2024 CVEs (page 375)
Page 375 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1099 | Low | 3.5 | 2024-01-31 | A vulnerability was found in Rebuild up to 3.5.5. It has been classified as problematic. Affected is the function getFileOfData of the file /filex/read-raw. Th… |
CVE-2024-1098 | Medium | 4.3 | 2024-01-31 | A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic. This issue affects the function QiniuCloud.getStorageFile of the file /filex/pr… |
CVE-2024-23775 | High | 7.5 | 2024-01-31 | Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_ext… |
CVE-2024-23170 | Medium | 5.5 | 2024-01-31 | An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could… |
CVE-2024-1012 | Medium | 6.3 | 2024-01-31 | A vulnerability, which was classified as critical, has been found in Wanhu ezOFFICE 11.1.0. This issue affects some unknown processing of the file defaultroot/… |
CVE-2024-0836 | Medium | 4.3 | 2024-01-31 | The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca… |
CVE-2024-22236 | Low | 3.3 | 2024-01-31 | In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to loc… |
CVE-2024-0914 | Medium | 5.9 | 2024-01-31 | A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potent… |
CVE-2024-1069 | High | 7.2 | 2024-01-31 | The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versio… |
CVE-2024-23745 | Critical | 9.8 | 2024-01-31 | In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, e… |
CVE-2024-22569 | Medium | 5.4 | 2024-01-31 | Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=in… |
CVE-2024-23834 | Medium | 6.3 | 2024-01-30 | Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only… |
CVE-2024-1077 | High | 8.8 | 2024-01-30 | Use after free in Network in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a malicious file. (Chro… |
CVE-2024-1060 | High | 8.8 | 2024-01-30 | Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2024-1059 | High | 8.8 | 2024-01-30 | Use after free in Peer Connection in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML… |
CVE-2024-24567 | Medium | 4.8 | 2024-01-30 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a d… |
CVE-2024-24558 | High | 8.2 | 2024-01-30 | TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-next-experimental` NPM… |
CVE-2024-24556 | High | 7.2 | 2024-01-30 | urql is a GraphQL client that exposes a set of helpers for several frameworks. The `@urql/next` package is vulnerable to XSS. To exploit this an attacker woul… |
CVE-2024-23841 | High | 8.2 | 2024-01-30 | apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cros… |
CVE-2024-21388 | Medium | 6.5 | 2024-01-30 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2024-1036 | High | 7.3 | 2024-01-30 | A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function uploadIcon of the file /application/index/controlle… |
CVE-2024-24565 | Medium | 5.7 | 2024-01-30 | CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the Crat… |
CVE-2024-23840 | Medium | 5.5 | 2024-01-30 | GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --deb… |
CVE-2024-23838 | High | 7.5 | 2024-01-30 | TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the Ht… |
CVE-2024-23825 | Low | 3.0 | 2024-01-30 | TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by the user. That use… |
CVE-2024-23647 | Medium | 6.5 | 2024-01-30 | Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offe… |
CVE-2024-22200 | Low | 3.3 | 2024-01-30 | vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, users can run the U… |
CVE-2024-22193 | Low | 3.5 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are n… |
CVE-2024-21671 | Low | 3.7 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is poss… |
CVE-2024-21653 | Medium | 6.5 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Nodes and… |
CVE-2024-21649 | High | 8.8 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4… |
CVE-2024-1035 | High | 7.3 | 2024-01-30 | A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function uploadIcon of the file /application/in… |
CVE-2024-1019 | High | 8.6 | 2024-01-30 | ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 d… |
CVE-2024-24333 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAclRules function. |
CVE-2024-24332 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function. |
CVE-2024-24331 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiScheduleCfg function. |
CVE-2024-24330 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the setRemoteCfg functi… |
CVE-2024-24329 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules functio… |
CVE-2024-24328 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function. |
CVE-2024-24327 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function. |
CVE-2024-24326 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setStaticDhcpRules funct… |
CVE-2024-24325 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function. |
CVE-2024-24324 | Critical | 9.8 | 2024-01-30 | TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow. |
CVE-2024-1034 | High | 7.3 | 2024-01-30 | A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadFile of the file /application/index/control… |
CVE-2024-0564 | Medium | 5.3 | 2024-01-30 | A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4… |
CVE-2024-1033 | Medium | 4.3 | 2024-01-30 | A vulnerability, which was classified as problematic, has been found in openBI up to 1.0.8. Affected by this issue is the function agent of the file /applicati… |
CVE-2024-1032 | High | 7.3 | 2024-01-30 | A vulnerability classified as critical was found in openBI up to 1.0.8. Affected by this vulnerability is the function testConnection of the file /application/… |
CVE-2024-1031 | Low | 3.5 | 2024-01-30 | A vulnerability was found in CodeAstro Expense Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-0676 | Medium | 5.6 | 2024-01-30 | Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a local user to interact with the machine w… |
CVE-2024-0675 | Medium | 6.3 | 2024-01-30 | Vulnerability of improper checking for unusual or exceptional conditions in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, the exploitation of whic… |
CVE-2024-0674 | Medium | 6.3 | 2024-01-30 | Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by mod… |
CVE-2024-22894 | Medium | 6.8 | 2024-01-30 | An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0… |
CVE-2024-1063 | Medium | 5.3 | 2024-01-30 | Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159. |
CVE-2024-1030 | Low | 3.5 | 2024-01-30 | A vulnerability was found in Cogites eReserv 7.7.58. It has been classified as problematic. This affects an unknown part of the file /front/admin/tenancyDetail… |
CVE-2024-22523 | High | 7.5 | 2024-01-30 | Directory Traversal vulnerability in Qiyu iFair version 23.8_ad0 and before, allows remote attackers to obtain sensitive information via uploadimage component. |
CVE-2024-1061 | High | 8.6 | 2024-01-30 | The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_vi… |
CVE-2024-21803 | Low | 3.5 | 2024-01-30 | Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associat… |
CVE-2024-22648 | Medium | 5.3 | 2024-01-30 | A Blind SSRF vulnerability exists in the "Crawl Meta Data" functionality of SEO Panel version 4.10.0. This makes it possible for remote attackers to scan ports… |
CVE-2024-22647 | Medium | 5.3 | 2024-01-30 | An user enumeration vulnerability was found in SEO Panel 4.10.0. This issue occurs during user authentication, where a difference in error messages could allow… |
CVE-2024-22646 | Medium | 5.3 | 2024-01-30 | An email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0. This allows an attacker to guess which emails exi… |
CVE-2024-22643 | Medium | 6.5 | 2024-01-30 | A Cross-Site Request Forgery (CSRF) vulnerability in SEO Panel version 4.10.0 allows remote attackers to perform unauthorized user password resets. |
CVE-2024-1029 | Low | 3.5 | 2024-01-30 | A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. Affected by this issue is some unknown functionality of the file /front/admi… |
CVE-2024-21488 | High | 7.3 | 2024-01-30 | Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitiza… |
CVE-2024-1028 | Low | 3.5 | 2024-01-30 | A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2024-21840 | High | 7.9 | 2024-01-30 | Incorrect Default Permissions vulnerability in Hitachi Storage Plug-in for VMware vCenter allows local users to read and write specific files. This issue affe… |
CVE-2024-1027 | Medium | 6.3 | 2024-01-30 | A vulnerability, which was classified as critical, was found in SourceCodester Facebook News Feed Like 1.0. Affected is an unknown function of the component Po… |
CVE-2024-22938 | High | 7.8 | 2024-01-30 | Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin… |
CVE-2024-1026 | Low | 3.5 | 2024-01-30 | A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. This issue affects some unknown processing of the file front/admin/config.ph… |
CVE-2024-1024 | Low | 3.5 | 2024-01-30 | A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. This vulnerability affects unknown code of the comp… |
CVE-2024-23829 | Medium | 6.5 | 2024-01-29 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences i… |
CVE-2024-23334 | Medium | 5.9 | 2024-01-29 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessa… |
CVE-2024-1022 | Low | 2.4 | 2024-01-29 | A vulnerability, which was classified as problematic, was found in CodeAstro Simple Student Result Management System 5.6. This affects an unknown part of the f… |
CVE-2024-1021 | Medium | 6.3 | 2024-01-29 | A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Affected by this issue is the function readRawText of the component H… |
CVE-2024-1020 | Low | 3.5 | 2024-01-29 | A vulnerability classified as problematic was found in Rebuild up to 3.5.5. Affected by this vulnerability is the function getStorageFile of the file /filex/pr… |
CVE-2024-24141 | Critical | 9.8 | 2024-01-29 | Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter. |
CVE-2024-24140 | High | 7.2 | 2024-01-29 | Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.' |
CVE-2024-24139 | High | 7.2 | 2024-01-29 | Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter. |
CVE-2024-24136 | Medium | 6.1 | 2024-01-29 | The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting (XSS) attacks. |
CVE-2024-22570 | Medium | 5.4 | 2024-01-29 | A stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute arbitrary web scripts… |
CVE-2024-1018 | Low | 2.4 | 2024-01-29 | A vulnerability classified as problematic has been found in PbootCMS 3.2.5-20230421. Affected is an unknown function of the file /admin.php?p=/Area/index#tab=t… |
CVE-2024-24135 | Medium | 6.1 | 2024-01-29 | Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XSS attacks. |
CVE-2024-24134 | Medium | 4.8 | 2024-01-29 | Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update Menu section. |
CVE-2024-23940 | High | 7.8 | 2024-01-29 | Trend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable to a DLL hijacking/pr… |
CVE-2024-1017 | Medium | 5.3 | 2024-01-29 | A vulnerability was found in Gabriels FTP Server 1.2. It has been rated as problematic. This issue affects some unknown processing. The manipulation of the arg… |
CVE-2024-1016 | Medium | 5.3 | 2024-01-29 | A vulnerability was found in Solar FTP Server 2.1.1/2.1.2. It has been declared as problematic. This vulnerability affects unknown code of the component PASV C… |
CVE-2024-23828 | High | 8.8 | 2024-01-29 | Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the… |
CVE-2024-1011 | Medium | 4.3 | 2024-01-29 | A vulnerability classified as problematic was found in SourceCodester Employee Management System 1.0. This vulnerability affects unknown code of the file delet… |
CVE-2024-1010 | Low | 3.5 | 2024-01-29 | A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file edit-profil… |
CVE-2024-1009 | High | 7.3 | 2024-01-29 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-0788 | Medium | 6.6 | 2024-01-29 | SUPERAntiSpyware Pro X v10.0.1260 is vulnerable to kernel-level API parameters manipulation and Denial of Service vulnerabilities by triggering the 0x9C402140… |
CVE-2024-23827 | Critical | 9.8 | 2024-01-29 | Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check i… |
CVE-2024-23826 | Medium | 6.8 | 2024-01-29 | spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an a… |
CVE-2024-23822 | Medium | 5.4 | 2024-01-29 | Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allow… |
CVE-2024-23441 | Medium | 5.5 | 2024-01-29 | Vba32 Antivirus v3.36.0 is vulnerable to a Denial of Service vulnerability by triggering the 0x2220A7 IOCTL code of the Vba32m64.sys driver. |
CVE-2024-1008 | Medium | 4.7 | 2024-01-29 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-1007 | Medium | 6.3 | 2024-01-29 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been classified as critical. Affected is an unknown function of the file edi… |
CVE-2024-1006 | High | 7.3 | 2024-01-29 | A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-1005 | Medium | 5.3 | 2024-01-29 | A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-1004 | High | 7.2 | 2024-01-29 | A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216. This affects the function loginAuth of the file /cgi-bin… |
CVE-2024-1003 | High | 7.2 | 2024-01-29 | A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the function setLanguageC… |