2024 CVEs (page 91)
Page 91 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11799 | High | 7.8 | 2024-11-28 | Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attac… |
CVE-2024-11798 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT X1 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2024-11797 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2024-11796 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2024-11795 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex… |
CVE-2024-11794 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V10 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2024-11793 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2024-11792 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex… |
CVE-2024-11791 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V8C File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e… |
CVE-2024-11790 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e… |
CVE-2024-11789 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e… |
CVE-2024-11787 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e… |
CVE-2024-53860 | High | 8.6 | 2024-11-27 | sp-php-email-handler is a PHP package for handling contact form submissions. Messages sent using this script are vulnerable to abuse, as the script allows anyb… |
CVE-2024-53859 | Medium | 6.5 | 2024-11-27 | go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` th… |
CVE-2024-53858 | Medium | 6.5 | 2024-11-27 | The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cl… |
CVE-2024-53260 | Medium | 6.8 | 2024-11-27 | Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to include a valid exce… |
CVE-2024-53855 | Low | 1.9 | 2024-11-27 | Centurion ERP (Enterprise Rescource Planning) is a simple application developed to provide open source IT management with a large emphasis on the IT Service Ma… |
CVE-2024-53264 | | 2024-11-27 | bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attacker… | |
CVE-2024-47181 | High | 7.5 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can be triggered in the two RPL implementations of th… |
CVE-2024-41126 | High | 8.3 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a devi… |
CVE-2024-41125 | High | 8.3 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a devi… |
CVE-2024-9369 | Critical | 9.6 | 2024-11-27 | Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an o… |
CVE-2024-7025 | High | 8.8 | 2024-11-27 | Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2024-54004 | Medium | 4.3 | 2024-11-27 | Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with… |
CVE-2024-54003 | High | 8.0 | 2024-11-27 | Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by atta… |
CVE-2024-51228 | Medium | 6.8 | 2024-11-27 | An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX… |
CVE-2024-37816 | Medium | 4.2 | 2024-11-27 | Quectel EC25-EUX EC25EUXGAR08A05M1G was discovered to contain a stack overflow. |
CVE-2024-31976 | High | 8.0 | 2024-11-27 | EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remote attacker to execute arbitrary OS commands via the Controller connectivity parameter. |
CVE-2024-21703 | Medium | 6.4 | 2024-11-27 | This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. … |
CVE-2024-11860 | Medium | 6.5 | 2024-11-27 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects an unknown part of the file /rent… |
CVE-2024-53920 | High | 7.8 | 2024-11-27 | In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can… |
CVE-2024-52951 | High | 8.0 | 2024-11-27 | Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to execute arbitrary co… |
CVE-2024-46055 | Medium | 4.8 | 2024-11-27 | OpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in review names. |
CVE-2024-46054 | Critical | 9.8 | 2024-11-27 | OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upload files. |
CVE-2024-11862 | | 2024-11-27 | Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a… | |
CVE-2024-53635 | Medium | 4.8 | 2024-11-27 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /covid-tms/patient-search-report.php in PHPGurukul COVID 19 Testing Management System v1.0, w… |
CVE-2024-53604 | Critical | 9.8 | 2024-11-27 | A SQL Injection vulnerability was found in /covid-tms/check_availability.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attacke… |
CVE-2024-53603 | High | 7.3 | 2024-11-27 | A SQL Injection vulnerability was found in /covid-tms/password-recovery.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attacker… |
CVE-2024-36464 | Low | 2.7 | 2024-11-27 | When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. T… |
CVE-2024-42333 | Low | 2.7 | 2024-11-27 | The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c |
CVE-2024-42332 | Low | 3.7 | 2024-11-27 | The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have for… |
CVE-2024-42331 | Low | 3.3 | 2024-11-27 | In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequen… |
CVE-2024-42330 | Critical | 9.1 | 2024-11-27 | The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are create… |
CVE-2024-42329 | Low | 3.3 | 2024-11-27 | The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for… |
CVE-2024-42328 | Low | 3.3 | 2024-11-27 | When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiv… |
CVE-2024-42327 | Critical | 9.9 | 2024-11-27 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQL… |
CVE-2024-42326 | Medium | 4.4 | 2024-11-27 | There was discovered a use after free bug in browser.c in the es_browser_get_variant function |
CVE-2024-36468 | Low | 3.0 | 2024-11-27 | The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs whe… |
CVE-2024-11009 | Medium | 4.9 | 2024-11-27 | The Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘p… |
CVE-2024-11025 | Medium | 5.4 | 2024-11-27 | An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access… |
CVE-2024-10521 | Medium | 4.3 | 2024-11-27 | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is du… |
CVE-2024-52323 | High | 8.1 | 2024-11-27 | Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive t… |
CVE-2024-11667 | High | 7.5 | 2024-11-27 | A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware version… |
CVE-2024-36467 | High | 7.5 | 2024-11-27 | An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be… |
CVE-2024-10895 | Medium | 6.4 | 2024-11-27 | The Counter Up – Animated Number Counter & Milestone Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lgx-counter'… |
CVE-2024-10580 | Medium | 5.3 | 2024-11-27 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized form submissions due to a missing capability c… |
CVE-2024-10175 | Medium | 6.4 | 2024-11-27 | The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wdo_… |
CVE-2024-52959 | High | 7.2 | 2024-11-27 | A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 al… |
CVE-2024-52958 | High | 7.2 | 2024-11-27 | A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remo… |
CVE-2024-11219 | Medium | 5.3 | 2024-11-27 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all versions up to, and in… |
CVE-2024-11083 | Medium | 5.3 | 2024-11-27 | The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core sear… |
CVE-2024-5921 | High | 8.8 | 2024-11-27 | An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary serv… |
CVE-2024-53676 | Critical | 9.8 | 2024-11-27 | A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. |
CVE-2024-11820 | Low | 3.5 | 2024-11-27 | A vulnerability, which was classified as problematic, has been found in code-projects Crud Operation System 1.0. This issue affects some unknown processing of… |
CVE-2024-53849 | | 2024-11-27 | editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows… | |
CVE-2024-11819 | High | 7.3 | 2024-11-27 | A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /for… |
CVE-2024-11818 | High | 7.3 | 2024-11-27 | A vulnerability classified as critical has been found in PHPGurukul User Registration & Login and User Management System 1.0. This affects an unknown part of t… |
CVE-2024-11817 | High | 7.3 | 2024-11-26 | A vulnerability was found in PHPGurukul User Registration & Login and User Management System 1.0. It has been rated as critical. Affected by this issue is some… |
CVE-2024-53675 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53674 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53673 | High | 8.1 | 2024-11-26 | A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code. |
CVE-2024-11622 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-50942 | Critical | 9.8 | 2024-11-26 | qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml. |
CVE-2024-43784 | Medium | 5.7 | 2024-11-26 | lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have be… |
CVE-2024-11745 | High | 8.8 | 2024-11-26 | A vulnerability was found in Tenda AC8 16.03.34.09 and classified as critical. Affected by this issue is the function route_static_check of the file /goform/Se… |
CVE-2024-11744 | High | 7.3 | 2024-11-26 | A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2024-8676 | High | 7.4 | 2024-11-26 | A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that r… |
CVE-2024-49053 | High | 7.6 | 2024-11-26 | Microsoft Dynamics 365 Sales Spoofing Vulnerability |
CVE-2024-49052 | High | 8.2 | 2024-11-26 | Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network. |
CVE-2024-49038 | Critical | 9.3 | 2024-11-26 | Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privil… |
CVE-2024-49035 | High | 8.7 | 2024-11-26 | An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network. |
CVE-2024-11743 | Medium | 4.3 | 2024-11-26 | A vulnerability, which was classified as problematic, was found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of t… |
CVE-2024-11742 | Low | 3.5 | 2024-11-26 | A vulnerability, which was classified as problematic, has been found in SourceCodester Best House Rental Management System 1.0. This issue affects some unknown… |
CVE-2024-11145 | Critical | 9.8 | 2024-11-26 | Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privi… |
CVE-2024-10240 | Medium | 5.3 | 2024-11-26 | An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions… |
CVE-2024-8237 | Medium | 6.5 | 2024-11-26 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior… |
CVE-2024-8177 | Medium | 5.3 | 2024-11-26 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior… |
CVE-2024-8114 | High | 8.2 | 2024-11-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an a… |
CVE-2024-53844 | Medium | 6.3 | 2024-11-26 | E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. A path traversal vulnerability exists in the backup export funct… |
CVE-2024-53620 | Medium | 4.8 | 2024-11-26 | A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via inj… |
CVE-2024-53619 | Medium | 6.3 | 2024-11-26 | An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2024-53267 | Medium | 5.5 | 2024-11-26 | sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a valid… |
CVE-2024-52008 | High | 8.8 | 2024-11-26 | Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to… |
CVE-2024-32965 | High | 8.1 | 2024-11-26 | Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malic… |
CVE-2024-11828 | Medium | 4.3 | 2024-11-26 | A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1… |
CVE-2024-11669 | Medium | 6.5 | 2024-11-26 | An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints cou… |
CVE-2024-11668 | Medium | 4.2 | 2024-11-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connection… |
CVE-2024-51058 | Medium | 6.2 | 2024-11-26 | Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file s… |
CVE-2024-10878 | Medium | 6.1 | 2024-11-26 | The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_quer… |
CVE-2024-53555 | High | 8.8 | 2024-11-26 | A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV file. |