2024 CVEs (page 377)
Page 377 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21383 | Low | 3.3 | 2024-01-26 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-21382 | Medium | 4.3 | 2024-01-26 | Microsoft Edge for Android Information Disclosure Vulnerability |
CVE-2024-21326 | Critical | 9.6 | 2024-01-26 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2024-0456 | Medium | 4.3 | 2024-01-26 | An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able… |
CVE-2024-0402 | Critical | 9.9 | 2024-01-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an a… |
CVE-2024-23630 | Critical | 9.0 | 2024-01-26 | An arbitrary firmware upload vulnerability exists in the Motorola MR2600. An attacker can exploit this vulnerability to achieve code execution on the device… |
CVE-2024-23629 | Critical | 9.6 | 2024-01-26 | An authentication bypass vulnerability exists in the web component of the Motorola MR2600. An attacker can exploit this vulnerability to access protected URLs… |
CVE-2024-23628 | Critical | 9.0 | 2024-01-26 | A command injection vulnerability exists in the 'SaveStaticRouteIPv6Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerabilit… |
CVE-2024-23627 | Critical | 9.0 | 2024-01-26 | A command injection vulnerability exists in the 'SaveStaticRouteIPv4Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability… |
CVE-2024-23626 | Critical | 9.0 | 2024-01-26 | A command injection vulnerability exists in the ‘SaveSysLogParams’ parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achi… |
CVE-2024-23625 | Critical | 9.6 | 2024-01-26 | A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnera… |
CVE-2024-23624 | Critical | 9.6 | 2024-01-26 | A command injection vulnerability exists in the gena.cgi module of D-Link DAP-1650 devices. An unauthenticated attacker can exploit this vulnerability to gain… |
CVE-2024-23622 | Critical | 10.0 | 2024-01-26 | A stack-based buffer overflow exists in IBM Merge Healthcare eFilm Workstation license server. A remote, unauthenticated attacker can exploit this vulnerabilit… |
CVE-2024-23621 | Critical | 10.0 | 2024-01-26 | A buffer overflow exists in IBM Merge Healthcare eFilm Workstation license server. A remote, unauthenticated attacker can exploit this vulnerability to achieve… |
CVE-2024-23620 | High | 8.8 | 2024-01-26 | An improper privilege management vulnerability exists in IBM Merge Healthcare eFilm Workstation. A local, authenticated attacker can exploit this vulnerability… |
CVE-2024-23619 | Critical | 9.8 | 2024-01-26 | A hardcoded credential vulnerability exists in IBM Merge Healthcare eFilm Workstation. A remote, unauthenticated attacker can exploit this vulnerability to ach… |
CVE-2024-23618 | Critical | 9.6 | 2024-01-26 | An arbitrary code execution vulnerability exists in Arris SURFboard SGB6950AC2 devices. An unauthenticated attacker can exploit this vulnerability to achieve c… |
CVE-2024-23617 | Critical | 9.6 | 2024-01-26 | A buffer overflow vulnerability exists in Symantec Data Loss Prevention version 14.0.2 and before. A remote, unauthenticated attacker can exploit this vulnerab… |
CVE-2024-23616 | Critical | 10.0 | 2024-01-26 | A buffer overflow vulnerability exists in Symantec Server Management Suite version 7.9 and before. A remote, anonymous attacker can exploit this vulnerability… |
CVE-2024-23615 | Critical | 10.0 | 2024-01-26 | A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit this vulnerability to a… |
CVE-2024-23614 | Critical | 10.0 | 2024-01-26 | A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before. A remote, anonymous attacker can exploit this vulnerability to ac… |
CVE-2024-23613 | Critical | 10.0 | 2024-01-26 | A buffer overflow vulnerability exists in Symantec Deployment Solution version 7.9 when parsing UpdateComputer tokens. A remote, anonymous attacker can exploit… |
CVE-2024-21620 | High | 8.8 | 2024-01-25 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and E… |
CVE-2024-21619 | Medium | 5.3 | 2024-01-25 | A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-We… |
CVE-2024-0891 | Low | 3.5 | 2024-01-25 | A vulnerability was found in hongmaple octopus 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipu… |
CVE-2024-0890 | Medium | 6.3 | 2024-01-25 | A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function of the file /system/dept/edit. The mani… |
CVE-2024-0889 | Medium | 5.3 | 2024-01-25 | A vulnerability was found in Kmint21 Golden FTP Server 2.02b and classified as problematic. This issue affects some unknown processing of the component PASV Co… |
CVE-2024-23055 | Medium | 6.1 | 2024-01-25 | An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST header… |
CVE-2024-22922 | Critical | 9.8 | 2024-01-25 | An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the PO… |
CVE-2024-0888 | Medium | 5.3 | 2024-01-25 | A vulnerability, which was classified as problematic, was found in BORGChat 1.0.0 Build 438. This affects an unknown part of the component Service Port 7551. T… |
CVE-2024-0887 | Medium | 5.3 | 2024-01-25 | A vulnerability, which was classified as problematic, has been found in Mafiatic Blue Server 1.1. Affected by this issue is some unknown functionality of the c… |
CVE-2024-0886 | Low | 3.3 | 2024-01-25 | A vulnerability classified as problematic was found in Poikosoft EZ CD Audio Converter 8.0.7. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-24399 | High | 7.2 | 2024-01-25 | An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/lang… |
CVE-2024-22639 | Medium | 6.1 | 2024-01-25 | iGalerie v3.0.22 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Titre (Title) field in the editing interface. |
CVE-2024-22638 | Critical | 9.8 | 2024-01-25 | liveSite v2019.1 was discovered to contain a remote code execution (RCE) vulenrabiity via the component /livesite/edit_designer_region.php or /livesite/add_ema… |
CVE-2024-22637 | Medium | 6.1 | 2024-01-25 | Form Tools v3.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /form_builder/preview.php?form_id=2. |
CVE-2024-22636 | High | 8.8 | 2024-01-25 | PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature. This vulnerability is exploited via injec… |
CVE-2024-22635 | Medium | 6.1 | 2024-01-25 | WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /WebCalendarvqsmnseug2/edit_entry.php. |
CVE-2024-0885 | Medium | 5.3 | 2024-01-25 | A vulnerability classified as problematic has been found in SpyCamLizard 1.230. Affected is an unknown function of the component HTTP GET Request Handler. The… |
CVE-2024-0884 | Medium | 4.7 | 2024-01-25 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects the function exec o… |
CVE-2024-23817 | High | 7.1 | 2024-01-25 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerabilit… |
CVE-2024-23656 | High | 7.5 | 2024-01-25 | Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex… |
CVE-2024-23655 | High | 7.5 | 2024-01-25 | Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the use… |
CVE-2024-21630 | Medium | 4.3 | 2024-01-25 | Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-… |
CVE-2024-0883 | Medium | 6.3 | 2024-01-25 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerability affects the func… |
CVE-2024-0882 | Medium | 4.3 | 2024-01-25 | A vulnerability was found in qwdigital LinkWechat 5.1.0. It has been classified as problematic. This affects an unknown part of the file /linkwechat-api/common… |
CVE-2024-0880 | Medium | 4.3 | 2024-01-25 | A vulnerability was found in Qidianbang qdbcrm 1.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/edit… |
CVE-2024-22749 | High | 7.8 | 2024-01-25 | GPAC v2.3 was detected to contain a buffer overflow via the function gf_isom_new_generic_sample_description function in the isomedia/isom_write.c:4577 |
CVE-2024-22529 | Critical | 9.8 | 2024-01-25 | TOTOLINK X2000R_V2 V2.0.0-B20230727.10434 has a command injection vulnerability in the sub_449040 (handle function of formUploadFile) of /bin/boa. |
CVE-2024-0822 | High | 7.5 | 2024-01-25 | An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in… |
CVE-2024-22729 | Critical | 9.8 | 2024-01-25 | NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page. |
CVE-2024-22432 | High | 7.8 | 2024-01-25 | Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. Us… |
CVE-2024-0879 | Medium | 6.5 | 2024-01-25 | Authentication bypass in vector-admin allows a user to register to a vector-admin server while “domain restriction” is active, even when not owning an authori… |
CVE-2024-23855 | High | 8.2 | 2024-01-25 | A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a… |
CVE-2024-23307 | Medium | 4.4 | 2024-01-25 | Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow. |
CVE-2024-22099 | Medium | 6.3 | 2024-01-25 | NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth modules) allows Overflow Buffers. This vulnerability is… |
CVE-2024-23985 | High | 7.5 | 2024-01-25 | EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command. |
CVE-2024-0625 | Medium | 4.4 | 2024-01-25 | The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpfront-notification-bar-options[custom_class]’ paramet… |
CVE-2024-0688 | Medium | 4.4 | 2024-01-25 | The "WebSub (FKA. PubSubHubbub)" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 3… |
CVE-2024-0624 | Medium | 5.3 | 2024-01-25 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… |
CVE-2024-0617 | Medium | 5.3 | 2024-01-25 | The Category Discount Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpcd_save_di… |
CVE-2024-22751 | Critical | 9.8 | 2024-01-24 | D-Link DIR-882 DIR882A1_FW130B06 was discovered to contain a stack overflow via the sub_477AA0 function. |
CVE-2024-23646 | High | 8.8 | 2024-01-24 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site… |
CVE-2024-23644 | Medium | 6.8 | 2024-01-24 | Trillium is a composable toolkit for building internet applications with async rust. In `trillium-http` prior to 0.3.12 and `trillium-client` prior to 0.5.4, i… |
CVE-2024-23905 | Medium | 5.4 | 2024-01-24 | Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worksp… |
CVE-2024-23904 | High | 7.5 | 2024-01-24 | Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argu… |
CVE-2024-23903 | Medium | 5.3 | 2024-01-24 | Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expecte… |
CVE-2024-23902 | Medium | 4.3 | 2024-01-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an atta… |
CVE-2024-23901 | Medium | 6.5 | 2024-01-24 | Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowin… |
CVE-2024-23900 | Medium | 4.3 | 2024-01-24 | Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with… |
CVE-2024-23899 | Medium | 6.5 | 2024-01-24 | Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file p… |
CVE-2024-23898 | High | 8.8 | 2024-01-24 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI… |
CVE-2024-23897 | Critical | 9.8 | 2024-01-24 | Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path… |
CVE-2024-23649 | High | 7.5 | 2024-01-24 | Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private messages, even when th… |
CVE-2024-23648 | High | 8.8 | 2024-01-24 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password chan… |
CVE-2024-22720 | Medium | 4.8 | 2024-01-24 | Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature. |
CVE-2024-23641 | High | 7.5 | 2024-01-24 | SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request wit… |
CVE-2024-22229 | Low | 3.1 | 2024-01-24 | Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker could exploit this vu… |
CVE-2024-22725 | Medium | 6.1 | 2024-01-24 | Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error report… |
CVE-2024-22651 | Critical | 9.8 | 2024-01-24 | There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04. |
CVE-2024-22141 | Medium | 6.5 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a thr… |
CVE-2024-22154 | High | 7.5 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SNP Digital SalesKing.This issue affects SalesKing: from n/a through 1.6.15. |
CVE-2024-22309 | High | 8.7 | 2024-01-24 | Deserialization of Untrusted Data vulnerability in QuantumCloud ChatBot with AI.This issue affects ChatBot with AI: from n/a through 5.1.0. |
CVE-2024-22308 | Low | 3.4 | 2024-01-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through… |
CVE-2024-22301 | Medium | 5.3 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ignazio Scimone Albo Pretorio On line.This issue affects Albo Pretorio On line: fro… |
CVE-2024-22294 | Medium | 5.3 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in IP2Location IP2Location Country Blocker.This issue affects IP2Location Country Bloc… |
CVE-2024-22284 | High | 8.7 | 2024-01-24 | Deserialization of Untrusted Data vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.7.2. |
CVE-2024-22152 | High | 8.0 | 2024-01-24 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for W… |
CVE-2024-22135 | High | 8.0 | 2024-01-24 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order… |
CVE-2024-22134 | Medium | 4.9 | 2024-01-24 | Server-Side Request Forgery (SSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailch… |
CVE-2024-0854 | Medium | 5.4 | 2024-01-24 | URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42… |
CVE-2024-0665 | Medium | 6.1 | 2024-01-24 | The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 d… |
CVE-2024-22372 | Medium | 6.8 | 2024-01-24 | OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS c… |
CVE-2024-22366 | Medium | 6.8 | 2024-01-24 | Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who knows how to use the debug function accesses the device's managem… |
CVE-2024-22380 | Medium | 5.5 | 2024-01-24 | Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era e… |
CVE-2024-21796 | Medium | 5.5 | 2024-01-24 | Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey Editi… |
CVE-2024-21765 | Medium | 5.5 | 2024-01-24 | Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check S… |
CVE-2024-23638 | Medium | 6.5 | 2024-01-24 | Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against C… |
CVE-2024-23633 | Medium | 4.7 | 2024-01-24 | Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and coul… |
CVE-2024-23453 | Medium | 5.5 | 2024-01-24 | Android Spoon application version 7.11.1 to 8.6.0 uses hard-coded credentials, which may allow a local attacker to retrieve the hard-coded API key when the app… |