Total
258583 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-38467 | 2024-07-03 | N/A | 7.5 HIGH | ||
| Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API. | |||||
| CVE-2024-38459 | 2024-07-03 | N/A | 7.8 HIGH | ||
| langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444. | |||||
| CVE-2024-38448 | 2024-07-03 | N/A | 9.1 CRITICAL | ||
| htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used. | |||||
| CVE-2024-38443 | 2024-07-03 | N/A | 6.2 MEDIUM | ||
| C/sorting/binary_insertion_sort.c in The Algorithms - C through e5dad3f has a segmentation fault for deep recursion, which may affect common use cases such as sorting an array of 50 elements. | |||||
| CVE-2024-38441 | 2024-07-03 | N/A | 9.8 CRITICAL | ||
| Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/afpd/directory.c. 2.4.1 and 3.1.19 are also fixed versions. | |||||
| CVE-2024-38427 | 2024-07-03 | N/A | 8.8 HIGH | ||
| In International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTagXml.cpp results in unconditionally returning false. | |||||
| CVE-2024-38396 | 2024-07-03 | N/A | 9.8 CRITICAL | ||
| An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal, a different vulnerability than CVE-2024-38395. | |||||
| CVE-2024-38395 | 2024-07-03 | N/A | 9.8 CRITICAL | ||
| In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable." | |||||
| CVE-2024-38384 | 2024-07-03 | N/A | 8.4 HIGH | ||
| In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start is being executed. If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one stat instance being added in blk_cgroup_bio_start(), then the local list in __blkcg_rstat_flush() could be corrupted. Fix the issue by adding one barrier. | |||||
| CVE-2024-38293 | 2024-07-03 | N/A | 8.8 HIGH | ||
| ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php. | |||||
| CVE-2024-38275 | 2024-07-03 | N/A | 7.5 HIGH | ||
| The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs. | |||||
| CVE-2024-37855 | 2024-07-03 | N/A | 8.4 HIGH | ||
| An issue in Nepstech Wifi Router xpon (terminal) NTPL-Xpon1GFEVN, hardware verstion 1.0 firmware 2.0.1 allows a remote attacker to execute arbitrary code via the router's Telnet port 2345 without requiring authentication credentials. | |||||
| CVE-2024-37848 | 2024-07-03 | N/A | 8.4 HIGH | ||
| SQL Injection vulnerability in Online-Bookstore-Project-In-PHP v1.0 allows a local attacker to execute arbitrary code via the admin_delete.php component. | |||||
| CVE-2024-37840 | 2024-07-03 | N/A | 8.8 HIGH | ||
| SQL injection vulnerability in processscore.php in Itsourcecode Learning Management System Project In PHP With Source Code v1.0 allows remote attackers to execute arbitrary SQL commands via the LessonID parameter. | |||||
| CVE-2024-37821 | 2024-07-03 | N/A | 8.8 HIGH | ||
| An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file. | |||||
| CVE-2024-37799 | 2024-07-03 | N/A | 5.4 MEDIUM | ||
| CodeProjects Restaurant Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the reserv_id parameter at view_reservations.php. | |||||
| CVE-2024-37795 | 2024-07-03 | N/A | 7.5 HIGH | ||
| A segmentation fault in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT-LIB input file containing the `set-logic` command with specific formatting errors. | |||||
| CVE-2024-37794 | 2024-07-03 | N/A | 7.5 HIGH | ||
| Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file. | |||||
| CVE-2024-37764 | 2024-07-03 | N/A | 5.4 MEDIUM | ||
| MachForm up to version 19 is affected by an authenticated stored cross-site scripting. | |||||
| CVE-2024-37759 | 2024-07-03 | N/A | 9.8 CRITICAL | ||
| DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing interface. | |||||