2024 CVEs (page 379)
Page 379 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23751 | Critical | 9.8 | 2024-01-22 | LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetri… |
CVE-2024-23750 | High | 8.8 | 2024-01-22 | MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen. |
CVE-2024-0776 | Low | 3.5 | 2024-01-22 | A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms 2.0. Affected by this issue is some unknown functionality of the com… |
CVE-2024-0774 | Medium | 5.3 | 2024-01-22 | A vulnerability was found in Any-Capture Any Sound Recorder 2.93. It has been declared as problematic. This vulnerability affects unknown code of the component… |
CVE-2024-0773 | Low | 3.5 | 2024-01-22 | A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-0772 | Medium | 5.3 | 2024-01-22 | A vulnerability was found in Nsasoft ShareAlarmPro 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the component R… |
CVE-2024-23744 | High | 7.5 | 2024-01-21 | An issue was discovered in Mbed TLS 3.5.1. There is persistent handshake denial if a client sends a TLS 1.3 ClientHello without extensions. |
CVE-2024-0771 | Medium | 5.3 | 2024-01-21 | A vulnerability has been found in Nsasoft Product Key Explorer 4.0.9 and classified as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2024-0770 | Medium | 4.4 | 2024-01-21 | A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file… |
CVE-2024-23732 | High | 7.5 | 2024-01-21 | The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py. |
CVE-2024-23731 | Critical | 9.8 | 2024-01-21 | The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument. |
CVE-2024-23730 | Critical | 9.8 | 2024-01-21 | The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_load is not used for YA… |
CVE-2024-0769 | Medium | 5.3 | 2024-01-21 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown func… |
CVE-2024-23726 | High | 8.8 | 2024-01-21 | Ubee DDW365 XCNDDW365 devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. A remote attacker (in proximity to a Wi-Fi netw… |
CVE-2024-23725 | Medium | 6.1 | 2024-01-21 | Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries. |
CVE-2024-0521 | High | 7.8 | 2024-01-20 | Code Injection in paddlepaddle/paddle |
CVE-2024-0679 | Medium | 6.5 | 2024-01-20 | The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() function in all version… |
CVE-2024-0623 | Medium | 4.3 | 2024-01-20 | The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing o… |
CVE-2024-23332 | Medium | 4.0 | 2024-01-19 | The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic co… |
CVE-2024-23688 | Medium | 5.3 | 2024-01-19 | Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's p… |
CVE-2024-23687 | Critical | 9.1 | 2024-01-19 | Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modi… |
CVE-2024-23686 | Medium | 5.3 | 2024-01-19 | DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to r… |
CVE-2024-0739 | High | 7.3 | 2024-01-19 | A vulnerability, which was classified as critical, was found in Hecheng Leadshop up to 1.4.20. Affected is an unknown function of the file /web/leadshop.php. T… |
CVE-2024-0738 | Medium | 6.3 | 2024-01-19 | A vulnerability, which was classified as critical, has been found in 个人开源 mldong 1.0. This issue affects the function ExpressionEngine of the file com/mldong/m… |
CVE-2024-0737 | Medium | 5.3 | 2024-01-19 | A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. This vulnerability affects unknown code of the component Login. The ma… |
CVE-2024-23689 | High | 8.8 | 2024-01-19 | Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions… |
CVE-2024-23685 | Medium | 5.3 | 2024-01-19 | Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storag… |
CVE-2024-23684 | High | 7.5 | 2024-01-19 | Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versi… |
CVE-2024-23683 | High | 8.2 | 2024-01-19 | Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException… |
CVE-2024-23682 | High | 8.2 | 2024-01-19 | Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An atta… |
CVE-2024-23681 | High | 8.2 | 2024-01-19 | Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.load… |
CVE-2024-23680 | Medium | 5.3 | 2024-01-19 | AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures. |
CVE-2024-23679 | Critical | 9.8 | 2024-01-19 | Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of… |
CVE-2024-22421 | High | 7.6 | 2024-01-19 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who cli… |
CVE-2024-22420 | Medium | 6.5 | 2024-01-19 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends… |
CVE-2024-0758 | Medium | 6.1 | 2024-01-19 | MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a victim browser via cr… |
CVE-2024-0736 | Medium | 5.3 | 2024-01-19 | A vulnerability classified as problematic has been found in EFS Easy File Sharing FTP 3.6. This affects an unknown part of the component Login. The manipulatio… |
CVE-2024-0735 | Medium | 6.3 | 2024-01-19 | A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. Affected by this issue is the function… |
CVE-2024-0734 | Medium | 6.3 | 2024-01-19 | A vulnerability was found in Smsot up to 2.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /get.ph… |
CVE-2024-0733 | Medium | 6.3 | 2024-01-19 | A vulnerability was found in Smsot up to 2.12. It has been classified as critical. Affected is an unknown function of the file /api.php of the component HTTP P… |
CVE-2024-23331 | High | 7.5 | 2024-01-19 | Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-au… |
CVE-2024-23329 | Low | 3.7 | 2024-01-19 | changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/histor… |
CVE-2024-22211 | Low | 3.7 | 2024-01-19 | FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_contex… |
CVE-2024-0732 | Medium | 5.3 | 2024-01-19 | A vulnerability was found in PCMan FTP Server 2.0.7 and classified as problematic. This issue affects some unknown processing of the component STOR Command Han… |
CVE-2024-0731 | Medium | 5.3 | 2024-01-19 | A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as problematic. This vulnerability affects unknown code of the component PUT Command Ha… |
CVE-2024-0730 | Medium | 6.3 | 2024-01-19 | A vulnerability, which was classified as critical, was found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file course… |
CVE-2024-0729 | Medium | 5.5 | 2024-01-19 | A vulnerability, which was classified as critical, has been found in ForU CMS up to 2020-06-23. Affected by this issue is some unknown functionality of the fil… |
CVE-2024-0728 | Medium | 4.7 | 2024-01-19 | A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channe… |
CVE-2024-22957 | Medium | 5.5 | 2024-01-19 | swftools 0.9.2 was discovered to contain an Out-of-bounds Read vulnerability via the function dict_do_lookup in swftools/lib/q.c:1190. |
CVE-2024-22956 | High | 7.8 | 2024-01-19 | swftools 0.9.2 was discovered to contain a heap-use-after-free vulnerability via the function removeFromTo at swftools/src/swfc.c:838 |
CVE-2024-22955 | High | 7.8 | 2024-01-19 | swftools 0.9.2 was discovered to contain a stack-buffer-underflow vulnerability via the function parseExpression at swftools/src/swfc.c:2576. |
CVE-2024-22919 | High | 7.8 | 2024-01-19 | swftools0.9.2 was discovered to contain a global-buffer-overflow vulnerability via the function parseExpression at swftools/src/swfc.c:2587. |
CVE-2024-22915 | High | 7.8 | 2024-01-19 | A heap-use-after-free was found in SWFTools v0.9.2, in the function swf_DeleteTag at rfxswf.c:1193. It allows an attacker to cause code execution. |
CVE-2024-22914 | Medium | 5.5 | 2024-01-19 | A heap-use-after-free was found in SWFTools v0.9.2, in the function input at lex.swf5.c:2620. It allows an attacker to cause denial of service. |
CVE-2024-22913 | High | 7.8 | 2024-01-19 | A heap-buffer-overflow was found in SWFTools v0.9.2, in the function swf5lex at lex.swf5.c:1321. It allows an attacker to cause code execution. |
CVE-2024-22912 | High | 7.8 | 2024-01-19 | A global-buffer-overflow was found in SWFTools v0.9.2, in the function countline at swf5compiler.flex:327. It allows an attacker to cause code execution. |
CVE-2024-22911 | High | 7.8 | 2024-01-19 | A stack-buffer-underflow vulnerability was found in SWFTools v0.9.2, in the function parseExpression at src/swfc.c:2602. |
CVE-2024-0726 | Medium | 4.3 | 2024-01-19 | A vulnerability was found in Project Worlds Student Project Allocation System 1.0. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2024-0725 | Medium | 5.3 | 2024-01-19 | A vulnerability was found in ProSSHD 1.2 on Windows. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to de… |
CVE-2024-0723 | Medium | 5.3 | 2024-01-19 | A vulnerability was found in freeSSHd 1.0.9 on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to denial o… |
CVE-2024-0722 | Low | 3.5 | 2024-01-19 | A vulnerability was found in code-projects Social Networking Site 1.0 and classified as problematic. Affected by this issue is some unknown functionality of th… |
CVE-2024-0721 | Low | 3.5 | 2024-01-19 | A vulnerability has been found in Jspxcms 10.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Sur… |
CVE-2024-0720 | Low | 3.5 | 2024-01-19 | A vulnerability, which was classified as problematic, was found in FactoMineR FactoInvestigate up to 1.9. Affected is an unknown function of the component HTML… |
CVE-2024-0718 | Low | 2.4 | 2024-01-19 | A vulnerability, which was classified as problematic, has been found in liuwy-dlsdys zhglxt 4.7.7. This issue affects some unknown processing of the file /oa/n… |
CVE-2024-0717 | Medium | 5.3 | 2024-01-19 | A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR… |
CVE-2024-22920 | High | 7.8 | 2024-01-19 | swftools 0.9.2 was discovered to contain a heap-use-after-free via the function bufferWriteData in swftools/lib/action/compile.c. |
CVE-2024-22563 | High | 7.5 | 2024-01-19 | openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c. |
CVE-2024-22562 | High | 7.8 | 2024-01-19 | swftools 0.9.2 was discovered to contain a Stack Buffer Underflow via the function dict_foreach_keyvalue at swftools/lib/q.c. |
CVE-2024-0716 | Low | 3.1 | 2024-01-19 | A vulnerability classified as problematic has been found in Byzoro Smart S150 Management Platform V31R02B15. This affects an unknown part of the file /log/down… |
CVE-2024-0714 | Medium | 6.3 | 2024-01-19 | A vulnerability was found in MiczFlor RPi-Jukebox-RFID up to 2.5.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-22877 | Medium | 5.4 | 2024-01-19 | StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality. This feature allows an attacker to insert ma… |
CVE-2024-22876 | Medium | 5.4 | 2024-01-19 | StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which enables an attacker… |
CVE-2024-0712 | High | 7.3 | 2024-01-19 | A vulnerability was found in Byzoro Smart S150 Management Platform V31R02B15. It has been classified as critical. Affected is an unknown function of the file /… |
CVE-2024-21733 | Medium | 5.3 | 2024-01-19 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9… |
CVE-2024-0705 | Critical | 9.8 | 2024-01-19 | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.7… |
CVE-2024-23659 | Medium | 6.1 | 2024-01-19 | SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js. |
CVE-2024-23387 | Medium | 4.8 | 2024-01-19 | FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administr… |
CVE-2024-22424 | High | 8.3 | 2024-01-19 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable t… |
CVE-2024-22422 | High | 7.5 | 2024-01-19 | AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as references during chatting. In versio… |
CVE-2024-0696 | Low | 3.5 | 2024-01-18 | A vulnerability, which was classified as problematic, was found in AtroCore AtroPIM 1.8.4. This affects an unknown part of the file /#ProductSerie/view/ of the… |
CVE-2024-0695 | Medium | 4.3 | 2024-01-18 | A vulnerability, which was classified as problematic, has been found in EFS Easy Chat Server 3.1. Affected by this issue is some unknown functionality of the c… |
CVE-2024-0693 | Medium | 5.3 | 2024-01-18 | A vulnerability classified as problematic was found in EFS Easy File Sharing FTP 2.0. Affected by this vulnerability is an unknown functionality. The manipulat… |
CVE-2024-22418 | Medium | 6.5 | 2024-01-18 | Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group O… |
CVE-2024-22415 | High | 7.3 | 2024-01-18 | jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol… |
CVE-2024-22404 | Medium | 4.1 | 2024-01-18 | Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only"… |
CVE-2024-22402 | Medium | 5.4 | 2024-01-18 | Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page… |
CVE-2024-22401 | Medium | 4.1 | 2024-01-18 | Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of… |
CVE-2024-22403 | Low | 3.0 | 2024-01-18 | Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization… |
CVE-2024-22400 | Low | 3.1 | 2024-01-18 | Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up… |
CVE-2024-22213 | Unrated | | 2024-01-18 | Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users co… |
CVE-2024-22419 | High | 7.3 | 2024-01-18 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was all… |
CVE-2024-22212 | Critical | 9.6 | 2024-01-18 | Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the pa… |
CVE-2024-22819 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update. |
CVE-2024-22818 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerbility via /system/site/filterKeyword_save |
CVE-2024-22817 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte |
CVE-2024-22603 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/links/add_link |
CVE-2024-22601 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/scorerule_save |
CVE-2024-22699 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update_group_save. |
CVE-2024-0607 | Medium | 6.6 | 2024-01-18 | A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and… |
CVE-2024-0409 | High | 7.8 | 2024-01-18 | A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with… |