2024 CVEs (page 91)
Page 91 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46055 | Medium | 4.8 | 2024-11-27 | OpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in review names. |
CVE-2024-46054 | Critical | 9.8 | 2024-11-27 | OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upload files. |
CVE-2024-11862 | | 2024-11-27 | Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a… | |
CVE-2024-53635 | Medium | 4.8 | 2024-11-27 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /covid-tms/patient-search-report.php in PHPGurukul COVID 19 Testing Management System v1.0, w… |
CVE-2024-53604 | Critical | 9.8 | 2024-11-27 | A SQL Injection vulnerability was found in /covid-tms/check_availability.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attacke… |
CVE-2024-53603 | High | 7.3 | 2024-11-27 | A SQL Injection vulnerability was found in /covid-tms/password-recovery.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attacker… |
CVE-2024-36464 | Low | 2.7 | 2024-11-27 | When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. T… |
CVE-2024-42333 | Low | 2.7 | 2024-11-27 | The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c |
CVE-2024-42332 | Low | 3.7 | 2024-11-27 | The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have for… |
CVE-2024-42331 | Low | 3.3 | 2024-11-27 | In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequen… |
CVE-2024-42330 | Critical | 9.1 | 2024-11-27 | The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are create… |
CVE-2024-42329 | Low | 3.3 | 2024-11-27 | The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for… |
CVE-2024-42328 | Low | 3.3 | 2024-11-27 | When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiv… |
CVE-2024-42327 | Critical | 9.9 | 2024-11-27 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQL… |
CVE-2024-42326 | Medium | 4.4 | 2024-11-27 | There was discovered a use after free bug in browser.c in the es_browser_get_variant function |
CVE-2024-36468 | Low | 3.0 | 2024-11-27 | The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs whe… |
CVE-2024-11009 | Medium | 4.9 | 2024-11-27 | The Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘p… |
CVE-2024-11025 | Medium | 5.4 | 2024-11-27 | An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access… |
CVE-2024-10521 | Medium | 4.3 | 2024-11-27 | The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is du… |
CVE-2024-52323 | High | 8.1 | 2024-11-27 | Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive t… |
CVE-2024-11667 | High | 7.5 | 2024-11-27 | A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware version… |
CVE-2024-36467 | High | 7.5 | 2024-11-27 | An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be… |
CVE-2024-10895 | Medium | 6.4 | 2024-11-27 | The Counter Up – Animated Number Counter & Milestone Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lgx-counter'… |
CVE-2024-10580 | Medium | 5.3 | 2024-11-27 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized form submissions due to a missing capability c… |
CVE-2024-10175 | Medium | 6.4 | 2024-11-27 | The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wdo_… |
CVE-2024-52959 | High | 7.2 | 2024-11-27 | A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 al… |
CVE-2024-52958 | High | 7.2 | 2024-11-27 | A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remo… |
CVE-2024-11219 | Medium | 5.3 | 2024-11-27 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all versions up to, and in… |
CVE-2024-11083 | Medium | 5.3 | 2024-11-27 | The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core sear… |
CVE-2024-5921 | High | 8.8 | 2024-11-27 | An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary serv… |
CVE-2024-53676 | Critical | 9.8 | 2024-11-27 | A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. |
CVE-2024-11820 | Low | 3.5 | 2024-11-27 | A vulnerability, which was classified as problematic, has been found in code-projects Crud Operation System 1.0. This issue affects some unknown processing of… |
CVE-2024-53849 | | 2024-11-27 | editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows… | |
CVE-2024-11819 | High | 7.3 | 2024-11-27 | A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /for… |
CVE-2024-11818 | High | 7.3 | 2024-11-27 | A vulnerability classified as critical has been found in PHPGurukul User Registration & Login and User Management System 1.0. This affects an unknown part of t… |
CVE-2024-11817 | High | 7.3 | 2024-11-26 | A vulnerability was found in PHPGurukul User Registration & Login and User Management System 1.0. It has been rated as critical. Affected by this issue is some… |
CVE-2024-53675 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53674 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53673 | High | 8.1 | 2024-11-26 | A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code. |
CVE-2024-11622 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-50942 | Critical | 9.8 | 2024-11-26 | qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml. |
CVE-2024-43784 | Medium | 5.7 | 2024-11-26 | lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have be… |
CVE-2024-11745 | High | 8.8 | 2024-11-26 | A vulnerability was found in Tenda AC8 16.03.34.09 and classified as critical. Affected by this issue is the function route_static_check of the file /goform/Se… |
CVE-2024-11744 | High | 7.3 | 2024-11-26 | A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2024-8676 | High | 7.4 | 2024-11-26 | A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that r… |
CVE-2024-49053 | High | 7.6 | 2024-11-26 | Microsoft Dynamics 365 Sales Spoofing Vulnerability |
CVE-2024-49052 | High | 8.2 | 2024-11-26 | Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network. |
CVE-2024-49038 | Critical | 9.3 | 2024-11-26 | Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privil… |
CVE-2024-49035 | High | 8.7 | 2024-11-26 | An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network. |
CVE-2024-11743 | Medium | 4.3 | 2024-11-26 | A vulnerability, which was classified as problematic, was found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of t… |
CVE-2024-11742 | Low | 3.5 | 2024-11-26 | A vulnerability, which was classified as problematic, has been found in SourceCodester Best House Rental Management System 1.0. This issue affects some unknown… |
CVE-2024-11145 | Critical | 9.8 | 2024-11-26 | Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privi… |
CVE-2024-10240 | Medium | 5.3 | 2024-11-26 | An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions… |
CVE-2024-8237 | Medium | 6.5 | 2024-11-26 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior… |
CVE-2024-8177 | Medium | 5.3 | 2024-11-26 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior… |
CVE-2024-8114 | High | 8.2 | 2024-11-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an a… |
CVE-2024-53844 | Medium | 6.3 | 2024-11-26 | E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. A path traversal vulnerability exists in the backup export funct… |
CVE-2024-53620 | Medium | 4.8 | 2024-11-26 | A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via inj… |
CVE-2024-53619 | Medium | 6.3 | 2024-11-26 | An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2024-53267 | Medium | 5.5 | 2024-11-26 | sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a valid… |
CVE-2024-52008 | High | 8.8 | 2024-11-26 | Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to… |
CVE-2024-32965 | High | 8.1 | 2024-11-26 | Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malic… |
CVE-2024-11828 | Medium | 4.3 | 2024-11-26 | A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1… |
CVE-2024-11669 | Medium | 6.5 | 2024-11-26 | An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints cou… |
CVE-2024-11668 | Medium | 4.2 | 2024-11-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connection… |
CVE-2024-51058 | Medium | 6.2 | 2024-11-26 | Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file s… |
CVE-2024-10878 | Medium | 6.1 | 2024-11-26 | The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_quer… |
CVE-2024-53555 | High | 8.8 | 2024-11-26 | A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV file. |
CVE-2024-53365 | Medium | 5.4 | 2024-11-26 | A stored cross-site scripting (XSS) vulnerability was identified in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/profile.php. This vulnerabilit… |
CVE-2024-11407 | High | 7.5 | 2024-11-26 | There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX… |
CVE-2024-52337 | Medium | 5.5 | 2024-11-26 | A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequen… |
CVE-2024-52336 | High | 7.8 | 2024-11-26 | A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without a… |
CVE-2024-36463 | Medium | 6.5 | 2024-11-26 | The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. |
CVE-2024-22117 | Low | 2.2 | 2024-11-26 | When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementu… |
CVE-2024-9929 | Medium | 4.3 | 2024-11-26 | A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps. |
CVE-2024-9928 | Medium | 5.3 | 2024-11-26 | A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unau… |
CVE-2024-9461 | High | 7.2 | 2024-11-26 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to… |
CVE-2024-8236 | Medium | 6.4 | 2024-11-26 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the… |
CVE-2024-53976 | Medium | 5.4 | 2024-11-26 | Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the… |
CVE-2024-53975 | Medium | 5.4 | 2024-11-26 | Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appear secure. This vul… |
CVE-2024-11708 | Medium | 6.5 | 2024-11-26 | Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox < 133 an… |
CVE-2024-11706 | Medium | 6.5 | 2024-11-26 | A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_Util` function, when handling malformed o… |
CVE-2024-11705 | Critical | 9.1 | 2024-11-26 | `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading… |
CVE-2024-11704 | Critical | 9.8 | 2024-11-26 | A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key c… |
CVE-2024-11703 | Medium | 5.7 | 2024-11-26 | On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerability affects Firefox <… |
CVE-2024-11702 | High | 7.5 | 2024-11-26 | Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history… |
CVE-2024-11701 | Medium | 4.3 | 2024-11-26 | The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible sp… |
CVE-2024-11700 | High | 8.1 | 2024-11-26 | Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of… |
CVE-2024-11699 | High | 8.8 | 2024-11-26 | Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-11698 | Critical | 9.8 | 2024-11-26 | A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened durin… |
CVE-2024-11697 | High | 8.8 | 2024-11-26 | When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have l… |
CVE-2024-11696 | Medium | 5.4 | 2024-11-26 | The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an i… |
CVE-2024-11695 | Medium | 5.4 | 2024-11-26 | A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This… |
CVE-2024-11694 | Medium | 6.1 | 2024-11-26 | Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the W… |
CVE-2024-11693 | Critical | 9.8 | 2024-11-26 | The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating systems. Other operating… |
CVE-2024-11692 | Medium | 4.3 | 2024-11-26 | An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability… |
CVE-2024-11691 | High | 8.8 | 2024-11-26 | Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver… |
CVE-2024-51569 | High | 7.5 | 2024-11-26 | Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing… |
CVE-2024-47250 | Medium | 5.0 | 2024-11-26 | Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI advertising report could lead to out-of-bound access when parsing HCI even… |
CVE-2024-47249 | Medium | 5.0 | 2024-11-26 | Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory… |