2024 CVEs (page 385)
Page 385 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0261 | Medium | 5.3 | 2024-01-07 | A vulnerability has been found in Sentex FTPDMIN 0.96 and classified as problematic. Affected by this vulnerability is an unknown functionality of the componen… |
CVE-2024-0260 | Medium | 4.3 | 2024-01-07 | A vulnerability, which was classified as problematic, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file chan… |
CVE-2024-21642 | High | 7.5 | 2024-01-05 | D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF… |
CVE-2024-21641 | Medium | 6.5 | 2024-01-05 | Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third part… |
CVE-2024-0247 | High | 7.3 | 2024-01-05 | A vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /admin/ of t… |
CVE-2024-0246 | Medium | 4.3 | 2024-01-05 | A vulnerability classified as problematic has been found in IceWarp 12.0.2.1/12.0.3.1. This affects an unknown part of the file /install/ of the component Util… |
CVE-2024-22088 | Critical | 9.8 | 2024-01-05 | Lotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h via a long URI, because realloc is mishandled. |
CVE-2024-22087 | Critical | 9.8 | 2024-01-05 | route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution. |
CVE-2024-22086 | Critical | 9.8 | 2024-01-05 | handle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to remote code execution. |
CVE-2024-22075 | Medium | 6.1 | 2024-01-05 | Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection. |
CVE-2024-22051 | Critical | 9.8 | 2024-01-04 | CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attack… |
CVE-2024-22050 | High | 7.5 | 2024-01-04 | Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via mal… |
CVE-2024-22049 | Medium | 5.3 | 2024-01-04 | httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename… |
CVE-2024-22048 | Medium | 6.1 | 2024-01-04 | govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's… |
CVE-2024-22047 | Low | 3.1 | 2024-01-04 | A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user. |
CVE-2024-0241 | High | 7.5 | 2024-01-04 | encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might ca… |
CVE-2024-21636 | Medium | 6.1 | 2024-01-04 | view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cro… |
CVE-2024-21625 | High | 8.8 | 2024-01-04 | SideQuest is a place to get virtual reality applications for Oculus Quest. The SideQuest desktop application uses deep links with a custom protocol (`sidequest… |
CVE-2024-0225 | High | 8.8 | 2024-01-04 | Use after free in WebGPU in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2024-0224 | High | 8.8 | 2024-01-04 | Use after free in WebAudio in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2024-0223 | High | 8.8 | 2024-01-04 | Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-0222 | High | 8.8 | 2024-01-04 | Use after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had compromised the renderer process to potentially exploit heap… |
CVE-2024-20809 | Medium | 4.0 | 2024-01-04 | Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access data. |
CVE-2024-20808 | Medium | 4.0 | 2024-01-04 | Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access data. |
CVE-2024-20807 | Low | 3.3 | 2024-01-04 | Implicit intent hijacking vulnerability in Samsung Email prior to version 6.1.90.16 allows local attacker to get sensitive information. |
CVE-2024-20806 | Medium | 6.2 | 2024-01-04 | Improper access control in Notification service prior to SMR Jan-2024 Release 1 allows local attacker to access notification data. |
CVE-2024-20805 | Low | 3.3 | 2024-01-04 | Path traversal vulnerability in ZipCompressor of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 12, and version 14.5.00.21 in Android 13 all… |
CVE-2024-20804 | Medium | 4.0 | 2024-01-04 | Path traversal vulnerability in FileUriConverter of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 12, and version 14.5.00.21 in Android 13… |
CVE-2024-20803 | Medium | 6.8 | 2024-01-04 | Improper authentication vulnerability in Bluetooth pairing process prior to SMR Jan-2024 Release 1 allows remote attackers to establish pairing process without… |
CVE-2024-20802 | Medium | 4.6 | 2024-01-04 | Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users' notification in a multi-user envir… |
CVE-2024-21634 | High | 7.5 | 2024-01-03 | Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for application… |
CVE-2024-21633 | High | 7.8 | 2024-01-03 | Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resourc… |
CVE-2024-21631 | Medium | 6.5 | 2024-01-03 | Vapor is an HTTP web framework for Swift. Prior to version 4.90.0, Vapor's `vapor_urlparser_parse` function uses `uint16_t` indexes when parsing a URI's compon… |
CVE-2024-21622 | Medium | 5.4 | 2024-01-03 | Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to… |
CVE-2024-0217 | Low | 3.3 | 2024-01-03 | A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memor… |
CVE-2024-21911 | Medium | 6.1 | 2024-01-03 | TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML int… |
CVE-2024-21910 | Medium | 6.1 | 2024-01-03 | TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or lin… |
CVE-2024-21909 | High | 7.5 | 2024-01-03 | PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by prov… |
CVE-2024-21908 | Medium | 6.1 | 2024-01-03 | TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML int… |
CVE-2024-21907 | High | 7.5 | 2024-01-03 | Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.Dese… |
CVE-2024-0201 | Medium | 5.4 | 2024-01-03 | The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_setti… |
CVE-2024-0211 | High | 7.8 | 2024-01-03 | DOCSIS dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file |
CVE-2024-0210 | High | 7.8 | 2024-01-03 | Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file |
CVE-2024-0209 | High | 7.8 | 2024-01-03 | IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file |
CVE-2024-0208 | High | 7.8 | 2024-01-03 | GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file |
CVE-2024-0207 | High | 7.8 | 2024-01-03 | HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file |
CVE-2024-21632 | High | 8.6 | 2024-01-02 | omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy… |
CVE-2024-21629 | Medium | 5.9 | 2024-01-02 | Rust EVM is an Ethereum Virtual Machine interpreter. In `rust-evm`, a feature called `record_external_operation` was introduced, allowing library users to reco… |
CVE-2024-21628 | Medium | 5.4 | 2024-01-02 | PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to stor… |
CVE-2024-0196 | Medium | 6.3 | 2024-01-02 | A vulnerability has been found in Magic-Api up to 2.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /res… |
CVE-2024-21627 | High | 8.1 | 2024-01-02 | PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Som… |
CVE-2024-21623 | Critical | 9.8 | 2024-01-02 | OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "`Analysis - SonarCloud`" wor… |
CVE-2024-0195 | Medium | 6.3 | 2024-01-02 | A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/j… |
CVE-2024-0194 | Medium | 6.3 | 2024-01-02 | A vulnerability, which was classified as critical, has been found in CodeAstro Internet Banking System up to 1.0. This issue affects some unknown processing of… |
CVE-2024-0192 | Medium | 6.3 | 2024-01-02 | A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-0191 | Medium | 5.3 | 2024-01-02 | A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /ad… |
CVE-2024-0190 | Low | 3.5 | 2024-01-02 | A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file a… |
CVE-2024-0193 | High | 7.8 | 2024-01-02 | A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, th… |
CVE-2024-0189 | Low | 3.5 | 2024-01-02 | A vulnerability has been found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-0188 | Low | 3.1 | 2024-01-02 | A vulnerability, which was classified as problematic, was found in RRJ Nueva Ecija Engineer Online Portal 1.0. This affects an unknown part of the file change_… |
CVE-2024-0186 | Low | 3.7 | 2024-01-02 | A vulnerability classified as problematic has been found in HuiRan Host Reseller System up to 2.0.0. Affected is an unknown function of the file /user/index/fi… |
CVE-2024-0185 | Medium | 4.7 | 2024-01-02 | A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2024-0184 | Low | 2.4 | 2024-01-02 | A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2024-0183 | Low | 2.4 | 2024-01-01 | A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. This affects an unknown part of the file /admin… |
CVE-2024-0182 | High | 7.3 | 2024-01-01 | A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-0181 | Low | 2.4 | 2024-01-01 | A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown func… |
CVE-2024-21732 | Medium | 6.1 | 2024-01-01 | FlyCms through abbaa5a allows XSS via the permission management feature. |