution privil… |
CVE-2024-20009 | High | 8.8 | 2024-02-05 | In alac decoder, there is a possible out of bounds write due to an incorrect error handling. This could lead to remote escalation of privilege with no addition… |
CVE-2024-20007 | High | 7.5 | 2024-02-05 | In mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation of privilege with no additional execution… |
CVE-2024-20006 | Medium | 6.7 | 2024-02-05 | In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges… |
CVE-2024-20004 | High | 7.5 | 2024-02-05 | In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Conn… |
CVE-2024-20003 | High | 7.5 | 2024-02-05 | In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Conn… |
CVE-2024-20002 | Medium | 6.7 | 2024-02-05 | In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privile… |
CVE-2024-20001 | Medium | 6.7 | 2024-02-05 | In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privile… |
CVE-2024-25089 | Critical | 9.8 | 2024-02-04 | Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes. |
CVE-2024-25062 | High | 7.5 | 2024-02-04 | An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabl… |
CVE-2024-1215 | Low | 3.5 | 2024-02-03 | A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been rated as problematic. Affected by this issue is some unknown functionalit… |
CVE-2024-0853 | Medium | 5.3 | 2024-02-03 | curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the… |
CVE-2024-1064 | High | 7.5 | 2024-02-03 | A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Servi… |
CVE-2024-23550 | Medium | 6.2 | 2024-02-03 | HCL DevOps Deploy / HCL Launch (UCD) could disclose sensitive user information when installing the Windows agent. |
CVE-2024-0909 | Medium | 5.3 | 2024-02-03 | The Anonymous Restricted Content plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.6.2. This is due to insuf… |
CVE-2024-0895 | Medium | 5.4 | 2024-02-03 | The PDF Flipbook, 3D Flipbook – DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versions up to, and incl… |
CVE-2024-1200 | Medium | 5.3 | 2024-02-03 | A vulnerability was found in Jspxcms 10.2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /template/1/default… |
CVE-2024-1199 | Medium | 5.4 | 2024-02-03 | A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2024-1198 | Medium | 6.3 | 2024-02-03 | A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file application/controllers/User… |
CVE-2024-1197 | High | 7.3 | 2024-02-02 | A vulnerability, which was classified as critical, has been found in SourceCodester Testimonial Page Manager 1.0. This issue affects some unknown processing of… |
CVE-2024-1196 | Medium | 4.3 | 2024-02-02 | A vulnerability classified as problematic was found in SourceCodester Testimonial Page Manager 1.0. This vulnerability affects unknown code of the file add-tes… |
CVE-2024-1195 | Medium | 5.5 | 2024-02-02 | A vulnerability classified as critical was found in iTop VPN up to 4.0.0.1. Affected by this vulnerability is an unknown functionality in the library ITopVpnCa… |
CVE-2024-23553 | Low | 3.0 | 2024-02-02 | A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute. |
CVE-2024-1194 | Low | 3.3 | 2024-02-02 | A vulnerability classified as problematic has been found in Armcode AlienIP 2.41. Affected is an unknown function of the component Locate Host Handler. The man… |
CVE-2024-1193 | Low | 3.3 | 2024-02-02 | A vulnerability was found in Navicat 12.0.29. It has been rated as problematic. This issue affects some unknown processing of the component MySQL Conecction Ha… |
CVE-2024-1190 | Low | 3.3 | 2024-02-02 | A vulnerability was found in Global Scape CuteFTP 9.3.0.3 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation… |
CVE-2024-1189 | Medium | 5.3 | 2024-02-02 | A vulnerability has been found in AMPPS 2.7 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Encrypti… |
CVE-2024-1188 | Low | 3.3 | 2024-02-02 | A vulnerability, which was classified as problematic, was found in Rizone Soft Notepad3 1.0.2.350. Affected is an unknown function of the component Encryption… |
CVE-2024-1187 | Low | 3.3 | 2024-02-02 | A vulnerability, which was classified as problematic, has been found in Munsoft Easy Outlook Express Recovery 2.0. This issue affects some unknown processing o… |
CVE-2024-24560 | Low | 3.7 | 2024-02-02 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at… |
CVE-2024-23635 | Medium | 6.1 | 2024-02-02 | AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XS… |
CVE-2024-1186 | Low | 3.3 | 2024-02-02 | A vulnerability classified as problematic was found in Munsoft Easy Archive Recovery 2.0. This vulnerability affects unknown code of the component Registration… |
CVE-2024-24760 | High | 8.8 | 2024-02-02 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affectin… |
CVE-2024-24757 | High | 7.6 | 2024-02-02 | open-irs is an issue response robot that reponds to issues in the installed repository. The `.env` file was accidentally uploaded when working with git actions… |
CVE-2024-24470 | High | 8.8 | 2024-02-02 | Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the update_post.php component. |
CVE-2024-24161 | High | 7.5 | 2024-02-02 | MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered. |
CVE-2024-24160 | Medium | 5.4 | 2024-02-02 | MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do. |
CVE-2024-24029 | Critical | 9.8 | 2024-02-02 | JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data. |
CVE-2024-23831 | High | 7.5 | 2024-02-02 | LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick… |
CVE-2024-23824 | Medium | 4.7 | 2024-02-02 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the pa… |
CVE-2024-22108 | Critical | 9.8 | 2024-02-02 | An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method setTermsHashAction at /opt/webapp/lib/PureApi/CCApi.class.php is vulnerable to an u… |
CVE-2024-22107 | High | 7.2 | 2024-02-02 | An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSet… |
CVE-2024-1185 | Low | 3.3 | 2024-02-02 | A vulnerability classified as problematic has been found in Nsasoft NBMonitor Network Bandwidth Monitor 1.6.5.0. This affects an unknown part of the component… |
CVE-2024-1184 | Low | 3.3 | 2024-02-02 | A vulnerability was found in Nsasoft Network Sleuth 3.0.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the comp… |
CVE-2024-0269 | High | 8.3 | 2024-02-02 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown. This issue has been fixed and re… |
CVE-2024-0253 | High | 8.3 | 2024-02-02 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in home Graph-Data. |
CVE-2024-1201 | High | 7.8 | 2024-02-02 | Search path or unquoted item vulnerability in HDD Health affecting versions 4.2.0.112 and earlier. This vulnerability could allow a local attacker to store a m… |
CVE-2024-0963 | Medium | 6.4 | 2024-02-02 | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up… |
CVE-2024-0844 | Medium | 4.7 | 2024-02-02 | The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via the ycfChangeElementD… |
CVE-2024-24388 | Medium | 6.1 | 2024-02-02 | Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious… |
CVE-2024-23895 | High | 8.2 | 2024-02-02 | A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a… |
CVE-2024-0338 | High | 7.3 | 2024-02-02 | A buffer overflow vulnerability has been found in XAMPP affecting version 8.2.4 and earlier. An attacker could execute arbitrary code through a long file debug… |
CVE-2024-22851 | High | 7.5 | 2024-02-02 | Directory Traversal Vulnerability in LiveConfig before v.2.5.2 allows a remote attacker to obtain sensitive information via a crafted request to the /static/ e… |
CVE-2024-24524 | High | 8.8 | 2024-02-02 | Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add_menu.php component. |
CVE-2024-23978 | Critical | 9.8 | 2024-02-02 | Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be executed. Note that th… |
CVE-2024-21863 | Medium | 4.7 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2024-21860 | High | 8.2 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow an adjacent attacker arbitrary code execution in any apps through use after free. |
CVE-2024-21851 | Low | 2.9 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through integer overflow. |
CVE-2024-21845 | Low | 2.9 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through integer overflow. |
CVE-2024-21780 | High | 7.5 | 2024-02-02 | Stack-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. Processing a specially crafted command may result in a denial of service… |
CVE-2024-0285 | Medium | 4.7 | 2024-02-02 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2024-1162 | Medium | 4.3 | 2024-02-02 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. This is due to missi… |
CVE-2024-1143 | Critical | 9.3 | 2024-02-02 | Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentic… |
CVE-2024-1047 | Medium | 5.3 | 2024-02-02 | Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on th… |
CVE-2024-24482 | Critical | 9.8 | 2024-02-02 | Aprktool before 2.9.3 on Windows allows ../ and /.. directory traversal. |
CVE-2024-21485 | Medium | 6.5 | 2024-02-02 | Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15… |
CVE-2024-1073 | Medium | 6.4 | 2024-02-02 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including… |
CVE-2024-0685 | Medium | 5.9 | 2024-02-02 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email addr… |
CVE-2024-22533 | Critical | 9.8 | 2024-02-02 | Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be… |
CVE-2024-22320 | Critical | 9.8 | 2024-02-02 | IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserializatio… |
CVE-2024-22319 | High | 8.1 | 2024-02-02 | IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injec… |
CVE-2024-23746 | Critical | 9.8 | 2024-02-02 | Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCService… |
CVE-2024-22903 | High | 8.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function. |
CVE-2024-22902 | Critical | 9.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. |
CVE-2024-22901 | Critical | 9.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials. |
CVE-2024-22900 | High | 8.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function. |
CVE-2024-22899 | High | 8.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function. |
CVE-2024-22779 | High | 8.8 | 2024-02-02 | Directory Traversal vulnerability in Kihron ServerRPExposer v.1.0.2 and before allows a remote attacker to execute arbitrary code via the loadServerPack in Ser… |
CVE-2024-21399 | High | 8.3 | 2024-02-02 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-22096 | Medium | 6.5 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific com… |
CVE-2024-22016 | High | 7.8 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may allow privilege esc… |
CVE-2024-21869 | Medium | 6.2 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an att… |
CVE-2024-21866 | Medium | 5.3 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it r… |
CVE-2024-21794 | Medium | 5.4 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page. |
CVE-2024-21764 | Critical | 9.8 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the product uses hard-coded credentials, which may allow an attacker to connect to a speci… |