2024 CVEs (page 378)
Page 378 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23898 | High | 8.8 | 2024-01-24 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI… |
CVE-2024-23897 | Critical | 9.8 | 2024-01-24 | Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path… |
CVE-2024-23649 | High | 7.5 | 2024-01-24 | Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private messages, even when th… |
CVE-2024-23648 | High | 8.8 | 2024-01-24 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password chan… |
CVE-2024-22720 | Medium | 4.8 | 2024-01-24 | Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature. |
CVE-2024-23641 | High | 7.5 | 2024-01-24 | SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request wit… |
CVE-2024-22229 | Low | 3.1 | 2024-01-24 | Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker could exploit this vu… |
CVE-2024-22725 | Medium | 6.1 | 2024-01-24 | Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error report… |
CVE-2024-22651 | Critical | 9.8 | 2024-01-24 | There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04. |
CVE-2024-22141 | Medium | 6.5 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a thr… |
CVE-2024-22154 | High | 7.5 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SNP Digital SalesKing.This issue affects SalesKing: from n/a through 1.6.15. |
CVE-2024-22309 | High | 8.7 | 2024-01-24 | Deserialization of Untrusted Data vulnerability in QuantumCloud ChatBot with AI.This issue affects ChatBot with AI: from n/a through 5.1.0. |
CVE-2024-22308 | Low | 3.4 | 2024-01-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through… |
CVE-2024-22301 | Medium | 5.3 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ignazio Scimone Albo Pretorio On line.This issue affects Albo Pretorio On line: fro… |
CVE-2024-22294 | Medium | 5.3 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in IP2Location IP2Location Country Blocker.This issue affects IP2Location Country Bloc… |
CVE-2024-22284 | High | 8.7 | 2024-01-24 | Deserialization of Untrusted Data vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.7.2. |
CVE-2024-22152 | High | 8.0 | 2024-01-24 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for W… |
CVE-2024-22135 | High | 8.0 | 2024-01-24 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order… |
CVE-2024-22134 | Medium | 4.9 | 2024-01-24 | Server-Side Request Forgery (SSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailch… |
CVE-2024-0854 | Medium | 5.4 | 2024-01-24 | URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42… |
CVE-2024-0665 | Medium | 6.1 | 2024-01-24 | The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 d… |
CVE-2024-22372 | Medium | 6.8 | 2024-01-24 | OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS c… |
CVE-2024-22366 | Medium | 6.8 | 2024-01-24 | Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who knows how to use the debug function accesses the device's managem… |
CVE-2024-22380 | Medium | 5.5 | 2024-01-24 | Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era e… |
CVE-2024-21796 | Medium | 5.5 | 2024-01-24 | Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey Editi… |
CVE-2024-21765 | Medium | 5.5 | 2024-01-24 | Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check S… |
CVE-2024-23638 | Medium | 6.5 | 2024-01-24 | Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against C… |
CVE-2024-23633 | Medium | 4.7 | 2024-01-24 | Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and coul… |
CVE-2024-23453 | Medium | 5.5 | 2024-01-24 | Android Spoon application version 7.11.1 to 8.6.0 uses hard-coded credentials, which may allow a local attacker to retrieve the hard-coded API key when the app… |
CVE-2024-0814 | Medium | 6.5 | 2024-01-24 | Incorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (… |
CVE-2024-0813 | High | 8.8 | 2024-01-24 | Use after free in Reading Mode in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2024-0812 | High | 8.8 | 2024-01-24 | Inappropriate implementation in Accessibility in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit object corruption via a… |
CVE-2024-0811 | Medium | 4.3 | 2024-01-24 | Inappropriate implementation in Extensions API in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2024-0810 | Medium | 4.3 | 2024-01-24 | Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2024-0809 | Medium | 4.3 | 2024-01-24 | Inappropriate implementation in Autofill in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML p… |
CVE-2024-0808 | Critical | 9.8 | 2024-01-24 | Integer underflow in WebUI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a malicious file. (Chro… |
CVE-2024-0807 | High | 8.8 | 2024-01-24 | Use after free in Web Audio in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2024-0806 | High | 8.8 | 2024-01-24 | Use after free in Passwords in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via specific UI interactio… |
CVE-2024-0805 | Medium | 4.3 | 2024-01-24 | Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to perform domain spoofing via a crafted domain nam… |
CVE-2024-0804 | High | 7.5 | 2024-01-24 | Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2024-22497 | Medium | 6.1 | 2024-01-23 | Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL. |
CVE-2024-23636 | Critical | 9.8 | 2024-01-23 | SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a black… |
CVE-2024-23341 | Medium | 6.1 | 2024-01-23 | TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanes… |
CVE-2024-23330 | Medium | 5.3 | 2024-01-23 | Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the d… |
CVE-2024-22417 | Medium | 6.1 | 2024-01-23 | Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate the user-controlled `… |
CVE-2024-22205 | Critical | 9.1 | 2024-01-23 | Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location`… |
CVE-2024-22204 | Medium | 5.3 | 2024-01-23 | Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle a… |
CVE-2024-22203 | Critical | 9.1 | 2024-01-23 | Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `s… |
CVE-2024-22496 | Medium | 6.1 | 2024-01-23 | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter. |
CVE-2024-22490 | Medium | 6.1 | 2024-01-23 | Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter. |
CVE-2024-22663 | Critical | 9.8 | 2024-01-23 | TOTOLINK_A3700R_V9.1.2u.6165_20211012has a command Injection vulnerability via setOpModeCfg |
CVE-2024-22662 | Critical | 9.8 | 2024-01-23 | TOTOLINK A3700R_V9.1.2u.6165_20211012 has a stack overflow vulnerability via setParentalRules |
CVE-2024-22660 | Critical | 9.8 | 2024-01-23 | TOTOLINK_A3700R_V9.1.2u.6165_20211012has a stack overflow vulnerability via setLanguageCfg |
CVE-2024-0755 | High | 8.8 | 2024-01-23 | Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-0754 | Medium | 6.5 | 2024-01-23 | Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122. |
CVE-2024-0753 | Medium | 6.5 | 2024-01-23 | In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunder… |
CVE-2024-0752 | Medium | 6.5 | 2024-01-23 | A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system. This could have resulted in an exploitable cr… |
CVE-2024-0751 | High | 8.8 | 2024-01-23 | A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 11… |
CVE-2024-0750 | High | 8.8 | 2024-01-23 | A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affect… |
CVE-2024-0749 | Medium | 4.3 | 2024-01-23 | A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar. This vulnerability affects Firef… |
CVE-2024-0748 | Medium | 4.3 | 2024-01-23 | A compromised content process could have updated the document URI. This could have allowed an attacker to set an arbitrary URI in the address bar or history. T… |
CVE-2024-0747 | Medium | 6.5 | 2024-01-23 | When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy… |
CVE-2024-0746 | Medium | 6.5 | 2024-01-23 | A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunde… |
CVE-2024-0745 | High | 8.8 | 2024-01-23 | The WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow. This could have led to a potentially exploitable crash. This vulnerability aff… |
CVE-2024-0744 | High | 7.5 | 2024-01-23 | In some circumstances, JIT compiled code could have dereferenced a wild pointer value. This could have led to an exploitable crash. This vulnerability affects… |
CVE-2024-0743 | High | 7.5 | 2024-01-23 | An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115… |
CVE-2024-0742 | Medium | 4.3 | 2024-01-23 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent… |
CVE-2024-0741 | Medium | 6.5 | 2024-01-23 | An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox… |
CVE-2024-22705 | High | 7.8 | 2024-01-23 | An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-… |
CVE-2024-22076 | Critical | 9.8 | 2024-01-23 | MyQ Print Server before 8.2 patch 43 allows remote authenticated administrators to execute arbitrary code via PHP scripts that are reached through the administ… |
CVE-2024-0703 | Medium | 4.4 | 2024-01-23 | The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and incl… |
CVE-2024-23348 | High | 8.8 | 2024-01-23 | Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x s… |
CVE-2024-23183 | Medium | 5.4 | 2024-01-23 | Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series… |
CVE-2024-23182 | High | 8.1 | 2024-01-23 | Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x ser… |
CVE-2024-23181 | Medium | 6.1 | 2024-01-23 | Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series… |
CVE-2024-23180 | High | 8.8 | 2024-01-23 | Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x s… |
CVE-2024-23851 | Medium | 5.5 | 2024-01-23 | copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_k… |
CVE-2024-23850 | Medium | 5.5 | 2024-01-23 | In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out… |
CVE-2024-23849 | Medium | 5.5 | 2024-01-23 | In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, res… |
CVE-2024-23848 | Medium | 5.5 | 2024-01-23 | In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-a… |
CVE-2024-0587 | Medium | 6.1 | 2024-01-23 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'disqus_name' parameter in all versions… |
CVE-2024-23842 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22772 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-8H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22771 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22770 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-16781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22769 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22768 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-23224 | Medium | 5.5 | 2024-01-23 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.3, macOS Ventura 13.6.4. An app may be able to access sensitive user data. |
CVE-2024-23223 | Medium | 6.2 | 2024-01-23 | A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An… |
CVE-2024-23222 | High | 8.8 | 2024-01-23 | A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS… |
CVE-2024-23219 | Medium | 6.2 | 2024-01-23 | The issue was addressed with improved authentication. This issue is fixed in iOS 17.3 and iPadOS 17.3. Stolen Device Protection may be unexpectedly disabled. |
CVE-2024-23218 | Medium | 5.9 | 2024-01-23 | A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPad… |
CVE-2024-23217 | Low | 3.3 | 2024-01-23 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, macOS Ventura 13.6… |
CVE-2024-23215 | Medium | 5.5 | 2024-01-23 | An issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3… |
CVE-2024-23214 | High | 8.8 | 2024-01-23 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3… |
CVE-2024-23213 | High | 8.8 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma… |
CVE-2024-23212 | High | 7.8 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, ma… |
CVE-2024-23211 | Low | 3.3 | 2024-01-23 | A privacy issue was addressed with improved handling of user preferences. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS… |
CVE-2024-23210 | Low | 3.3 | 2024-01-23 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watch… |
CVE-2024-23209 | High | 8.8 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3. Processing web content may lead to arbitrary code execution. |