2024 CVEs (page 374)
Page 374 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24756 | High | 7.5 | 2024-02-01 | Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be requested from the se… |
CVE-2024-23034 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-23033 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-23032 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-23031 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-22927 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-21852 | High | 8.8 | 2024-02-01 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can supply a malicious configuration file by utilizing a Zip Slip vulnerabilit… |
CVE-2024-24755 | Medium | 4.3 | 2024-02-01 | discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip… |
CVE-2024-1040 | Medium | 4.4 | 2024-02-01 | Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can restore the passwords by breaking the hashes stored on the devi… |
CVE-2024-1039 | Critical | 9.8 | 2024-02-01 | Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web managemen… |
CVE-2024-0325 | Low | 3.6 | 2024-02-01 | In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins. |
CVE-2024-24945 | Medium | 6.1 | 2024-02-01 | A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2024-24041 | Medium | 6.1 | 2024-02-01 | A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2024-24569 | Medium | 5.4 | 2024-02-01 | The Pixee Java Code Security Toolkit is a set of security APIs meant to help secure Java code. `ZipSecurity#isBelowCurrentDirectory` is vulnerable to a partial… |
CVE-2024-23645 | Medium | 6.5 | 2024-02-01 | GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12. |
CVE-2024-1167 | Medium | 5.5 | 2024-02-01 | When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur. |
CVE-2024-24570 | High | 8.2 | 2024-02-01 | Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end form… |
CVE-2024-24561 | Critical | 9.8 | 2024-02-01 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for… |
CVE-2024-24557 | Medium | 6.9 | 2024-02-01 | Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image… |
CVE-2024-23832 | Critical | 9.4 | 2024-02-01 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin… |
CVE-2024-24754 | Low | 3.7 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lam… |
CVE-2024-24753 | Medium | 4.8 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers… |
CVE-2024-24752 | Medium | 6.5 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lam… |
CVE-2024-1141 | Medium | 5.5 | 2024-02-01 | A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enable… |
CVE-2024-24062 | Medium | 5.4 | 2024-02-01 | springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role. |
CVE-2024-24061 | Medium | 5.4 | 2024-02-01 | springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add. |
CVE-2024-24060 | Medium | 5.4 | 2024-02-01 | springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user. |
CVE-2024-24059 | Medium | 5.4 | 2024-02-01 | springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files. |
CVE-2024-0935 | Medium | 4.4 | 2024-02-01 | Insertion of Sensitive Information into Log File vulnerabilities are affecting DELMIA Apriso Release 2019 through Release 2024 |
CVE-2024-22449 | Medium | 6.6 | 2024-02-01 | Dell PowerScale OneFS versions 9.0.0.x through 9.6.0.x contains a missing authentication for critical function vulnerability. A low privileged local malicious… |
CVE-2024-22430 | Medium | 5.5 | 2024-02-01 | Dell PowerScale OneFS versions 8.2.x through 9.6.0.x contains an incorrect default permissions vulnerability. A local low privileges malicious user could pote… |
CVE-2024-22148 | High | 7.1 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Editor JoomUnited allows Reflected XSS.This issu… |
CVE-2024-21750 | High | 7.1 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scribit Shortcodes Finder allows Reflected XSS.This issue… |
CVE-2024-24548 | Medium | 6.5 | 2024-02-01 | Payment EX Ver1.1.5b and earlier allows a remote unauthenticated attacker to obtain the information of the user who purchases merchandise using Payment EX. |
CVE-2024-22859 | High | 8.8 | 2024-02-01 | Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the v… |
CVE-2024-23941 | Medium | 5.4 | 2024-02-01 | Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated atta… |
CVE-2024-0831 | Medium | 4.5 | 2024-02-01 | Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensiti… |
CVE-2024-24573 | High | 8.8 | 2024-01-31 | facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request… |
CVE-2024-24572 | Medium | 6.5 | 2024-01-31 | facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was unsafely called ins… |
CVE-2024-24571 | Medium | 5.4 | 2024-01-31 | facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found t… |
CVE-2024-24747 | High | 8.8 | 2024-01-31 | MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but… |
CVE-2024-23653 | Critical | 9.8 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as bui… |
CVE-2024-23652 | Critical | 10.0 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerf… |
CVE-2024-23651 | High | 8.7 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in par… |
CVE-2024-23650 | Medium | 5.3 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend… |
CVE-2024-21626 | High | 8.6 | 2024-01-31 | runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descrip… |
CVE-2024-1117 | High | 7.3 | 2024-01-31 | A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of the file /applicatio… |
CVE-2024-1116 | High | 7.3 | 2024-01-31 | A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application/plugins/controller… |
CVE-2024-1115 | High | 7.3 | 2024-01-31 | A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controlle… |
CVE-2024-1114 | Medium | 6.5 | 2024-01-31 | A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function dlfile of the file /application/index/… |
CVE-2024-1113 | Medium | 6.3 | 2024-01-31 | A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /application/index/contro… |
CVE-2024-22159 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager… |
CVE-2024-22158 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership… |
CVE-2024-22153 | Medium | 5.9 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood & Alexandre Faustino Stock Locations for Wo… |
CVE-2024-22150 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PWR Plugins Portfolio & Image Gallery for WordPress | Pow… |
CVE-2024-22146 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows St… |
CVE-2024-21917 | Critical | 9.8 | 2024-01-31 | A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authenticat… |
CVE-2024-21916 | High | 8.6 | 2024-01-31 | A denial-of-service vulnerability exists in specific Rockwell Automation ControlLogix ang GuardLogix controllers. If exploited, the product could potentially… |
CVE-2024-1111 | Medium | 4.3 | 2024-01-31 | A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Login System 1.0. Affected by this issue is some unknown functio… |
CVE-2024-23637 | Medium | 4.2 | 2024-01-31 | OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change th… |
CVE-2024-22297 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeboxr CBX Map for Google Map & OpenStreetMap allows St… |
CVE-2024-22295 | Medium | 5.9 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Galle… |
CVE-2024-22293 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrea Tarantini BP Profile Search allows Reflected XSS.T… |
CVE-2024-22292 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP… |
CVE-2024-22289 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberNetikz Post views Stats post-views-stats allows DOM-… |
CVE-2024-22286 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aluka BA Plus – Before & After Image Slider FREE allows R… |
CVE-2024-22282 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Torbert SimpleMap Store Locator allows Reflected… |
CVE-2024-22163 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shield Security Shield Security – Smart Bot Blocking & In… |
CVE-2024-22162 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Shortcodes allows Reflected XSS.This issue… |
CVE-2024-22161 | Medium | 5.9 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harmonic Design HD Quiz allows Stored XSS.This issue affe… |
CVE-2024-22160 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bradley B. Dalina Image Tag Manager allows Reflected XSS… |
CVE-2024-21893 | High | 8.2 | 2024-01-31 | A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons… |
CVE-2024-21888 | High | 8.8 | 2024-01-31 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privil… |
CVE-2024-24579 | Medium | 5.3 | 2024-01-31 | stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar arc… |
CVE-2024-24566 | Medium | 5.3 | 2024-01-31 | Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-prote… |
CVE-2024-22310 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formzu Inc. Formzu WP allows Stored XSS.This issue affect… |
CVE-2024-22307 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay.This is… |
CVE-2024-22306 | Medium | 5.9 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hometory Mang Board WP allows Stored XSS.This issue affec… |
CVE-2024-22302 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignazio Scimone Albo Pretorio On line allows Stored XSS.T… |
CVE-2024-23508 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress a… |
CVE-2024-23505 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DearHive PDF Viewer & 3D PDF Flipbook – DearPDF allows St… |
CVE-2024-23502 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in InfornWeb Posts List Designer by Category – List Category… |
CVE-2024-0833 | High | 7.8 | 2024-01-31 | In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In a… |
CVE-2024-0832 | High | 7.8 | 2024-01-31 | In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environ… |
CVE-2024-0219 | High | 7.8 | 2024-01-31 | In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an env… |
CVE-2024-1103 | Low | 3.5 | 2024-01-31 | A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionalit… |
CVE-2024-22140 | High | 8.8 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0. |
CVE-2024-22136 | Medium | 4.3 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in DroitThemes Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder.This issue aff… |
CVE-2024-1112 | High | 7.3 | 2024-01-31 | Heap-based buffer overflow vulnerability in Resource Hacker, developed by Angus Johnson, affecting version 3.6.0.92. This vulnerability could allow an attacker… |
CVE-2024-22304 | Medium | 5.4 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a through 2.3.2. |
CVE-2024-22291 | Medium | 4.3 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Browser Theme Color.This issue affects Browser Theme Color: from n/a through 1.3. |
CVE-2024-22285 | Medium | 5.4 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Elise Bosse Frontpage Manager.This issue affects Frontpage Manager: from n/a through 1.3. |
CVE-2024-22143 | Medium | 5.4 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check.This issue affects WP Spell Check: from n/a through 9.17. |
CVE-2024-1086 | High | 7.8 | 2024-01-31 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_… |
CVE-2024-1085 | High | 7.8 | 2024-01-31 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_ca… |
CVE-2024-0589 | Medium | 5.4 | 2024-01-31 | Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows allows an attacker wi… |
CVE-2024-23507 | High | 8.5 | 2024-01-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affect… |
CVE-2024-22305 | High | 7.5 | 2024-01-31 | Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects… |
CVE-2024-22290 | High | 7.1 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in AboZain,O7abeeb,UnitOne Custom Dashboard Widgets allows Cross-Site Scripting (XSS).This issue affects Custom… |
CVE-2024-22287 | High | 7.1 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Luděk Melichar Better Anchor Links allows Cross-Site Scripting (XSS).This issue affects Better Anchor Links… |