2024 CVEs (page 380)
Page 380 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0714 | Medium | 6.3 | 2024-01-19 | A vulnerability was found in MiczFlor RPi-Jukebox-RFID up to 2.5.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-22877 | Medium | 5.4 | 2024-01-19 | StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality. This feature allows an attacker to insert ma… |
CVE-2024-22876 | Medium | 5.4 | 2024-01-19 | StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which enables an attacker… |
CVE-2024-0712 | High | 7.3 | 2024-01-19 | A vulnerability was found in Byzoro Smart S150 Management Platform V31R02B15. It has been classified as critical. Affected is an unknown function of the file /… |
CVE-2024-21733 | Medium | 5.3 | 2024-01-19 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9… |
CVE-2024-0705 | Critical | 9.8 | 2024-01-19 | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.7… |
CVE-2024-23659 | Medium | 6.1 | 2024-01-19 | SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js. |
CVE-2024-23387 | Medium | 4.8 | 2024-01-19 | FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administr… |
CVE-2024-22424 | High | 8.3 | 2024-01-19 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable t… |
CVE-2024-22422 | High | 7.5 | 2024-01-19 | AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as references during chatting. In versio… |
CVE-2024-0696 | Low | 3.5 | 2024-01-18 | A vulnerability, which was classified as problematic, was found in AtroCore AtroPIM 1.8.4. This affects an unknown part of the file /#ProductSerie/view/ of the… |
CVE-2024-0695 | Medium | 4.3 | 2024-01-18 | A vulnerability, which was classified as problematic, has been found in EFS Easy Chat Server 3.1. Affected by this issue is some unknown functionality of the c… |
CVE-2024-0693 | Medium | 5.3 | 2024-01-18 | A vulnerability classified as problematic was found in EFS Easy File Sharing FTP 2.0. Affected by this vulnerability is an unknown functionality. The manipulat… |
CVE-2024-22418 | Medium | 6.5 | 2024-01-18 | Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group O… |
CVE-2024-22415 | High | 7.3 | 2024-01-18 | jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol… |
CVE-2024-22404 | Medium | 4.1 | 2024-01-18 | Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only"… |
CVE-2024-22402 | Medium | 5.4 | 2024-01-18 | Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page… |
CVE-2024-22401 | Medium | 4.1 | 2024-01-18 | Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of… |
CVE-2024-22403 | Low | 3.0 | 2024-01-18 | Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization… |
CVE-2024-22400 | Low | 3.1 | 2024-01-18 | Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up… |
CVE-2024-22213 | Unrated | | 2024-01-18 | Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users co… |
CVE-2024-22419 | High | 7.3 | 2024-01-18 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was all… |
CVE-2024-22212 | Critical | 9.6 | 2024-01-18 | Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the pa… |
CVE-2024-22819 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update. |
CVE-2024-22818 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerbility via /system/site/filterKeyword_save |
CVE-2024-22817 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte |
CVE-2024-22603 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/links/add_link |
CVE-2024-22601 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/scorerule_save |
CVE-2024-22699 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update_group_save. |
CVE-2024-0607 | Medium | 6.6 | 2024-01-18 | A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and… |
CVE-2024-0409 | High | 7.8 | 2024-01-18 | A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with… |
CVE-2024-0408 | Medium | 5.5 | 2024-01-18 | A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues a… |
CVE-2024-22593 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/add_group_save |
CVE-2024-22592 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_update |
CVE-2024-22591 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_save. |
CVE-2024-22568 | High | 8.8 | 2024-01-18 | FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/del. |
CVE-2024-22549 | Medium | 5.4 | 2024-01-18 | FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section. |
CVE-2024-22548 | Medium | 5.4 | 2024-01-18 | FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the system website settings website name section. |
CVE-2024-22317 | Critical | 9.1 | 2024-01-18 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to obtain sensitive information or cause a d… |
CVE-2024-0669 | Medium | 6.3 | 2024-01-18 | A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an ad… |
CVE-2024-0580 | Medium | 6.5 | 2024-01-18 | Omission of user-controlled key authorization in the IDMSistemas platform, affecting the QSige product. This vulnerability allows an attacker to extract sensit… |
CVE-2024-0381 | Medium | 6.4 | 2024-01-18 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-d… |
CVE-2024-0655 | Medium | 5.5 | 2024-01-18 | A vulnerability has been found in Novel-Plus 4.3.0-RC1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /nove… |
CVE-2024-0654 | Medium | 5.3 | 2024-01-18 | A vulnerability, which was classified as problematic, was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. Affected is an unknown function of the fil… |
CVE-2024-0652 | Low | 3.5 | 2024-01-18 | A vulnerability was found in PHPGurukul Company Visitor Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functio… |
CVE-2024-0651 | Medium | 6.3 | 2024-01-18 | A vulnerability was found in PHPGurukul Company Visitor Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown f… |
CVE-2024-23525 | Medium | 6.5 | 2024-01-18 | The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig. |
CVE-2024-22416 | Critical | 9.6 | 2024-01-18 | pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session… |
CVE-2024-0650 | Medium | 4.3 | 2024-01-18 | A vulnerability was found in Project Worlds Visitor Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file d… |
CVE-2024-0649 | Medium | 6.3 | 2024-01-17 | A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical. This issue affects the function download_network_image of the file /app/Http/Co… |
CVE-2024-0648 | High | 7.3 | 2024-01-17 | A vulnerability has been found in Yunyou CMS up to 2.2.6 and classified as critical. This vulnerability affects unknown code of the file /app/index/controller/… |
CVE-2024-22414 | Medium | 6.5 | 2024-01-17 | flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the `/user/<user>` page allows a user's comments to execute arbitrary javasc… |
CVE-2024-22410 | Low | 3.3 | 2024-01-17 | Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsof… |
CVE-2024-0647 | Medium | 4.3 | 2024-01-17 | A vulnerability, which was classified as problematic, was found in Sparksuite SimpleMDE up to 1.11.2. This affects an unknown part of the component iFrame Hand… |
CVE-2024-22715 | High | 8.8 | 2024-01-17 | Stupid Simple CMS <=1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin-edit.php. |
CVE-2024-22714 | Medium | 6.1 | 2024-01-17 | Stupid Simple CMS <=1.2.4 is vulnerable to Cross Site Scripting (XSS) in the editing section of the article content. |
CVE-2024-20287 | Medium | 6.5 | 2024-01-17 | A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point Setup could allow an aut… |
CVE-2024-20277 | Medium | 6.8 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated… |
CVE-2024-20272 | High | 7.3 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an… |
CVE-2024-20270 | Medium | 4.8 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could al… |
CVE-2024-20251 | Medium | 4.8 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to perform a stored… |
CVE-2024-0646 | High | 7.0 | 2024-01-17 | An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls soc… |
CVE-2024-0641 | Medium | 5.5 | 2024-01-17 | A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with l… |
CVE-2024-0639 | Medium | 5.5 | 2024-01-17 | A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw all… |
CVE-2024-0396 | High | 7.1 | 2024-01-17 | In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue… |
CVE-2024-0645 | High | 7.3 | 2024-01-17 | Buffer overflow vulnerability in Explorer++ affecting version 1.3.5.531. A local attacker could execute arbitrary code via a long filename argument by monitori… |
CVE-2024-0643 | Critical | 10.0 | 2024-01-17 | Unrestricted upload of dangerous file types in the C21 Live Encoder and Live Mosaic product, version 5.3. This vulnerability allows a remote attacker to upload… |
CVE-2024-0642 | Critical | 9.8 | 2024-01-17 | Inadequate access control in the C21 Live Encoder and Live Mosaic product, version 5.3. This vulnerability allows a remote attacker to access the application a… |
CVE-2024-0405 | High | 7.2 | 2024-01-17 | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON para… |
CVE-2024-22409 | High | 7.5 | 2024-01-16 | DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile… |
CVE-2024-22408 | High | 7.6 | 2024-01-16 | Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL use… |
CVE-2024-22407 | Medium | 4.9 | 2024-01-16 | Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions… |
CVE-2024-22406 | Critical | 9.3 | 2024-01-16 | Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information… |
CVE-2024-22916 | Critical | 9.8 | 2024-01-16 | In D-LINK Go-RT-AC750 v101b03, the sprintf function in the sub_40E700 function within the cgibin is susceptible to stack overflow. |
CVE-2024-22411 | Medium | 6.5 | 2024-01-16 | Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseA… |
CVE-2024-22192 | Medium | 6.5 | 2024-01-16 | Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could im… |
CVE-2024-22191 | High | 7.3 | 2024-01-16 | Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3… |
CVE-2024-21670 | Medium | 6.5 | 2024-01-16 | Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could im… |
CVE-2024-20987 | Medium | 5.4 | 2024-01-16 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). The supported version that is affected is 12.2.1.4.0. Easily ex… |
CVE-2024-20985 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and p… |
CVE-2024-20983 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploita… |
CVE-2024-20981 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and p… |
CVE-2024-20979 | Medium | 5.4 | 2024-01-16 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 6.4.0.0.0, 7.0.0.0.0 an… |
CVE-2024-20977 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20975 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.2.0 and prior. Easily exp… |
CVE-2024-20973 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20971 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20969 | Medium | 5.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and p… |
CVE-2024-20967 | Medium | 5.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.35 and prior and 8.2… |
CVE-2024-20965 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20963 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.35 and prior… |
CVE-2024-20961 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20959 | Medium | 4.4 | 2024-01-16 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily expl… |
CVE-2024-20957 | Low | 2.7 | 2024-01-16 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are Prio… |
CVE-2024-20955 | Low | 3.7 | 2024-01-16 | Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are af… |
CVE-2024-20952 | High | 7.4 | 2024-01-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2024-20950 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected… |
CVE-2024-20948 | Medium | 6.1 | 2024-01-16 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin). Supported versions that are affected are 12.2.3… |
CVE-2024-20946 | Medium | 5.5 | 2024-01-16 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabi… |
CVE-2024-20944 | Medium | 5.4 | 2024-01-16 | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |