2024 CVEs (page 84)
Page 84 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38920 | Critical | 9.1 | 2024-12-05 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38910 | High | 7.5 | 2024-12-05 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a use-after-free in the nav2_amcl process. This vulnerability… |
CVE-2024-37863 | Critical | 9.8 | 2024-12-05 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process. This vulnerabi… |
CVE-2024-37862 | High | 7.3 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotic Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker to execute… |
CVE-2024-37861 | Critical | 9.8 | 2024-12-05 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process. This vulnerabi… |
CVE-2024-37860 | High | 7.3 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker to execute arbitrar… |
CVE-2024-30964 | High | 7.8 | 2024-12-05 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker… |
CVE-2024-30963 | High | 7.8 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to ex… |
CVE-2024-30962 | High | 7.8 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to ex… |
CVE-2024-30961 | High | 7.8 | 2024-12-05 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker… |
CVE-2024-54140 | | 2024-12-05 | sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundl… | |
CVE-2024-53457 | Medium | 5.4 | 2024-12-05 | A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scri… |
CVE-2024-53523 | High | 7.5 | 2024-12-05 | JSFinder commit d70ab9bc5221e016c08cffaf0d9ac79646c90645 is vulnerable to Directory Traversal in the find_by_file function. |
CVE-2024-53589 | High | 8.4 | 2024-12-05 | GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files. |
CVE-2024-53442 | Critical | 9.8 | 2024-12-05 | whapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component. |
CVE-2024-41579 | Critical | 9.8 | 2024-12-05 | DTStack Taier 1.4.0 allows remote attackers to specify the jobName parameter in the console listNames function to cause a SQL injection vulnerability |
CVE-2024-11148 | High | 7.5 | 2024-12-05 | In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request. |
CVE-2024-10933 | Medium | 5.0 | 2024-12-05 | In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untru… |
CVE-2024-12235 | Medium | 6.3 | 2024-12-05 | A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected by this vulnerabil… |
CVE-2024-12130 | High | 7.8 | 2024-12-05 | An “out of bounds read” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force t… |
CVE-2024-11158 | Medium | 6.7 | 2024-12-05 | An “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and f… |
CVE-2024-11156 | High | 7.8 | 2024-12-05 | An “out of bounds write” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundari… |
CVE-2024-11155 | High | 7.8 | 2024-12-05 | A “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the sof… |
CVE-2024-54128 | Medium | 5.7 | 2024-12-05 | Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding rest… |
CVE-2024-53846 | Medium | 5.5 | 2024-12-05 | OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of desig… |
CVE-2024-53490 | High | 7.5 | 2024-12-05 | Favorites-web 1.3.0 favorites-web has a directory traversal vulnerability in SecurityFilter.java. |
CVE-2024-12234 | High | 7.3 | 2024-12-05 | A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been classified as critical. Affected is an unknown function of the fil… |
CVE-2024-12233 | High | 7.3 | 2024-12-05 | A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processing of the file /re… |
CVE-2024-54130 | | 2024-12-05 | The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A segmentation fault occurs with ION-DTN BP… | |
CVE-2024-54129 | | 2024-12-05 | The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A vulnerability exists in the version ION-D… | |
CVE-2024-54001 | Medium | 5.5 | 2024-12-05 | Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fiel… |
CVE-2024-53857 | High | 7.5 | 2024-12-05 | rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing craft… |
CVE-2024-53856 | High | 7.5 | 2024-12-05 | rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability i… |
CVE-2024-53472 | High | 8.8 | 2024-12-05 | WeGIA v3.2.0 was discovered to contain a Cross-Site Request Forgery (CSRF). |
CVE-2024-53471 | Medium | 6.1 | 2024-12-05 | Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/meio_pagamento.php of WeGIA v3.2.0 allows attackers to execute arbitr… |
CVE-2024-53470 | Medium | 6.1 | 2024-12-05 | Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/gateway_pagamento.php of WeGIA v3.2.0 allows attackers to execute arb… |
CVE-2024-12247 | Medium | 4.6 | 2024-12-05 | Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a… |
CVE-2024-12232 | Low | 3.5 | 2024-12-05 | A vulnerability has been found in code-projects Simple CRUD Functionality 1.0 and classified as problematic. This vulnerability affects unknown code of the fil… |
CVE-2024-12231 | High | 7.3 | 2024-12-05 | A vulnerability, which was classified as critical, was found in CodeZips Project Management System 1.0. This affects an unknown part of the file /index.php. Th… |
CVE-2024-10716 | Medium | 5.9 | 2024-12-05 | Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search. |
CVE-2024-12230 | High | 7.3 | 2024-12-05 | A vulnerability, which was classified as critical, has been found in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functio… |
CVE-2024-12229 | High | 7.3 | 2024-12-05 | A vulnerability classified as critical was found in PHPGurukul Complaint Management System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-11942 | Medium | 5.9 | 2024-12-05 | A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10. |
CVE-2024-11941 | High | 7.5 | 2024-12-05 | A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8. |
CVE-2024-54679 | Medium | 4.3 | 2024-12-05 | CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. |
CVE-2024-53703 | High | 8.1 | 2024-12-05 | A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote at… |
CVE-2024-53702 | Medium | 5.3 | 2024-12-05 | Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases… |
CVE-2024-52271 | | 2024-12-05 | User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flat… | |
CVE-2024-45319 | Medium | 6.3 | 2024-12-05 | A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certifi… |
CVE-2024-45318 | High | 8.1 | 2024-12-05 | A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potentially lead to co… |
CVE-2024-40763 | High | 7.5 | 2024-12-05 | Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-base… |
CVE-2024-12228 | High | 7.3 | 2024-12-05 | A vulnerability classified as critical has been found in PHPGurukul Complaint Management System 1.0. Affected is an unknown function of the file /admin/user-se… |
CVE-2024-12227 | Medium | 5.5 | 2024-12-05 | A vulnerability, which was classified as problematic, was found in MSI Dragon Center up to 2.0.146.0. This affects the function MmUnMapIoSpace in the library N… |
CVE-2024-6784 | Critical | 9.9 | 2024-12-05 | Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure. Affec… |
CVE-2024-6516 | Critical | 9.0 | 2024-12-05 | Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser. Affected products: ABB AS… |
CVE-2024-6515 | Critical | 9.6 | 2024-12-05 | Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails e… |
CVE-2024-54127 | | 2024-12-05 | This vulnerability exists in the TP-Link Archer C50 due to presence of terminal access on a serial interface without proper access control. An attacker with ph… | |
CVE-2024-54126 | | 2024-12-05 | This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An a… | |
CVE-2024-51555 | Critical | 10.0 | 2024-12-05 | Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the install… |
CVE-2024-51554 | Critical | 9.1 | 2024-12-05 | Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPE… |
CVE-2024-51551 | Critical | 10.0 | 2024-12-05 | Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPE… |
CVE-2024-51550 | Critical | 10.0 | 2024-12-05 | Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device. Affected products: … |
CVE-2024-51549 | Critical | 10.0 | 2024-12-05 | Absolute File Traversal vulnerabilities allows access and modification of un-intended resources. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXU… |
CVE-2024-51548 | Critical | 9.9 | 2024-12-05 | Dangerous File Upload vulnerabilities allow upload of malicious scripts. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRI… |
CVE-2024-51546 | High | 7.5 | 2024-12-05 | Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series… |
CVE-2024-51545 | Critical | 10.0 | 2024-12-05 | Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. Affected products: ABB ASPECT - Ente… |
CVE-2024-51544 | High | 8.2 | 2024-12-05 | Service Control vulnerabilities allow access to service restart requests and vm configuration settings. Affected products: ABB ASPECT - Enterprise v3.08.02… |
CVE-2024-51543 | High | 8.2 | 2024-12-05 | Information Disclosure vulnerabilities allow access to application configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Se… |
CVE-2024-51542 | High | 8.2 | 2024-12-05 | Configuration Download vulnerabilities allow access to dependency configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Ser… |
CVE-2024-51541 | High | 8.2 | 2024-12-05 | Local File Inclusion vulnerabilities allow access to sensitive system information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08… |
CVE-2024-48847 | High | 8.2 | 2024-12-05 | MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. Affect… |
CVE-2024-48846 | High | 7.1 | 2024-12-05 | Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. Affected product… |
CVE-2024-48845 | Critical | 9.4 | 2024-12-05 | Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/appli… |
CVE-2024-48844 | High | 7.7 | 2024-12-05 | Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; N… |
CVE-2024-48843 | High | 7.7 | 2024-12-05 | Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; N… |
CVE-2024-48840 | Critical | 10.0 | 2024-12-05 | Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series… |
CVE-2024-48839 | Critical | 10.0 | 2024-12-05 | Improper Input Validation vulnerability allows Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX S… |
CVE-2024-12094 | | 2024-12-05 | This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical a… | |
CVE-2024-11317 | Critical | 10.0 | 2024-12-05 | Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. … |
CVE-2024-11316 | High | 7.5 | 2024-12-05 | Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products: ABB ASPECT - Enterprise v3.08.02… |
CVE-2024-52270 | | 2024-12-05 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show… | |
CVE-2024-52564 | High | 7.5 | 2024-12-05 | Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier. A remote… |
CVE-2024-47133 | High | 7.2 | 2024-12-05 | UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier allow a remote authenticated attacker with an administrative account to exec… |
CVE-2024-45841 | Medium | 6.5 | 2024-12-05 | Incorrect permission assignment for critical resource issue exists in UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier. If an… |
CVE-2024-11779 | Medium | 6.4 | 2024-12-05 | The WIP WooCarousel Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wip_woocarousel_products_carousel' shortcode in al… |
CVE-2024-11420 | Medium | 6.4 | 2024-12-05 | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Info Block link parameter in all versions up to, and including, 2… |
CVE-2024-11341 | Medium | 4.3 | 2024-12-05 | The Simple Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or in… |
CVE-2024-11324 | Medium | 6.1 | 2024-12-05 | The Accounting for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapin… |
CVE-2024-10848 | Medium | 6.4 | 2024-12-05 | The NewsMunch theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 1.0.35 due to… |
CVE-2024-10777 | Medium | 4.3 | 2024-12-05 | The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' short… |
CVE-2024-10056 | Medium | 6.4 | 2024-12-05 | The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's livesite-pay shortcode in all versions up… |
CVE-2024-10937 | Medium | 5.3 | 2024-12-05 | The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Sensitive Information E… |
CVE-2024-11429 | High | 8.8 | 2024-12-05 | The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion in… |
CVE-2024-42195 | Low | 3.1 | 2024-12-05 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2024-10178 | Medium | 6.4 | 2024-12-05 | The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdow… |
CVE-2024-10881 | Medium | 6.4 | 2024-12-05 | The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lunaradio' shortcode in versions up to, and including, 6.24.11… |
CVE-2024-54014 | Low | 3.6 | 2024-12-05 | Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allo… |
CVE-2024-12188 | High | 7.3 | 2024-12-05 | A vulnerability was found in 1000 Projects Library Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functi… |
CVE-2024-12187 | High | 7.3 | 2024-12-05 | A vulnerability was found in 1000 Projects Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /show… |
CVE-2024-54221 | Critical | 9.3 | 2024-12-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking.This is… |