2024 CVEs (page 97)
Page 97 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52814 | Low | 2.8 | 2024-11-22 | Argo Helm is a collection of community maintained charts for `argoproj.github.io` projects. Prior to version 0.45.0, the `workflow-role`) lacks granularity in… |
CVE-2024-52804 | High | 7.5 | 2024-11-22 | Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes… |
CVE-2024-52802 | High | 7.5 | 2024-11-22 | RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in `/sys/net/applicati… |
CVE-2024-52793 | | 2024-11-22 | The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, `http/file-server`'s `serveDir` with `showDirListing: true` option is vu… | |
CVE-2024-52723 | Critical | 9.8 | 2024-11-22 | In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arb… |
CVE-2024-51074 | Medium | 6.7 | 2024-11-22 | Incorrect access control in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to arbitrarily change odometer readings in t… |
CVE-2024-51073 | Medium | 6.7 | 2024-11-22 | An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to control or disrupt CAN communication between the instrume… |
CVE-2024-51072 | Medium | 5.3 | 2024-11-22 | An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to cause a Denial of Service (DoS) via ECU reset UDS service… |
CVE-2024-50965 | Medium | 5.4 | 2024-11-22 | Cross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an attacker to execute arbitrary code and esc… |
CVE-2024-50401 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50400 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50399 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50398 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50397 | High | 8.8 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50396 | High | 8.8 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50395 | High | 8.8 | 2024-11-22 | An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could all… |
CVE-2024-48862 | Critical | 9.8 | 2024-11-22 | A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to traverse the file syst… |
CVE-2024-48861 | High | 7.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers… |
CVE-2024-48860 | Critical | 9.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to exe… |
CVE-2024-38647 | High | 7.5 | 2024-11-22 | An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to co… |
CVE-2024-38646 | Medium | 6.0 | 2024-11-22 | An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow… |
CVE-2024-38645 | Medium | 6.5 | 2024-11-22 | A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticate… |
CVE-2024-38644 | High | 8.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers t… |
CVE-2024-38643 | Critical | 9.8 | 2024-11-22 | A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote at… |
CVE-2024-37050 | Medium | 6.5 | 2024-11-22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-37049 | Medium | 6.5 | 2024-11-22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-37048 | Medium | 4.9 | 2024-11-22 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-37047 | Medium | 6.5 | 2024-11-22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-37046 | Medium | 4.9 | 2024-11-22 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-37045 | Medium | 4.9 | 2024-11-22 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-37044 | High | 7.2 | 2024-11-22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-37043 | Medium | 4.9 | 2024-11-22 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-37042 | Medium | 4.9 | 2024-11-22 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-37041 | High | 7.2 | 2024-11-22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-32770 | Medium | 6.3 | 2024-11-22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gai… |
CVE-2024-32769 | Medium | 6.3 | 2024-11-22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gai… |
CVE-2024-32768 | Medium | 6.3 | 2024-11-22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gai… |
CVE-2024-32767 | Medium | 6.3 | 2024-11-22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gai… |
CVE-2024-10863 | | 2024-11-22 | : Insufficient Logging vulnerability in OpenText Secure Content Manager on Windows allows Audit Log Manipulation.This issue affects Secure Content Manager: fro… | |
CVE-2024-49054 | Medium | 4.3 | 2024-11-22 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-45719 | Low | 2.6 | 2024-11-22 | Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version a… |
CVE-2024-51766 | Medium | 6.5 | 2024-11-22 | A potential security vulnerability has been identified in the HPE NonStop DISK UTIL (T9208) product. This vulnerability could be exploited to cause a denial of… |
CVE-2024-41781 | Medium | 5.1 | 2024-11-22 | IBM PowerVM Platform KeyStore (IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1030.00 through FW1030.60, FW1050.00 through FW1050.20, and FW1060.00 throug… |
CVE-2024-41779 | Critical | 9.8 | 2024-11-22 | IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race conditi… |
CVE-2024-7882 | Medium | 6.5 | 2024-11-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Special Minds Design and Software e-Commerce allows SQL I… |
CVE-2024-7837 | High | 8.2 | 2024-11-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Firmanet Software ERP allows SQL Injection. This issue a… |
CVE-2024-8929 | Medium | 5.8 | 2024-11-22 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap… |
CVE-2024-9422 | Medium | 6.6 | 2024-11-22 | The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could al… |
CVE-2024-8932 | Critical | 9.8 | 2024-11-22 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can… |
CVE-2024-8735 | Medium | 6.1 | 2024-11-22 | The MailMunch – Grow your Email List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate e… |
CVE-2024-11601 | High | 8.1 | 2024-11-22 | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) plugin f… |
CVE-2024-11381 | Medium | 6.4 | 2024-11-22 | The Control horas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ch_registro' shortcode in all versions up to, and includi… |
CVE-2024-11355 | Medium | 4.3 | 2024-11-22 | The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2024-11225 | Medium | 6.1 | 2024-11-22 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with… |
CVE-2024-11104 | High | 8.1 | 2024-11-22 | The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress i… |
CVE-2024-10666 | Medium | 4.3 | 2024-11-22 | The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via… |
CVE-2024-10034 | Medium | 5.5 | 2024-11-22 | The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerabl… |
CVE-2024-38296 | Medium | 6.7 | 2024-11-22 | Dell Edge Gateway 3200, versions prior to 15.40.30.2879, and Edge Gateway 5200, versions prior to 12.0.94.2380, contain an Exposure of Sensitive Information in… |
CVE-2024-47142 | Medium | 5.5 | 2024-11-22 | AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials… |
CVE-2024-45837 | Medium | 5.4 | 2024-11-22 | Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthenticated attacker may… |
CVE-2024-39290 | Medium | 6.5 | 2024-11-22 | Insufficiently protected credentials issue exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent unauthenticated attacker may obtain sensitive informa… |
CVE-2024-31408 | High | 8.0 | 2024-11-22 | OS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker may execute an arbitrary OS command wi… |
CVE-2024-52056 | Medium | 6.5 | 2024-11-21 | Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to delete any directory on the file system if the ta… |
CVE-2024-52055 | Medium | 4.9 | 2024-11-21 | Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to read any file on the file system if the target di… |
CVE-2024-52054 | Low | 2.7 | 2024-11-21 | Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to create an XML definition file anywhere on the fil… |
CVE-2024-52053 | Critical | 9.6 | 2024-11-21 | Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject client-side JavaScript… |
CVE-2024-52052 | High | 7.2 | 2024-11-21 | Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream… |
CVE-2024-52616 | Medium | 5.3 | 2024-11-21 | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This p… |
CVE-2024-52615 | Medium | 5.3 | 2024-11-21 | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are… |
CVE-2024-51367 | Critical | 9.8 | 2024-11-21 | An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrary code via upload… |
CVE-2024-51366 | Critical | 9.8 | 2024-11-21 | An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploading a crafted .con… |
CVE-2024-51364 | High | 8.8 | 2024-11-21 | An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file. |
CVE-2024-49588 | Medium | 6.8 | 2024-11-21 | Multiple endpoints in `oracle-sidecar` in versions 0.347.0 to 0.543.0 were found to be vulnerable to SQL injections. |
CVE-2024-53095 | Critical | 9.8 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free of network namespace. Recently, we got a customer report… |
CVE-2024-53094 | Critical | 9.8 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES While running ISER over SIW… |
CVE-2024-53093 | High | 7.5 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: defer partition scanning We need to suppress the partition scan from occu… |
CVE-2024-53092 | High | 8.4 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: virtio_pci: Fix admin vq cleanup by using correct info pointer vp_modern_avq_cleanup() an… |
CVE-2024-53091 | High | 7.8 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx As the introduction of the… |
CVE-2024-53090 | High | 7.5 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afs_wake_up_async_call() can incur lock recursion. The problem i… |
CVE-2024-53089 | Medium | 5.5 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Mark hrtimer to expire in hard interrupt context Like commit 2c0d278f3293… |
CVE-2024-51337 | Low | 3.5 | 2024-11-21 | Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email par… |
CVE-2024-53432 | High | 7.5 | 2024-11-21 | While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::out_of_range exception in PCLPointCloud2::at. This issue could po… |
CVE-2024-53335 | High | 7.8 | 2024-11-21 | TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi. |
CVE-2024-53334 | High | 8.8 | 2024-11-21 | TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in infostat.cgi. |
CVE-2024-53333 | Medium | 6.3 | 2024-11-21 | TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allows an attacker to… |
CVE-2024-52309 | | 2024-11-21 | SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerful feature of SFTPGo… | |
CVE-2024-52307 | Medium | 5.6 | 2024-11-21 | authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force t… |
CVE-2024-52289 | Critical | 9.8 | 2024-11-21 | authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are con… |
CVE-2024-52287 | High | 7.2 | 2024-11-21 | authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token fr… |
CVE-2024-48288 | High | 8.0 | 2024-11-21 | TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend. |
CVE-2024-48286 | High | 8.0 | 2024-11-21 | Linksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function. |
CVE-2024-52803 | High | 7.5 | 2024-11-21 | LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory train… |
CVE-2024-52799 | High | 8.2 | 2024-11-21 | Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the w… |
CVE-2024-49529 | Medium | 5.5 | 2024-11-21 | InDesign Desktop versions 19.0, 20.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An atta… |
CVE-2024-45517 | Medium | 5.4 | 2024-11-21 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h/rest endpoint of the Zimbra webmail an… |
CVE-2024-45513 | Medium | 4.8 | 2024-11-21 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/contacts/print endp… |
CVE-2024-45194 | Medium | 4.8 | 2024-11-21 | In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads. An attacke… |
CVE-2024-8526 | | 2024-11-21 | A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously crafted URL, which when visited by an authenticated WebCTRL user… | |
CVE-2024-8525 | | 2024-11-21 | An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a… | |
CVE-2024-45514 | Medium | 5.4 | 2024-11-21 | An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmai… |