2024 CVEs (page 380)
Page 380 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0408 | Medium | 5.5 | 2024-01-18 | A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues a… |
CVE-2024-22593 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/add_group_save |
CVE-2024-22592 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_update |
CVE-2024-22591 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_save. |
CVE-2024-22568 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/del. |
CVE-2024-22549 | Medium | 5.4 | 2024-01-18 | FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section. |
CVE-2024-22548 | Medium | 5.4 | 2024-01-18 | FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the system website settings website name section. |
CVE-2024-22317 | Critical | 9.1 | 2024-01-18 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to obtain sensitive information or cause a d… |
CVE-2024-0669 | Medium | 6.3 | 2024-01-18 | A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an ad… |
CVE-2024-0580 | Medium | 6.5 | 2024-01-18 | Omission of user-controlled key authorization in the IDMSistemas platform, affecting the QSige product. This vulnerability allows an attacker to extract sensit… |
CVE-2024-0381 | Medium | 6.4 | 2024-01-18 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-d… |
CVE-2024-0655 | Medium | 5.5 | 2024-01-18 | A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /nove… |
CVE-2024-0654 | Medium | 5.3 | 2024-01-18 | A vulnerability, which was classified as problematic, was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. Affected is an unknown function of the fil… |
CVE-2024-0652 | Low | 3.5 | 2024-01-18 | A vulnerability was found in PHPGurukul Company Visitor Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functio… |
CVE-2024-0651 | Medium | 6.3 | 2024-01-18 | A vulnerability was found in PHPGurukul Company Visitor Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown f… |
CVE-2024-23525 | Medium | 6.5 | 2024-01-18 | The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig. |
CVE-2024-22416 | Critical | 9.6 | 2024-01-18 | pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session… |
CVE-2024-0650 | Medium | 4.3 | 2024-01-18 | A vulnerability was found in Project Worlds Visitor Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file d… |
CVE-2024-0649 | Medium | 6.3 | 2024-01-17 | A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical. This issue affects the function download_network_image of the file /app/Http/Co… |
CVE-2024-0648 | High | 7.3 | 2024-01-17 | A vulnerability has been found in Yunyou CMS up to 2.2.6 and classified as critical. This vulnerability affects unknown code of the file /app/index/controller/… |
CVE-2024-22414 | Medium | 6.5 | 2024-01-17 | flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the `/user/<user>` page allows a user's comments to execute arbitrary javasc… |
CVE-2024-22410 | Low | 3.3 | 2024-01-17 | Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsof… |
CVE-2024-0647 | Medium | 4.3 | 2024-01-17 | A vulnerability, which was classified as problematic, was found in Sparksuite SimpleMDE up to 1.11.2. This affects an unknown part of the component iFrame Hand… |
CVE-2024-22715 | High | 8.8 | 2024-01-17 | Stupid Simple CMS <=1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin-edit.php. |
CVE-2024-22714 | Medium | 6.1 | 2024-01-17 | Stupid Simple CMS <=1.2.4 is vulnerable to Cross Site Scripting (XSS) in the editing section of the article content. |
CVE-2024-20287 | Medium | 6.5 | 2024-01-17 | A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point Setup could allow an aut… |
CVE-2024-20277 | Medium | 6.8 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated… |
CVE-2024-20272 | High | 7.3 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an… |
CVE-2024-20270 | Medium | 4.8 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could al… |
CVE-2024-20251 | Medium | 4.8 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to perform a stored… |
CVE-2024-0646 | High | 7.0 | 2024-01-17 | An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls soc… |
CVE-2024-0641 | Medium | 5.5 | 2024-01-17 | A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with l… |
CVE-2024-0639 | Medium | 5.5 | 2024-01-17 | A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw all… |
CVE-2024-0396 | High | 7.1 | 2024-01-17 | In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue… |
CVE-2024-0645 | High | 7.3 | 2024-01-17 | Buffer overflow vulnerability in Explorer++ affecting version 1.3.5.531. A local attacker could execute arbitrary code via a long filename argument by monitori… |
CVE-2024-0643 | Critical | 10.0 | 2024-01-17 | Unrestricted upload of dangerous file types in the C21 Live Encoder and Live Mosaic product, version 5.3. This vulnerability allows a remote attacker to upload… |
CVE-2024-0642 | Critical | 9.8 | 2024-01-17 | Inadequate access control in the C21 Live Encoder and Live Mosaic product, version 5.3. This vulnerability allows a remote attacker to access the application a… |
CVE-2024-0405 | High | 7.2 | 2024-01-17 | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON para… |
CVE-2024-22409 | High | 7.5 | 2024-01-16 | DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile… |
CVE-2024-22408 | High | 7.6 | 2024-01-16 | Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL use… |
CVE-2024-22407 | Medium | 4.9 | 2024-01-16 | Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions… |
CVE-2024-22406 | Critical | 9.3 | 2024-01-16 | Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information… |
CVE-2024-22916 | Critical | 9.8 | 2024-01-16 | In D-LINK Go-RT-AC750 v101b03, the sprintf function in the sub_40E700 function within the cgibin is susceptible to stack overflow. |
CVE-2024-22411 | Medium | 6.5 | 2024-01-16 | Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseA… |
CVE-2024-22192 | Medium | 6.5 | 2024-01-16 | Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could im… |
CVE-2024-22191 | High | 7.3 | 2024-01-16 | Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3… |
CVE-2024-21670 | Medium | 6.5 | 2024-01-16 | Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could im… |
CVE-2024-20987 | Medium | 5.4 | 2024-01-16 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). The supported version that is affected is 12.2.1.4.0. Easily ex… |
CVE-2024-20985 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and p… |
CVE-2024-20983 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploita… |
CVE-2024-20981 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and p… |
CVE-2024-20979 | Medium | 5.4 | 2024-01-16 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 6.4.0.0.0, 7.0.0.0.0 an… |
CVE-2024-20977 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20975 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.2.0 and prior. Easily exp… |
CVE-2024-20973 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20971 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20969 | Medium | 5.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and p… |
CVE-2024-20967 | Medium | 5.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.35 and prior and 8.2… |
CVE-2024-20965 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20963 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.35 and prior… |
CVE-2024-20961 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20959 | Medium | 4.4 | 2024-01-16 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily expl… |
CVE-2024-20957 | Low | 2.7 | 2024-01-16 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are Prio… |
CVE-2024-20955 | Low | 3.7 | 2024-01-16 | Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are af… |
CVE-2024-20952 | High | 7.4 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2024-20950 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected… |
CVE-2024-20948 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin). Supported versions that are affected are 12.2.3… |
CVE-2024-20946 | Medium | 5.5 | 2024-01-16 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabi… |
CVE-2024-20944 | Medium | 5.4 | 2024-01-16 | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2024-20942 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle Supply Chain (component: LOV). Supported versions that are affected ar… |
CVE-2024-20940 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Create, Update, Authoring Flow). Supported versions that are a… |
CVE-2024-20938 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: ECC). Supported versions that are affected are 12.2.3-12.2.13. Easily exploi… |
CVE-2024-20936 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-… |
CVE-2024-20934 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). Supported versions that are affected are… |
CVE-2024-20932 | High | 7.5 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2024-20930 | Medium | 6.3 | 2024-01-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Content Access SDK, Image Export SDK, PDF Export SDK, HTML Ex… |
CVE-2024-20928 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 12.2… |
CVE-2024-20926 | Medium | 5.9 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported ver… |
CVE-2024-20924 | High | 7.6 | 2024-01-16 | Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Difficult to exploit vuln… |
CVE-2024-20922 | Low | 2.5 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are… |
CVE-2024-20920 | Low | 3.8 | 2024-01-16 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Easily exploitable vulne… |
CVE-2024-20918 | High | 7.4 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-20916 | High | 8.3 | 2024-01-16 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). The supported version that i… |
CVE-2024-20914 | Low | 2.3 | 2024-01-16 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily expl… |
CVE-2024-20912 | Low | 2.7 | 2024-01-16 | Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Easily exploitable vulner… |
CVE-2024-20910 | Low | 3.0 | 2024-01-16 | Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Difficult to exploit vuln… |
CVE-2024-20908 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). The supported version that is affected is 12.2.1.4… |
CVE-2024-20906 | Medium | 4.8 | 2024-01-16 | Vulnerability in the Integrated Lights Out Manager (ILOM) product of Oracle Systems (component: System Management). Supported versions that are affected are 3… |
CVE-2024-20904 | Medium | 5.0 | 2024-01-16 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin). Supported versions that are affected… |
CVE-2024-0603 | High | 7.3 | 2024-01-16 | A vulnerability classified as critical has been found in ZhiCms up to 4.0. This affects an unknown part of the file app/plug/controller/giftcontroller.php. The… |
CVE-2024-0601 | Medium | 6.3 | 2024-01-16 | A vulnerability was found in ZhongFuCheng3y Austin 1.0. It has been rated as critical. Affected by this issue is the function getRemoteUrl2File of the file src… |
CVE-2024-0519 | High | 8.8 | 2024-01-16 | Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2024-0518 | High | 8.8 | 2024-01-16 | Type confusion in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2024-0517 | High | 8.8 | 2024-01-16 | Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2024-0599 | Low | 3.5 | 2024-01-16 | A vulnerability was found in Jspxcms 10.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file src\ma… |
CVE-2024-22491 | Medium | 5.4 | 2024-01-16 | A Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parameter. |
CVE-2024-0507 | Medium | 6.5 | 2024-01-16 | An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Ma… |
CVE-2024-0200 | High | 7.2 | 2024-01-16 | An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the exe… |
CVE-2024-23347 | High | 7.8 | 2024-01-16 | Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those… |
CVE-2024-22628 | High | 7.2 | 2024-01-16 | Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expense_budget/admin/?page=reports/budget&date_start=2023-12-28&date_end= |