CVE List - 2024 / May
Showing 4601 - 4700 of 4994 CVEs for May 2024 (Page 47 of 50)
| CVE ID | Date | Title |
|---|---|---|
| CVE-2024-24954 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can... |
| CVE-2024-24955 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can... |
| CVE-2024-24956 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can... |
| CVE-2024-24957 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can... |
| CVE-2024-24958 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can... |
| CVE-2024-24959 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can... |
| CVE-2024-24946 | 2024-05-28 | A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker... |
| CVE-2024-24947 | 2024-05-28 | A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to denial of service. An attacker... |
| CVE-2024-24851 | 2024-05-28 | A heap-based buffer overflow vulnerability exists in the Programming Software Connection FiBurn functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to a buffer overflow. An attacker... |
| CVE-2024-35621 | 2024-05-28 | A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content... |
| CVE-2024-33799 | 2024-05-28 | A SQL injection vulnerability in /model/get_teacher.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter. |
| CVE-2024-33800 | 2024-05-28 | A SQL injection vulnerability in /model/get_student1.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the index parameter. |
| CVE-2024-33801 | 2024-05-28 | A SQL injection vulnerability in /model/get_subject_routing.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter. |
| CVE-2024-33802 | 2024-05-28 | A SQL injection vulnerability in /model/get_student_subject.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the index parameter. |
| CVE-2024-33803 | 2024-05-28 | A SQL injection vulnerability in /model/get_exam.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter. |
| CVE-2024-33804 | 2024-05-28 | A SQL injection vulnerability in /model/get_subject.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter. |
| CVE-2024-33805 | 2024-05-28 | A SQL injection vulnerability in /model/get_student.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter. |
| CVE-2024-33806 | 2024-05-28 | A SQL injection vulnerability in /model/get_grade.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter. |
| CVE-2024-33807 | 2024-05-28 | A SQL injection vulnerability in /model/get_teacher_timetable.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the grade parameter. |
| CVE-2024-33808 | 2024-05-28 | A SQL injection vulnerability in /model/get_timetable.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter. |
| CVE-2024-36472 | 2024-05-28 | In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g., an adversary who controls the local... |
| CVE-2024-22590 | 2024-05-28 | The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow Client Hello messages to be overwritten at any time, including... |
| CVE-2024-30212 | 2024-05-28 | Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command |
| CVE-2024-35403 | 2024-05-28 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setIpPortFilterRules |
| CVE-2024-35401 | 2024-05-28 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function. |
| CVE-2024-34852 | 2024-05-28 | F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiver_schedule.php file. An unauthenticated remote attacker can exploit this vulnerability... |
| CVE-2024-34854 | 2024-05-28 | F-logic DataCube3 v1.0 is vulnerable to File Upload via `/admin/transceiver_schedule.php.` |
| CVE-2024-26024 | 2024-05-28 | SUBNET Substation Server Reliance on Insufficiently Trustworthy Component |
| CVE-2024-35563 | 2024-05-28 | CDG-Server-V5.6.2.126.139 and earlier was discovered to contain a SQL injection vulnerability via the permissionId parameter in CDGTempPermissions. |
| CVE-2024-30164 | 2024-05-28 | Amazon AWS Client VPN has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions. This is resolved in 3.11.1 on Windows, 3.9.1... |
| CVE-2024-30165 | 2024-05-28 | Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions, a different vulnerability than... |
| CVE-2024-35343 | 2024-05-28 | Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350,... |
| CVE-2024-35342 | 2024-05-28 | Certain Anpviz products allow unauthenticated users to modify or disable camera related settings such as microphone volume, speaker volume, LED lighting, NTP, motion detection, etc. This affects IPC-D250, IPC-D260, IPC-B850,... |
| CVE-2024-35341 | 2024-05-28 | Certain Anpviz products allow unauthenticated users to download the running configuration of the device via a HTTP GET request to /ConfigFile.ini or /config.xml URIs. This configuration file contains usernames and... |
| CVE-2024-35344 | 2024-05-28 | Certain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L,... |
| CVE-2024-33402 | 2024-05-28 | A SQL injection vulnerability in /model/approve_petty_cash.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter. |
| CVE-2023-43842 | 2024-05-28 | Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter user and administrator accounts credentials via HTTP... |
| CVE-2023-43843 | 2024-05-28 | Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to read user and administrator accounts passwords via HTTP... |
| CVE-2023-43844 | 2024-05-28 | Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account. The user is not asked to change the credentials after first login. If not changed, attackers... |
| CVE-2023-43845 | 2024-05-28 | Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged telnet account. The user is not asked to change the credentials after first login. If not changed, attackers can... |
| CVE-2023-43846 | 2024-05-28 | Incorrect access control in logs management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote attackers to get the device logs via HTTP GET request. The logs... |
| CVE-2023-43847 | 2024-05-28 | Incorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to control all the outlets as if they were... |
| CVE-2023-43848 | 2024-05-28 | Incorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter local firewall settings of the device as... |
| CVE-2023-43849 | 2024-05-28 | Incorrect access control in firmware upgrade function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to submit a firmware image via HTTP POST requests. This... |
| CVE-2023-43850 | 2024-05-28 | Improper input validation in the user management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to cause a partial DoS of web interface via... |
| CVE-2024-24919 | 2024-05-28 | Information disclosure |
| CVE-2024-36110 | 2024-05-28 | Cross-site scripting in ansibleguy-webui |
| CVE-2024-5433 | 2024-05-28 | Path Traversal in Campbell Scientific CSI Web Server and RTMC |
| CVE-2024-36109 | 2024-05-28 | Cross-site Scripting with Markdown rendering in CoCalc |
| CVE-2024-5434 | 2024-05-28 | Weak Encoding for Password vulnerability in Campbell Scientific CSI Web Server and RTMC |
| CVE-2024-36107 | 2024-05-28 | Information disclosure in minio |
| CVE-2024-33450 | 2024-05-28 | SQL Injection in Finereport v.8.0 allows a remote attacker to obtain sensitive information |
| CVE-2023-30311 | 2024-05-28 | An issue discovered in H3C Magic R365 and H3C Magic R100 routers allows attackers to hijack TCP sessions which could lead to a denial of service. |
| CVE-2023-30305 | 2024-05-28 | An issue discovered in Linksys E5600 routers allows attackers to hijack TCP sessions which could lead to a denial of service. |
| CVE-2023-46694 | 2024-05-28 | Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw exists due to the application's failure to enforce proper authentication controls... |
| CVE-2022-45171 | 2024-05-28 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous Type can occur under the vShare web site section. A remote... |
| CVE-2023-30307 | 2024-05-28 | An issue discovered in TP-LINK TL-R473GP-AC, TP-LINK XDR6020, TP-LINK TL-R479GP-AC, TP-LINK TL-R4239G, TP-LINK TL-WAR1200L, and TP-LINK TL-R476G routers allows attackers to hijack TCP sessions which could lead to a denial... |
| CVE-2024-35510 | 2024-05-28 | An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-28061 | 2024-05-28 | An issue was discovered in Apiris Kafeo 6.4.4. It permits a bypass, of the protection in place, to access to the data stored in the embedded database file. |
| CVE-2023-30308 | 2024-05-28 | An issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hijack TCP sessions which could lead to a denial of service. |
| CVE-2024-35582 | 2024-05-28 | A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Department input field. |
| CVE-2023-30309 | 2024-05-28 | An issue discovered in D-Link DI-7003GV2 routers allows attackers to hijack TCP sessions which could lead to a denial of service. |
| CVE-2024-35581 | 2024-05-28 | A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Borrower Name input... |
| CVE-2024-35583 | 2024-05-28 | A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Remarks input field. |
| CVE-2023-30310 | 2024-05-28 | An issue discovered in Comfast Comfast CF-616AC routers allows attackers to hijack TCP sessions which could lead to a denial of service. |
| CVE-2023-30306 | 2024-05-28 | An issue discovered in Mercury x30g, Mercury YR1800XG routers allows attackers to hijack TCP sessions which could lead to a denial of service. |
| CVE-2024-28060 | 2024-05-28 | An issue was discovered in Apiris Kafeo 6.4.4. It permits DLL hijacking, allowing a user to trigger the execution of arbitrary code every time the product is executed. |
| CVE-2023-30313 | 2024-05-28 | An issue discovered in Wavlink QUANTUM D2G routers allows attackers to hijack TCP sessions which could lead to a denial of service. |
| CVE-2024-35239 | 2024-05-28 | Stored Cross-site Scripting on Components of Umbraco Forms |
| CVE-2024-35240 | 2024-05-28 | Stored Cross-site Scripting on Print Functionality in Umbraco Commerce |
| CVE-2024-22641 | 2024-05-28 | TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file. |
| CVE-2024-35548 | 2024-05-28 | A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can... |
| CVE-2024-35511 | 2024-05-28 | phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php. |
| CVE-2024-35226 | 2024-05-28 | PHP Code Injection by malicious attribute in extends-tag in Smarty |
| CVE-2024-23579 | 2024-05-28 | HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions |
| CVE-2024-23580 | 2024-05-28 | HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs) |
| CVE-2023-30314 | 2024-05-28 | An issue discovered in 360 V6G, 360 T5G, 360 T6M, and 360 P1 routers allows attackers to hijack TCP sessions which could lead to a denial of service. |
| CVE-2024-36112 | 2024-05-28 | Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects |
| CVE-2024-5437 | 2024-05-28 | SourceCodester Simple Online Bidding System save_category cross site scripting |
| CVE-2024-36427 | 2024-05-29 | The file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to read or write to server files via a crafted file request.... |
| CVE-2024-5204 | 2024-05-29 | Swiss Toolkit For WP <= 1.0.7 - Authenticated (Contributor+) Authentication Bypass |
| CVE-2024-5150 | 2024-05-29 | Login with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value Check |
| CVE-2024-0434 | 2024-05-29 | WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_save |
| CVE-2023-6743 | 2024-05-29 | Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import |
| CVE-2024-4611 | 2024-05-29 | AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass |
| CVE-2024-21512 | 2024-05-29 | Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables. |
| CVE-2024-4419 | 2024-05-29 | Fetch JFT <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting |
| CVE-2024-3050 | 2024-05-29 | Site Reviews < 7.0.0 - IP Spoofing |
| CVE-2024-3921 | 2024-05-29 | Gianism <= 5.1.0 - Admin+ Stored XSS |
| CVE-2024-3937 | 2024-05-29 | Playlist for Youtube <= 1.32 - Editor+ Stored XSS |
| CVE-2024-36014 | 2024-05-29 | drm/arm/malidp: fix a possible null pointer dereference |
| CVE-2024-5086 | 2024-05-29 | Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget |
| CVE-2024-36015 | 2024-05-29 | ppdev: Add an error check in register_device |
| CVE-2024-3412 | 2024-05-29 | WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload |
| CVE-2024-28826 | 2024-05-29 | Unrestricted upload and download paths in check_sftp |
| CVE-2023-52881 | 2024-05-29 | tcp: do not accept ACK of bytes we never sent |
| CVE-2024-27313 | 2024-05-29 | XSS Vulnerability |
| CVE-2024-25976 | 2024-05-29 | Reflected Cross-Site-Scripting (XSS) |
| CVE-2024-25977 | 2024-05-29 | Session Fixation |
| CVE-2024-5039 | 2024-05-29 | HUSKY – Products Filter Professional for WooCommerce <= 1.3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |