2024 CVEs (page 103)
Page 103 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50515 | Medium | 5.9 | 2024-11-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.Th… |
CVE-2024-50514 | Medium | 5.9 | 2024-11-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.Th… |
CVE-2024-50513 | Medium | 5.9 | 2024-11-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows Stored XSS.This issue af… |
CVE-2024-50417 | Medium | 4.3 | 2024-11-19 | Missing Authorization vulnerability in boldthemes Bold Page Builder bold-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2024-49697 | Medium | 4.3 | 2024-11-19 | Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2024-49689 | Medium | 5.4 | 2024-11-19 | Missing Authorization vulnerability in Harmonic Design HD Quiz – Save Results Light hd-quiz-save-results-light allows Exploiting Incorrectly Configured Access… |
CVE-2024-49680 | Medium | 4.3 | 2024-11-19 | Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: fr… |
CVE-2024-48071 | Medium | 6.5 | 2024-11-19 | E-cology has a directory traversal vulnerability. An attacker can exploit this vulnerability to delete the server directory, causing the server to permanently… |
CVE-2024-43338 | Medium | 4.3 | 2024-11-19 | Cross-Site Request Forgery (CSRF) vulnerability in Automattic Crowdsignal Dashboard – Polls, Surveys & more polldaddy allows Cross Site Request Forgery.This is… |
CVE-2024-52582 | Medium | 4.7 | 2024-11-19 | Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to versi… |
CVE-2024-50803 | Medium | 5.4 | 2024-11-19 | The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privile… |
CVE-2024-10524 | Medium | 6.5 | 2024-11-19 | Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attac… |
CVE-2024-52711 | Medium | 5.7 | 2024-11-19 | DI-8100 v16.07.26A1 is vulnerable to Buffer Overflow In the ip_position_asp function via the ip parameter. |
CVE-2024-11075 | High | 8.8 | 2024-11-19 | A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privilege escalation to t… |
CVE-2024-10204 | High | 7.8 | 2024-11-19 | Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024… |
CVE-2024-9830 | Medium | 6.1 | 2024-11-19 | The Bard theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all ver… |
CVE-2024-9777 | Medium | 6.1 | 2024-11-19 | The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all ver… |
CVE-2024-52675 | Critical | 9.8 | 2024-11-19 | SourceCodester Sentiment Based Movie Rating System 1.0 is vulnerable to SQL Injection in /msrps/movies.php. |
CVE-2024-11224 | Medium | 6.4 | 2024-11-19 | The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due… |
CVE-2024-11198 | Medium | 6.4 | 2024-11-19 | The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘extra_class’ parameter in all versions up to, and including, 3… |
CVE-2024-11194 | High | 8.8 | 2024-11-19 | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to pr… |
CVE-2024-11195 | Medium | 6.4 | 2024-11-19 | The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's print_email_subscribe_form shortcode in all ver… |
CVE-2024-11038 | High | 7.3 | 2024-11-19 | The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode e… |
CVE-2024-11036 | High | 7.3 | 2024-11-19 | The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shor… |
CVE-2024-31141 | Medium | 6.5 | 2024-11-19 | Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configur… |
CVE-2024-11098 | Medium | 5.5 | 2024-11-19 | The SVG Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.24 due… |
CVE-2024-11069 | Medium | 6.5 | 2024-11-19 | The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_… |
CVE-2024-10388 | High | 7.2 | 2024-11-19 | The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters in all versions up… |
CVE-2024-10268 | Medium | 6.4 | 2024-11-19 | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sonaar… |
CVE-2024-8403 | High | 7.5 | 2024-11-19 | Improper Validation of Specified Type of Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET versions 1.100 to 1.200 and FX5-ENE… |
CVE-2024-10103 | Medium | 6.1 | 2024-11-19 | In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the edito… |
CVE-2024-21539 | High | 7.5 | 2024-11-19 | Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An a… |
CVE-2024-50302 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds… |
CVE-2024-50301 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: security/keys: fix slab-out-of-bounds in key_task_permission KASAN reports an out of boun… |
CVE-2024-50300 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: regulator: rtq2208: Fix uninitialized use of regulator_config Fix rtq2208 driver uninitia… |
CVE-2024-50299 | High | 8.2 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: properly validate chunk size in sctp_sf_ootb() A size validation fix similar to tha… |
CVE-2024-50298 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net: enetc: allocate vf_state during PF probes In the previous implementation, vf_state i… |
CVE-2024-50297 | High | 7.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts Enqueue packets i… |
CVE-2024-50296 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when uninstalling driver When the driver is uninstalled and t… |
CVE-2024-50295 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net: arc: fix the device for dma_map_single/dma_unmap_single The ndev->dev and pdev->dev… |
CVE-2024-50294 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing locking causing hanging calls If a call gets aborted (e.g. because kaf… |
CVE-2024-50293 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net/smc: do not leave a dangling sk pointer in __smc_create() Thanks to commit 4bbd360a50… |
CVE-2024-50292 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove In case of error wh… |
CVE-2024-50291 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: add missing buffer index check dvb_vb2_expbuf() didn't check if the give… |
CVE-2024-50290 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: media: cx24116: prevent overflows on SNR calculus as reported by Coverity, if reading SNR… |
CVE-2024-50289 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: media: av7110: fix a spectre vulnerability As warned by smatch: drivers/staging/media/av… |
CVE-2024-50288 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix buffer overwrite when using > 32 buffers The maximum number of buffers… |
CVE-2024-50287 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity, the logi… |
CVE-2024-50286 | Critical | 9.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create There is a race condition bet… |
CVE-2024-50285 | High | 7.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: check outstanding simultaneous SMB operations If Client send simultaneous SMB oper… |
CVE-2024-50284 | High | 7.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix the missing xa_store error check xa_store() can fail, it return xa_err(-EINVAL… |
CVE-2024-50283 | Critical | 9.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp ksmbd_user_session_put should be… |
CVE-2024-50282 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Avoid a possible buff… |
CVE-2024-50281 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation When sealing or unseali… |
CVE-2024-50280 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: dm cache: fix flushing uninitialized delayed_work on cache_ctr error An unexpected WARN_O… |
CVE-2024-50279 | High | 7.1 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: dm cache: fix out-of-bounds access to the dirty bitset when resizing dm-cache checks the… |
CVE-2024-50278 | High | 7.1 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: dm cache: fix potential out-of-bounds access on the first resume Out-of-bounds access occ… |
CVE-2024-50277 | Medium | 4.7 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: dm: fix a crash if blk_alloc_disk fails If blk_alloc_disk fails, the variable md->disk is… |
CVE-2024-50276 | Critical | 9.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: net: vertexcom: mse102x: Fix possible double free of TX skb The scope of the TX skb is wi… |
CVE-2024-50275 | High | 7.3 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: arm64/sve: Discard stale CPU state when handling SVE traps The logic for handling SVE tra… |
CVE-2024-50274 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: idpf: avoid vport access in idpf_get_link_ksettings When the device control plane is remo… |
CVE-2024-50273 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: btrfs: reinitialize delayed ref list after deleting it from the list At insert_delayed_re… |
CVE-2024-50272 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: filemap: Fix bounds checking in filemap_read() If the caller supplies an iocb->ki_pos val… |
CVE-2024-50271 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: signal: restore the override_rlimit logic Prior to commit d64696905554 ("Reimplement RLIM… |
CVE-2024-50270 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid overflow in damon_feed_loop_next_input() damon_feed_loop_next_input(… |
CVE-2024-50269 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: usb: musb: sunxi: Fix accessing an released usb phy Commit 6ed05c68cbca ("usb: musb: sunx… |
CVE-2024-50268 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() The "*cmd" v… |
CVE-2024-50267 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: fix use after free in debug printk The "dev_dbg(&urb->dev->dev… |
CVE-2024-50266 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: videocc-sm8350: use HW_CTRL_TRIGGER for vcodec GDSCs A recent change in the ve… |
CVE-2024-50265 | Medium | 5.5 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Syzkaller i… |
CVE-2024-50264 | High | 7.8 | 2024-11-19 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopb… |
CVE-2024-52340 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MartyThornley Photographer Connections photographer-conne… |
CVE-2024-52339 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maximilian Ruthe Mage Front End Forms mage-forms allows S… |
CVE-2024-51940 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sohelwpexpert WP Responsive Video my-wp-responsive-video… |
CVE-2024-51939 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Santhosh veer Stylish Internal Links stylish-internal-lin… |
CVE-2024-33231 | Medium | 5.4 | 2024-11-18 | Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a crafted payload to the PDF preview compo… |
CVE-2024-52587 | High | 8.8 | 2024-11-18 | StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden… |
CVE-2024-52418 | High | 7.1 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CactusThemes Gameplan gameplan allows Reflected XSS.This… |
CVE-2024-52417 | High | 7.1 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes ReConstruction reconstruction allows Reflected… |
CVE-2024-52394 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedi… |
CVE-2024-52390 | Medium | 4.9 | 2024-11-18 | Path Traversal: '.../...//' vulnerability in Greg Ross CYAN Backup cyan-backup allows Path Traversal.This issue affects CYAN Backup: from n/a through <= 2.5.3. |
CVE-2024-52389 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Stored XSS… |
CVE-2024-52349 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Shiddikur Rahman Awesome Tool Tip awesome-tool-tip al… |
CVE-2024-52348 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Extensions AA Audio Player aa-audio-player allows DOM-… |
CVE-2024-52347 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpwebsitecreator Website remote Install vor Gravity, WPFo… |
CVE-2024-52346 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JavierMendezPWG SimpleGMaps simplegmaps allows Stored XSS… |
CVE-2024-52345 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RobertoAlicata ra_qrcode ra-qrcode allows Stored XSS.This… |
CVE-2024-52344 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeies Pvt Ltd Provide Forex Signals provide-forex-signa… |
CVE-2024-52343 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Pricing Tables os-pricing… |
CVE-2024-52342 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS BXSlider os-bxslider allo… |
CVE-2024-52341 | Medium | 6.5 | 2024-11-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Our Team os-our-team allo… |
CVE-2024-51051 | Critical | 9.8 | 2024-11-18 | AVSCMS v8.2.0 was discovered to contain weak default credentials for the Administrator account. |
CVE-2024-21287 | High | 7.5 | 2024-11-18 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported versio… |
CVE-2024-10486 | Medium | 5.3 | 2024-11-18 | The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly ac… |
CVE-2024-52585 | Medium | 5.4 | 2024-11-18 | Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can aff… |
CVE-2024-52584 | Medium | 5.4 | 2024-11-18 | Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit t… |
CVE-2024-52583 | High | 8.2 | 2024-11-18 | The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` be… |
CVE-2024-52506 | Medium | 6.5 | 2024-11-18 | Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboar… |
CVE-2024-52304 | High | 7.5 | 2024-11-18 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions… |
CVE-2024-51053 | Critical | 9.8 | 2024-11-18 | An arbitrary file upload vulnerability in the component /main/fileupload.php of AVSCMS v8.2.0 allows attackers to execute arbitrary code via uploading a crafte… |