2024 CVEs (page 375)
Page 375 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1035 | High | 7.3 | 2024-01-30 | A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function uploadIcon of the file /application/in… |
CVE-2024-1019 | High | 8.6 | 2024-01-30 | ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 d… |
CVE-2024-24333 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAclRules function. |
CVE-2024-24332 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function. |
CVE-2024-24331 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiScheduleCfg function. |
CVE-2024-24330 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the setRemoteCfg functi… |
CVE-2024-24329 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules functio… |
CVE-2024-24328 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function. |
CVE-2024-24327 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function. |
CVE-2024-24326 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setStaticDhcpRules funct… |
CVE-2024-24325 | Critical | 9.8 | 2024-01-30 | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function. |
CVE-2024-24324 | Critical | 9.8 | 2024-01-30 | TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow. |
CVE-2024-1034 | High | 7.3 | 2024-01-30 | A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadFile of the file /application/index/control… |
CVE-2024-0564 | Medium | 5.3 | 2024-01-30 | A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4… |
CVE-2024-1033 | Medium | 4.3 | 2024-01-30 | A vulnerability, which was classified as problematic, has been found in openBI up to 1.0.8. Affected by this issue is the function agent of the file /applicati… |
CVE-2024-1032 | High | 7.3 | 2024-01-30 | A vulnerability classified as critical was found in openBI up to 1.0.8. Affected by this vulnerability is the function testConnection of the file /application/… |
CVE-2024-1031 | Low | 3.5 | 2024-01-30 | A vulnerability was found in CodeAstro Expense Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-0676 | Medium | 5.6 | 2024-01-30 | Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a local user to interact with the machine w… |
CVE-2024-0675 | Medium | 6.3 | 2024-01-30 | Vulnerability of improper checking for unusual or exceptional conditions in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, the exploitation of whic… |
CVE-2024-0674 | Medium | 6.3 | 2024-01-30 | Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by mod… |
CVE-2024-22894 | Medium | 6.8 | 2024-01-30 | An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0… |
CVE-2024-1063 | Medium | 5.3 | 2024-01-30 | Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159. |
CVE-2024-1030 | Low | 3.5 | 2024-01-30 | A vulnerability was found in Cogites eReserv 7.7.58. It has been classified as problematic. This affects an unknown part of the file /front/admin/tenancyDetail… |
CVE-2024-22523 | High | 7.5 | 2024-01-30 | Directory Traversal vulnerability in Qiyu iFair version 23.8_ad0 and before, allows remote attackers to obtain sensitive information via uploadimage component. |
CVE-2024-1061 | High | 8.6 | 2024-01-30 | The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_vi… |
CVE-2024-21803 | Low | 3.5 | 2024-01-30 | Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associat… |
CVE-2024-22648 | Medium | 5.3 | 2024-01-30 | A Blind SSRF vulnerability exists in the "Crawl Meta Data" functionality of SEO Panel version 4.10.0. This makes it possible for remote attackers to scan ports… |
CVE-2024-22647 | Medium | 5.3 | 2024-01-30 | An user enumeration vulnerability was found in SEO Panel 4.10.0. This issue occurs during user authentication, where a difference in error messages could allow… |
CVE-2024-22646 | Medium | 5.3 | 2024-01-30 | An email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0. This allows an attacker to guess which emails exi… |
CVE-2024-22643 | Medium | 6.5 | 2024-01-30 | A Cross-Site Request Forgery (CSRF) vulnerability in SEO Panel version 4.10.0 allows remote attackers to perform unauthorized user password resets. |
CVE-2024-1029 | Low | 3.5 | 2024-01-30 | A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. Affected by this issue is some unknown functionality of the file /front/admi… |
CVE-2024-21488 | High | 7.3 | 2024-01-30 | Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitiza… |
CVE-2024-1028 | Low | 3.5 | 2024-01-30 | A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2024-21840 | High | 7.9 | 2024-01-30 | Incorrect Default Permissions vulnerability in Hitachi Storage Plug-in for VMware vCenter allows local users to read and write specific files. This issue affe… |
CVE-2024-1027 | Medium | 6.3 | 2024-01-30 | A vulnerability, which was classified as critical, was found in SourceCodester Facebook News Feed Like 1.0. Affected is an unknown function of the component Po… |
CVE-2024-22938 | High | 7.8 | 2024-01-30 | Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin… |
CVE-2024-1026 | Low | 3.5 | 2024-01-30 | A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. This issue affects some unknown processing of the file front/admin/config.ph… |
CVE-2024-1024 | Low | 3.5 | 2024-01-30 | A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. This vulnerability affects unknown code of the comp… |
CVE-2024-23829 | Medium | 6.5 | 2024-01-29 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences i… |
CVE-2024-23334 | Medium | 5.9 | 2024-01-29 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessa… |
CVE-2024-1022 | Low | 2.4 | 2024-01-29 | A vulnerability, which was classified as problematic, was found in CodeAstro Simple Student Result Management System 5.6. This affects an unknown part of the f… |
CVE-2024-1021 | Medium | 6.3 | 2024-01-29 | A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. Affected by this issue is the function readRawText of the component H… |
CVE-2024-1020 | Low | 3.5 | 2024-01-29 | A vulnerability classified as problematic was found in Rebuild up to 3.5.5. Affected by this vulnerability is the function getStorageFile of the file /filex/pr… |
CVE-2024-24141 | Critical | 9.8 | 2024-01-29 | Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter. |
CVE-2024-24140 | High | 7.2 | 2024-01-29 | Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.' |
CVE-2024-24139 | High | 7.2 | 2024-01-29 | Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter. |
CVE-2024-24136 | Medium | 6.1 | 2024-01-29 | The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting (XSS) attacks. |
CVE-2024-22570 | Medium | 5.4 | 2024-01-29 | A stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute arbitrary web scripts… |
CVE-2024-1018 | Low | 2.4 | 2024-01-29 | A vulnerability classified as problematic has been found in PbootCMS 3.2.5-20230421. Affected is an unknown function of the file /admin.php?p=/Area/index#tab=t… |
CVE-2024-24135 | Medium | 6.1 | 2024-01-29 | Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XSS attacks. |
CVE-2024-24134 | Medium | 4.8 | 2024-01-29 | Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update Menu section. |
CVE-2024-23940 | High | 7.8 | 2024-01-29 | Trend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable to a DLL hijacking/pr… |
CVE-2024-1017 | Medium | 5.3 | 2024-01-29 | A vulnerability was found in Gabriels FTP Server 1.2. It has been rated as problematic. This issue affects some unknown processing. The manipulation of the arg… |
CVE-2024-1016 | Medium | 5.3 | 2024-01-29 | A vulnerability was found in Solar FTP Server 2.1.1/2.1.2. It has been declared as problematic. This vulnerability affects unknown code of the component PASV C… |
CVE-2024-23828 | High | 8.8 | 2024-01-29 | Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the… |
CVE-2024-1011 | Medium | 4.3 | 2024-01-29 | A vulnerability classified as problematic was found in SourceCodester Employee Management System 1.0. This vulnerability affects unknown code of the file delet… |
CVE-2024-1010 | Low | 3.5 | 2024-01-29 | A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file edit-profil… |
CVE-2024-1009 | High | 7.3 | 2024-01-29 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-0788 | Medium | 6.6 | 2024-01-29 | SUPERAntiSpyware Pro X v10.0.1260 is vulnerable to kernel-level API parameters manipulation and Denial of Service vulnerabilities by triggering the 0x9C402140… |
CVE-2024-23827 | Critical | 9.8 | 2024-01-29 | Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check i… |
CVE-2024-23826 | Medium | 6.8 | 2024-01-29 | spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an a… |
CVE-2024-23822 | Medium | 5.4 | 2024-01-29 | Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allow… |
CVE-2024-23441 | Medium | 5.5 | 2024-01-29 | Vba32 Antivirus v3.36.0 is vulnerable to a Denial of Service vulnerability by triggering the 0x2220A7 IOCTL code of the Vba32m64.sys driver. |
CVE-2024-1008 | Medium | 4.7 | 2024-01-29 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-1007 | Medium | 6.3 | 2024-01-29 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been classified as critical. Affected is an unknown function of the file edi… |
CVE-2024-1006 | High | 7.3 | 2024-01-29 | A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-1005 | Medium | 5.3 | 2024-01-29 | A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-1004 | High | 7.2 | 2024-01-29 | A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216. This affects the function loginAuth of the file /cgi-bin… |
CVE-2024-1003 | High | 7.2 | 2024-01-29 | A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the function setLanguageC… |
CVE-2024-23747 | High | 7.5 | 2024-01-29 | The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability… |
CVE-2024-22559 | Medium | 5.4 | 2024-01-29 | LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field. |
CVE-2024-1015 | Critical | 9.8 | 2024-01-29 | Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from th… |
CVE-2024-1014 | Medium | 6.2 | 2024-01-29 | Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availabi… |
CVE-2024-1002 | High | 7.2 | 2024-01-29 | A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this vulnerability is the function setIpPortFilterRules… |
CVE-2024-1001 | High | 7.2 | 2024-01-29 | A vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected is the function main of the file /cgi-bin/cstecgi.cgi… |
CVE-2024-1000 | High | 7.2 | 2024-01-29 | A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects the function setTracerouteCfg of the file… |
CVE-2024-0999 | High | 7.2 | 2024-01-29 | A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. This vulnerability affects the function setParentalRules… |
CVE-2024-0998 | High | 7.2 | 2024-01-29 | A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. This affects the function setDiagnosisCfg of the file /… |
CVE-2024-0997 | High | 7.2 | 2024-01-29 | A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. Affected by this issue is the function setOpModeCfg of the file… |
CVE-2024-23792 | Medium | 5.3 | 2024-01-29 | When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other us… |
CVE-2024-23791 | Medium | 4.9 | 2024-01-29 | Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects… |
CVE-2024-23790 | Low | 3.5 | 2024-01-29 | Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue… |
CVE-2024-0212 | High | 8.1 | 2024-01-29 | The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to a… |
CVE-2024-24736 | High | 7.5 | 2024-01-29 | The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remote denial of service (reboot) via a long string to TCP port 110, a related issue to CVE-2004-1558. |
CVE-2024-0996 | High | 7.2 | 2024-01-29 | A vulnerability classified as critical has been found in Tenda i9 1.0.0.9(4122). This affects the function formSetCfm of the file /goform/setcfm of the compone… |
CVE-2024-0995 | High | 7.2 | 2024-01-29 | A vulnerability was found in Tenda W6 1.0.0.9(4122). It has been rated as critical. Affected by this issue is the function formwrlSSIDset of the file /goform/w… |
CVE-2024-0994 | High | 7.2 | 2024-01-29 | A vulnerability was found in Tenda W6 1.0.0.9(4122). It has been declared as critical. Affected by this vulnerability is the function formSetCfm of the file /g… |
CVE-2024-0993 | High | 7.2 | 2024-01-29 | A vulnerability was found in Tenda i6 1.0.0.9(3857). It has been classified as critical. Affected is the function formWifiMacFilterGet of the file /goform/Wifi… |
CVE-2024-0992 | High | 7.2 | 2024-01-29 | A vulnerability was found in Tenda i6 1.0.0.9(3857) and classified as critical. This issue affects the function formwrlSSIDset of the file /goform/wifiSSIDset… |
CVE-2024-0991 | High | 7.2 | 2024-01-29 | A vulnerability has been found in Tenda i6 1.0.0.9(3857) and classified as critical. This vulnerability affects the function formSetCfm of the file /goform/set… |
CVE-2024-0990 | High | 7.2 | 2024-01-29 | A vulnerability, which was classified as critical, was found in Tenda i6 1.0.0.9(3857). This affects the function formSetAutoPing of the file /goform/setAutoPi… |
CVE-2024-0989 | Medium | 5.4 | 2024-01-29 | A vulnerability, which was classified as problematic, has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this issue is the function del… |
CVE-2024-0988 | Medium | 6.3 | 2024-01-29 | A vulnerability classified as critical was found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this vulnerability is the function checklogin of t… |
CVE-2024-0987 | Medium | 6.3 | 2024-01-29 | A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unknown function of the file /runtime/log… |
CVE-2024-0986 | Medium | 4.7 | 2024-01-29 | A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asterisk_… |
CVE-2024-23782 | Medium | 5.4 | 2024-01-28 | Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x… |
CVE-2024-0841 | Medium | 6.6 | 2024-01-28 | A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allo… |
CVE-2024-23740 | Critical | 9.8 | 2024-01-28 | An issue in Kap for macOS version 3.6.0 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments setti… |
CVE-2024-23742 | Critical | 9.8 | 2024-01-28 | An issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments set… |
CVE-2024-23741 | Critical | 9.8 | 2024-01-28 | An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments sett… |