2024 CVEs (page 92)
Page 92 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47250 | Medium | 5.0 | 2024-11-26 | Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI advertising report could lead to out-of-bound access when parsing HCI even… |
CVE-2024-47249 | Medium | 5.0 | 2024-11-26 | Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory… |
CVE-2024-47248 | Medium | 6.3 | 2024-11-26 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. Specially crafted MESH message could result in memory c… |
CVE-2024-38834 | Medium | 6.5 | 2024-11-26 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject ma… |
CVE-2024-38833 | Medium | 6.8 | 2024-11-26 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious sc… |
CVE-2024-38832 | High | 7.1 | 2024-11-26 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious scr… |
CVE-2024-38831 | High | 7.8 | 2024-11-26 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious comman… |
CVE-2024-38830 | High | 7.8 | 2024-11-26 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerabili… |
CVE-2024-8899 | Medium | 4.3 | 2024-11-26 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the render_content f… |
CVE-2024-50377 | Medium | 6.5 | 2024-11-26 | A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<… |
CVE-2024-50376 | High | 7.3 | 2024-11-26 | A CWE-79 "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" was discovered affecting the following devices manufactured by… |
CVE-2024-50375 | Critical | 9.8 | 2024-11-26 | A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EK… |
CVE-2024-50374 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50373 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50372 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50371 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50370 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50369 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50368 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50367 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50366 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50365 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50364 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50363 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50362 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50361 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50360 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50359 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50358 | High | 7.2 | 2024-11-26 | A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6… |
CVE-2024-11024 | Critical | 9.8 | 2024-11-26 | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4… |
CVE-2024-10579 | Medium | 4.3 | 2024-11-26 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability che… |
CVE-2024-10308 | Medium | 6.4 | 2024-11-26 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Countdown widget in all versions up to, and inc… |
CVE-2024-11680 | Critical | 9.8 | 2024-11-26 | ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sendin… |
CVE-2024-11032 | Medium | 6.1 | 2024-11-26 | The Parsi Date plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in… |
CVE-2024-9170 | Medium | 5.5 | 2024-11-26 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wcj_product_meta shortcode in all versions up to… |
CVE-2024-11192 | Medium | 6.4 | 2024-11-26 | The Spotify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spotifyplaybutton shortcode in all ver… |
CVE-2024-11119 | Medium | 6.4 | 2024-11-26 | The BNE Gallery Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and incl… |
CVE-2024-11091 | Medium | 6.4 | 2024-11-26 | The Support SVG – Upload svg files in wordpress without hassle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads… |
CVE-2024-9504 | High | 7.2 | 2024-11-26 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to… |
CVE-2024-8772 | Medium | 4.3 | 2024-11-26 | 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for… |
CVE-2024-8160 | Low | 3.8 | 2024-11-26 | Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a poss… |
CVE-2024-6831 | Medium | 4.4 | 2024-11-26 | Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the necessary permission due… |
CVE-2024-47257 | High | 7.5 | 2024-11-26 | Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device becoming unavailabl… |
CVE-2024-36254 | High | 7.5 | 2024-11-26 | Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-… |
CVE-2024-36251 | High | 7.5 | 2024-11-26 | The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to bill… |
CVE-2024-36249 | High | 7.4 | 2024-11-26 | Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is ex… |
CVE-2024-36248 | Critical | 9.1 | 2024-11-26 | API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the in… |
CVE-2024-35244 | Critical | 9.1 | 2024-11-26 | There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the cored… |
CVE-2024-34162 | Medium | 5.3 | 2024-11-26 | The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPL… |
CVE-2024-33616 | Medium | 5.3 | 2024-11-26 | Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states… |
CVE-2024-33610 | Critical | 9.1 | 2024-11-26 | "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information inclu… |
CVE-2024-33605 | High | 7.5 | 2024-11-26 | Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, mo… |
CVE-2024-32151 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-29978 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-29146 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-28955 | Medium | 5.9 | 2024-11-26 | Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files… |
CVE-2024-28038 | Critical | 9.0 | 2024-11-26 | The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character st… |
CVE-2024-11202 | Medium | 6.1 | 2024-11-26 | Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient inp… |
CVE-2024-6749 | Medium | 6.3 | 2024-11-26 | Seth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident report feature may expose sensitive credentials on the AXIS C… |
CVE-2024-6476 | Medium | 4.2 | 2024-11-26 | Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user to gain system privileges by redirectin… |
CVE-2024-11002 | Medium | 6.3 | 2024-11-26 | The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJAX action in all ver… |
CVE-2024-10857 | Medium | 6.5 | 2024-11-26 | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_dow… |
CVE-2024-10781 | High | 8.1 | 2024-11-26 | The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty… |
CVE-2024-10570 | High | 7.5 | 2024-11-26 | The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized SQL Injection due to an authorization bypass via reverse DNS spoofi… |
CVE-2024-10542 | Critical | 9.8 | 2024-11-26 | The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization… |
CVE-2024-10471 | Medium | 4.8 | 2024-11-26 | The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-53278 | Medium | 4.8 | 2024-11-26 | Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. If a malicious admin user customizes the admin screen with som… |
CVE-2024-49353 | High | 7.5 | 2024-11-26 | IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.0 through 5.0.2 does not properly check inputs to resources that are used concurrently, whi… |
CVE-2024-49351 | Medium | 5.5 | 2024-11-26 | IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user. |
CVE-2024-11418 | Medium | 6.1 | 2024-11-26 | The Additional Order Filters for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shipping_method_filter' parameter in… |
CVE-2024-11342 | Medium | 6.1 | 2024-11-26 | The Skt NURCaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing or inco… |
CVE-2024-49597 | High | 7.6 | 2024-11-26 | Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability. A high privileged a… |
CVE-2024-49596 | Medium | 5.9 | 2024-11-26 | Dell Wyse Management Suite, version WMS 4.4 and prior, contain a Missing Authorization vulnerability. A high privileged attacker with remote access could poten… |
CVE-2024-49595 | High | 7.6 | 2024-11-26 | Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerability. A high privileged attacker with remot… |
CVE-2024-11678 | Low | 3.5 | 2024-11-26 | A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-11677 | Low | 3.5 | 2024-11-26 | A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /backend… |
CVE-2024-10729 | High | 8.8 | 2024-11-26 | The Booking & Appointment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-52899 | High | 8.5 | 2024-11-26 | IBM Data Virtualization Manager for z/OS 1.1 and 1.2 could allow an authenticated user to inject malicious JDBC URL parameters and execute code on the server. |
CVE-2024-11676 | Low | 3.5 | 2024-11-26 | A vulnerability was found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of th… |
CVE-2024-11675 | Low | 3.5 | 2024-11-26 | A vulnerability has been found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown function… |
CVE-2024-53843 | High | 8.1 | 2024-11-26 | @dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend clients to interface with keycloak. A Ref… |
CVE-2024-11674 | Medium | 6.3 | 2024-11-26 | A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/… |
CVE-2024-11673 | Medium | 4.3 | 2024-11-25 | A vulnerability, which was classified as problematic, has been found in 1000 Projects Bookstore Management System 1.0. This issue affects some unknown processi… |
CVE-2024-53597 | Medium | 6.3 | 2024-11-25 | masterstack_imgcap v0.0.1 was discovered to contain a SQL injection vulnerability via the endpoint /submit. |
CVE-2024-53554 | High | 8.0 | 2024-11-25 | A Client-Side Template Injection (CSTI) vulnerability in the component /project/new/scrum of Taiga v 8.6.1 allows remote attackers to execute arbitrary code by… |
CVE-2024-53101 | Medium | 5.5 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() uses attr->i… |
CVE-2024-53100 | High | 7.8 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queue_lock lock and destroy Commit 76d54bf20cdc ("nvme-tcp… |
CVE-2024-53099 | High | 7.1 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check validity of link->type in bpf_link_show_fdinfo() If a newly-added link type do… |
CVE-2024-53098 | High | 7.8 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/ufence: Prefetch ufence addr to catch bogus address access_ok() only checks for ad… |
CVE-2024-53097 | Medium | 5.5 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: mm: krealloc: Fix MTE false alarm in __do_krealloc This patch addresses an issue introduc… |
CVE-2024-53096 | High | 7.8 | 2024-11-25 | In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region() error path behaviour The mmap_region() function is somew… |
CVE-2024-53556 | Medium | 6.1 | 2024-11-25 | An Open Redirect vulnerability in Taiga v6.8.1 allows attackers to redirect users to arbitrary websites via appending a crafted link to /login?next= in the log… |
CVE-2024-50672 | Critical | 9.8 | 2024-11-25 | A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passw… |
CVE-2024-50671 | Medium | 4.3 | 2024-11-25 | Incorrect access control in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows attackers with Authenticated User roles to obtain email addresses via the "Get… |
CVE-2024-53268 | High | 7.2 | 2024-11-25 | Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected versions attackers are… |
CVE-2024-53262 | Medium | 5.4 | 2024-11-25 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors contains placeholde… |
CVE-2024-53261 | Medium | 5.4 | 2024-11-25 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, w… |
CVE-2024-53258 | Medium | 5.3 | 2024-11-25 | Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignm… |
CVE-2024-53599 | Medium | 5.4 | 2024-11-25 | A cross-site scripting (XSS) vulnerability in the /scroll.php endpoint of LafeLabs Chaos v0.0.1 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2024-53255 | Medium | 5.4 | 2024-11-25 | BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a… |