2024 CVEs (page 379)
Page 379 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23208 | High | 7.8 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An app may… |
CVE-2024-23207 | Medium | 5.5 | 2024-01-23 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma… |
CVE-2024-23206 | Medium | 6.5 | 2024-01-23 | An access issue was addressed with improved access restrictions. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, ma… |
CVE-2024-23204 | High | 7.5 | 2024-01-23 | The issue was addressed with additional permissions checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7… |
CVE-2024-23203 | High | 7.5 | 2024-01-23 | The issue was addressed with additional permissions checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, m… |
CVE-2024-23345 | High | 7.1 | 2024-01-23 | Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2… |
CVE-2024-23342 | High | 7.4 | 2024-01-23 | The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorith… |
CVE-2024-23340 | Medium | 5.3 | 2024-01-22 | @hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `ur… |
CVE-2024-23339 | Medium | 6.3 | 2024-01-22 | hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility… |
CVE-2024-23678 | High | 7.5 | 2024-01-22 | In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe dese… |
CVE-2024-23677 | Medium | 4.3 | 2024-01-22 | In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file. |
CVE-2024-23676 | Medium | 4.6 | 2024-01-22 | In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to vie… |
CVE-2024-23675 | Medium | 6.5 | 2024-01-22 | In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST applicati… |
CVE-2024-0606 | Medium | 6.1 | 2024-01-22 | An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthorized actions… |
CVE-2024-0605 | High | 7.5 | 2024-01-22 | Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security me… |
CVE-2024-0430 | Medium | 5.5 | 2024-01-22 | IObit Malware Fighter v11.0.0.1274 is vulnerable to a Denial of Service vulnerability by triggering the 0x8001E00C IOCTL code of the ImfHpRegFilter.sys driver. |
CVE-2024-0784 | Medium | 6.3 | 2024-01-22 | A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function of the file /system/role/list. The mani… |
CVE-2024-0783 | Medium | 6.3 | 2024-01-22 | A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical. This issue affects some unknown processing of the file docu… |
CVE-2024-0204 | Critical | 9.8 | 2024-01-22 | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. |
CVE-2024-0782 | Low | 3.5 | 2024-01-22 | A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. This vulnerability affects unknown code of the… |
CVE-2024-0781 | Low | 3.5 | 2024-01-22 | A vulnerability, which was classified as problematic, was found in CodeAstro Internet Banking System 1.0. This affects an unknown part of the file pages_client… |
CVE-2024-0778 | High | 8.0 | 2024-01-22 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930. Affected by this issue… |
CVE-2024-22895 | High | 8.8 | 2024-01-22 | DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php. |
CVE-2024-22233 | High | 7.5 | 2024-01-22 | In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) co… |
CVE-2024-0775 | Medium | 6.7 | 2024-01-22 | A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information lea… |
CVE-2024-22113 | Medium | 6.1 | 2024-01-22 | Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote unauthenticated attacker to redirect us… |
CVE-2024-21484 | High | 7.5 | 2024-01-22 | Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can dec… |
CVE-2024-23771 | Critical | 9.8 | 2024-01-22 | darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication vi… |
CVE-2024-23770 | Medium | 5.5 | 2024-01-22 | darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments. |
CVE-2024-23768 | High | 8.8 | 2024-01-22 | Dremio before 24.3.1 allows path traversal. An authenticated user who has no privileges on certain folders (and the files and datasets in these folders) can ac… |
CVE-2024-23752 | Critical | 9.8 | 2024-01-22 | GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that… |
CVE-2024-23751 | Critical | 9.8 | 2024-01-22 | LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetri… |
CVE-2024-23750 | High | 8.8 | 2024-01-22 | MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen. |
CVE-2024-0776 | Low | 3.5 | 2024-01-22 | A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms 2.0. Affected by this issue is some unknown functionality of the com… |
CVE-2024-0774 | Medium | 5.3 | 2024-01-22 | A vulnerability was found in Any-Capture Any Sound Recorder 2.93. It has been declared as problematic. This vulnerability affects unknown code of the component… |
CVE-2024-0773 | Low | 3.5 | 2024-01-22 | A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-0772 | Medium | 5.3 | 2024-01-22 | A vulnerability was found in Nsasoft ShareAlarmPro 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the component R… |
CVE-2024-23744 | High | 7.5 | 2024-01-21 | An issue was discovered in Mbed TLS 3.5.1. There is persistent handshake denial if a client sends a TLS 1.3 ClientHello without extensions. |
CVE-2024-0771 | Medium | 5.3 | 2024-01-21 | A vulnerability has been found in Nsasoft Product Key Explorer 4.0.9 and classified as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2024-0770 | Medium | 4.4 | 2024-01-21 | A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file… |
CVE-2024-23732 | High | 7.5 | 2024-01-21 | The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py. |
CVE-2024-23731 | Critical | 9.8 | 2024-01-21 | The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument. |
CVE-2024-23730 | Critical | 9.8 | 2024-01-21 | The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_load is not used for YA… |
CVE-2024-0769 | Medium | 5.3 | 2024-01-21 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown func… |
CVE-2024-23726 | High | 8.8 | 2024-01-21 | Ubee DDW365 XCNDDW365 devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. A remote attacker (in proximity to a Wi-Fi netw… |
CVE-2024-23725 | Medium | 6.1 | 2024-01-21 | Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries. |
CVE-2024-0521 | High | 7.8 | 2024-01-20 | Code Injection in paddlepaddle/paddle |
CVE-2024-0679 | Medium | 6.5 | 2024-01-20 | The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() function in all version… |
CVE-2024-0623 | Medium | 4.3 | 2024-01-20 | The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing o… |
CVE-2024-23332 | Medium | 4.0 | 2024-01-19 | The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic co… |
CVE-2024-23688 | Medium | 5.3 | 2024-01-19 | Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's p… |
CVE-2024-23687 | Critical | 9.1 | 2024-01-19 | Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modi… |
CVE-2024-23686 | Medium | 5.3 | 2024-01-19 | DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to r… |
CVE-2024-0739 | High | 7.3 | 2024-01-19 | A vulnerability, which was classified as critical, was found in Hecheng Leadshop up to 1.4.20. Affected is an unknown function of the file /web/leadshop.php. T… |
CVE-2024-0738 | Medium | 6.3 | 2024-01-19 | A vulnerability, which was classified as critical, has been found in 个人开源 mldong 1.0. This issue affects the function ExpressionEngine of the file com/mldong/m… |
CVE-2024-0737 | Medium | 5.3 | 2024-01-19 | A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. This vulnerability affects unknown code of the component Login. The ma… |
CVE-2024-23689 | High | 8.8 | 2024-01-19 | Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions… |
CVE-2024-23685 | Medium | 5.3 | 2024-01-19 | Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storag… |
CVE-2024-23684 | High | 7.5 | 2024-01-19 | Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versi… |
CVE-2024-23683 | High | 8.2 | 2024-01-19 | Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException… |
CVE-2024-23682 | High | 8.2 | 2024-01-19 | Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An atta… |
CVE-2024-23681 | High | 8.2 | 2024-01-19 | Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.load… |
CVE-2024-23680 | Medium | 5.3 | 2024-01-19 | AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures. |
CVE-2024-23679 | Critical | 9.8 | 2024-01-19 | Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of… |
CVE-2024-22421 | High | 7.6 | 2024-01-19 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who cli… |
CVE-2024-22420 | Medium | 6.5 | 2024-01-19 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends… |
CVE-2024-0758 | Medium | 6.1 | 2024-01-19 | MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a victim browser via cr… |
CVE-2024-0736 | Medium | 5.3 | 2024-01-19 | A vulnerability classified as problematic has been found in EFS Easy File Sharing FTP 3.6. This affects an unknown part of the component Login. The manipulatio… |
CVE-2024-0735 | Medium | 6.3 | 2024-01-19 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. Affected by this issue is the function… |
CVE-2024-0734 | Medium | 6.3 | 2024-01-19 | A vulnerability was found in Smsot up to 2.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /get.ph… |
CVE-2024-0733 | Medium | 6.3 | 2024-01-19 | A vulnerability was found in Smsot up to 2.12. It has been classified as critical. Affected is an unknown function of the file /api.php of the component HTTP P… |
CVE-2024-23331 | High | 7.5 | 2024-01-19 | Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-au… |
CVE-2024-23329 | Low | 3.7 | 2024-01-19 | changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/histor… |
CVE-2024-22211 | Low | 3.7 | 2024-01-19 | FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_contex… |
CVE-2024-0732 | Medium | 5.3 | 2024-01-19 | A vulnerability was found in PCMan FTP Server 2.0.7 and classified as problematic. This issue affects some unknown processing of the component STOR Command Han… |
CVE-2024-0731 | Medium | 5.3 | 2024-01-19 | A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as problematic. This vulnerability affects unknown code of the component PUT Command Ha… |
CVE-2024-0730 | Medium | 6.3 | 2024-01-19 | A vulnerability, which was classified as critical, was found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file course… |
CVE-2024-0729 | Medium | 5.5 | 2024-01-19 | A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. Affected by this issue is some unknown functionality of the fil… |
CVE-2024-0728 | Medium | 4.7 | 2024-01-19 | A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channe… |
CVE-2024-22957 | Medium | 5.5 | 2024-01-19 | swftools 0.9.2 was discovered to contain an Out-of-bounds Read vulnerability via the function dict_do_lookup in swftools/lib/q.c:1190. |
CVE-2024-22956 | High | 7.8 | 2024-01-19 | swftools 0.9.2 was discovered to contain a heap-use-after-free vulnerability via the function removeFromTo at swftools/src/swfc.c:838 |
CVE-2024-22955 | High | 7.8 | 2024-01-19 | swftools 0.9.2 was discovered to contain a stack-buffer-underflow vulnerability via the function parseExpression at swftools/src/swfc.c:2576. |
CVE-2024-22919 | High | 7.8 | 2024-01-19 | swftools0.9.2 was discovered to contain a global-buffer-overflow vulnerability via the function parseExpression at swftools/src/swfc.c:2587. |
CVE-2024-22915 | High | 7.8 | 2024-01-19 | A heap-use-after-free was found in SWFTools v0.9.2, in the function swf_DeleteTag at rfxswf.c:1193. It allows an attacker to cause code execution. |
CVE-2024-22914 | Medium | 5.5 | 2024-01-19 | A heap-use-after-free was found in SWFTools v0.9.2, in the function input at lex.swf5.c:2620. It allows an attacker to cause denial of service. |
CVE-2024-22913 | High | 7.8 | 2024-01-19 | A heap-buffer-overflow was found in SWFTools v0.9.2, in the function swf5lex at lex.swf5.c:1321. It allows an attacker to cause code execution. |
CVE-2024-22912 | High | 7.8 | 2024-01-19 | A global-buffer-overflow was found in SWFTools v0.9.2, in the function countline at swf5compiler.flex:327. It allows an attacker to cause code execution. |
CVE-2024-22911 | High | 7.8 | 2024-01-19 | A stack-buffer-underflow vulnerability was found in SWFTools v0.9.2, in the function parseExpression at src/swfc.c:2602. |
CVE-2024-0726 | Medium | 4.3 | 2024-01-19 | A vulnerability was found in Project Worlds Student Project Allocation System 1.0. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2024-0725 | Medium | 5.3 | 2024-01-19 | A vulnerability was found in ProSSHD 1.2 on Windows. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to de… |
CVE-2024-0723 | Medium | 5.3 | 2024-01-19 | A vulnerability was found in freeSSHd 1.0.9 on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to denial o… |
CVE-2024-0722 | Low | 3.5 | 2024-01-19 | A vulnerability was found in code-projects Social Networking Site 1.0 and classified as problematic. Affected by this issue is some unknown functionality of th… |
CVE-2024-0721 | Low | 3.5 | 2024-01-19 | A vulnerability has been found in Jspxcms 10.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Sur… |
CVE-2024-0720 | Low | 3.5 | 2024-01-19 | A vulnerability, which was classified as problematic, was found in FactoMineR FactoInvestigate up to 1.9. Affected is an unknown function of the component HTML… |
CVE-2024-0718 | Low | 2.4 | 2024-01-19 | A vulnerability, which was classified as problematic, has been found in liuwy-dlsdys zhglxt 4.7.7. This issue affects some unknown processing of the file /oa/n… |
CVE-2024-0717 | Medium | 5.3 | 2024-01-19 | A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR… |
CVE-2024-22920 | High | 7.8 | 2024-01-19 | swftools 0.9.2 was discovered to contain a heap-use-after-free via the function bufferWriteData in swftools/lib/action/compile.c. |
CVE-2024-22563 | High | 7.5 | 2024-01-19 | openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c. |
CVE-2024-22562 | High | 7.8 | 2024-01-19 | swftools 0.9.2 was discovered to contain a Stack Buffer Underflow via the function dict_foreach_keyvalue at swftools/lib/q.c. |
CVE-2024-0716 | Low | 3.1 | 2024-01-19 | A vulnerability classified as problematic has been found in Byzoro Smart S150 Management Platform V31R02B15. This affects an unknown part of the file /log/down… |