2024 CVEs (page 105)
Page 105 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52414 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu wdes-responsive-mobile-menu allows Object Injection.This issue af… |
CVE-2024-52413 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in dmcwebzone Airin Blog airin-blog allows Object Injection.This issue affects Airin Blog: from n/a through <=… |
CVE-2024-52412 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Stephen Cui Xin allows Object Injection.This issue affects Xin: from n/a through 1.0.8.1. |
CVE-2024-52411 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in flowcraft Advanced Personalization personalization-by-flowcraft allows Object Injection.This issue affects A… |
CVE-2024-52410 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Phoenixheart Referrer Detector referrer-detector allows Object Injection.This issue affects Referrer Detecto… |
CVE-2024-52409 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Phoenixheart AJAX Random Posts ajax-random-posts allows Object Injection.This issue affects AJAX Random Post… |
CVE-2024-52408 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in pushassist Push Notifications for WordPress by PushAssist push-notification-for-wp-by-pushassi… |
CVE-2024-52407 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in BasePress BasePress Migration Tools basepress-migration-tools allows Upload a Web Shell to a W… |
CVE-2024-52406 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in wibergsweb CSV to html csv-to-html allows Upload a Web Shell to a Web Server.This issue affect… |
CVE-2024-52405 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in bikramjoshii B-Banner Slider b-banner-slider allows Upload a Web Shell to a Web Server.This is… |
CVE-2024-52404 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in bigfiveagency CF7 Reply Manager cf7-reply-manager.This issue affects CF7 Reply Manager: from n… |
CVE-2024-52403 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Saad Iqbal User Management user-management allows Upload a Web Shell to a Web Server.This issu… |
CVE-2024-52400 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Subhasis Laha Gallerio gallerio allows Upload a Web Shell to a Web Server.This issue affects G… |
CVE-2024-52399 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Clarisse K. Writer Helper writer-helper allows Upload a Web Shell to a Web Server.This issue a… |
CVE-2024-52398 | Critical | 9.1 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Halyra CDI collect-and-deliver-interface-for-woocommerce.This issue affects CDI: from n/a thro… |
CVE-2024-52386 | Medium | 5.3 | 2024-11-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classif… |
CVE-2024-9887 | High | 7.2 | 2024-11-16 | The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to… |
CVE-2024-11094 | Medium | 5.3 | 2024-11-16 | The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the export feature. Thi… |
CVE-2024-10592 | Medium | 6.4 | 2024-11-16 | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup class parameter in all versions up to, and including, 1.6.0… |
CVE-2024-10645 | High | 7.5 | 2024-11-16 | The Blogger 301 Redirect plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘br’ parameter in all versions up to, and including, 2.5… |
CVE-2024-10614 | Medium | 4.3 | 2024-11-16 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cancel_import() functio… |
CVE-2024-8856 | Critical | 9.8 | 2024-11-16 | The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHan… |
CVE-2024-10728 | High | 8.8 | 2024-11-16 | The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a mis… |
CVE-2024-9938 | Medium | 6.1 | 2024-11-16 | The Bounce Handler MailPoet 3 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and includin… |
CVE-2024-9935 | High | 7.5 | 2024-11-16 | The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw… |
CVE-2024-9850 | Medium | 6.4 | 2024-11-16 | The SVG Case Study plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insu… |
CVE-2024-9849 | High | 8.8 | 2024-11-16 | The Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati… |
CVE-2024-9839 | High | 7.3 | 2024-11-16 | The The Uix Slideshow plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.5. This is due to the softw… |
CVE-2024-9615 | Medium | 6.1 | 2024-11-16 | The BulkPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in a… |
CVE-2024-9386 | Medium | 6.4 | 2024-11-16 | The Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in a… |
CVE-2024-9192 | High | 8.8 | 2024-11-16 | The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to privilege escalation due to insufficient validation on user meta… |
CVE-2024-8873 | Medium | 6.1 | 2024-11-16 | The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropri… |
CVE-2024-6628 | Medium | 4.3 | 2024-11-16 | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a… |
CVE-2024-11118 | Medium | 5.3 | 2024-11-16 | The 404 Error Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or inc… |
CVE-2024-11092 | Medium | 6.4 | 2024-11-16 | The SVGPlus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.0 due to… |
CVE-2024-11085 | Medium | 5.4 | 2024-11-16 | The WP Log Viewer plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on several AJAX actions in all vers… |
CVE-2024-10884 | Medium | 6.1 | 2024-11-16 | The SimpleForm Contact Form Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg… |
CVE-2024-10883 | Medium | 6.1 | 2024-11-16 | The SimpleForm – Contact form made simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_a… |
CVE-2024-10875 | Medium | 6.1 | 2024-11-16 | The Gallery Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_Query_Arg without appropriate escaping on the… |
CVE-2024-10533 | Medium | 4.3 | 2024-11-16 | The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install_plugin() function… |
CVE-2024-10262 | Medium | 6.3 | 2024-11-16 | The The Drop Shadow Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.14. This is due to the… |
CVE-2024-10147 | Medium | 6.4 | 2024-11-16 | The Steel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn shortcode in all versions up to, and including, 1.3.0 due to i… |
CVE-2024-10017 | Medium | 6.4 | 2024-11-16 | The PJW Mime Config plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to ins… |
CVE-2024-10015 | Medium | 6.4 | 2024-11-16 | The ConvertCalculator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'type' parameters in all versions up to… |
CVE-2024-10861 | Medium | 5.3 | 2024-11-16 | The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2024-10795 | Medium | 4.3 | 2024-11-16 | The Popularis Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.7 via the 'elementor-template' shortco… |
CVE-2024-10786 | Medium | 4.3 | 2024-11-16 | The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache f… |
CVE-2024-11263 | Critical | 9.3 | 2024-11-15 | When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is… |
CVE-2024-11262 | Medium | 5.3 | 2024-11-15 | A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as critical. Affected by this vulnerability is the functio… |
CVE-2024-9500 | High | 7.8 | 2024-11-15 | A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges t… |
CVE-2024-51765 | Medium | 5.5 | 2024-11-15 | A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on configuration, this vulnerability may lead to local/cl… |
CVE-2024-51764 | Medium | 5.5 | 2024-11-15 | A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerability may lead to lo… |
CVE-2024-50983 | Medium | 5.4 | 2024-11-15 | FlightPath 7.5 contains a Cross Site Scripting (XSS) vulnerability, which allows authenticated remote attackers with administrative rights to inject arbitrary… |
CVE-2024-38370 | Medium | 5.3 | 2024-11-15 | GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from the API without appr… |
CVE-2024-11261 | Medium | 5.3 | 2024-11-15 | A vulnerability, which was classified as critical, was found in SourceCodester Student Record Management System 1.0. Affected is an unknown function of the fil… |
CVE-2024-49592 | Medium | 6.7 | 2024-11-15 | Trial installer for McAfee Total Protection (legacy trial installer software) 16.0.53 allows local privilege escalation because of an Uncontrolled Search Path… |
CVE-2024-49060 | High | 8.8 | 2024-11-15 | Azure Stack HCI Elevation of Privilege Vulnerability |
CVE-2024-45611 | Medium | 5.7 | 2024-11-15 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-45610 | Medium | 6.5 | 2024-11-15 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthent… |
CVE-2024-44758 | Critical | 9.8 | 2024-11-15 | An arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to execute arbitrary c… |
CVE-2024-11217 | Medium | 4.9 | 2024-11-15 | A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs… |
CVE-2024-49536 | Medium | 5.5 | 2024-11-15 | Audition versions 23.6.9, 24.4.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2024-45609 | Medium | 6.5 | 2024-11-15 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated… |
CVE-2024-44759 | High | 7.5 | 2024-11-15 | An arbitrary file download vulnerability in the component /Doc/DownloadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to download arbitrary fil… |
CVE-2024-3334 | Medium | 4.3 | 2024-11-15 | A security bypass vulnerability exists in the Removable Media Encryption (RME)component of Digital Guardian Windows Agents prior to version 8.2.0. This allows… |
CVE-2024-24459 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of S1Setup Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Se… |
CVE-2024-24458 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ENB Configuration Transfer messages containing invalid PLMN Identities in Athonet vEPC MME v11.4.0 allows attackers… |
CVE-2024-24457 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB Setup List Context SURes messages in Athonet vEPC MME v11.4.0 allows attackers to cause… |
CVE-2024-24455 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a… |
CVE-2024-24454 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB Modify Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial… |
CVE-2024-24453 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB NotToBeModifiedBearerModInd information element in Athonet vEPC MME v11.4.0 allows atta… |
CVE-2024-24452 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB Release Indication messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Den… |
CVE-2024-11259 | Low | 3.5 | 2024-11-15 | A vulnerability, which was classified as problematic, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /for… |
CVE-2024-11258 | High | 7.3 | 2024-11-15 | A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. This vulnerability affects unknown code of the file /ad… |
CVE-2024-11257 | High | 7.3 | 2024-11-15 | A vulnerability classified as critical has been found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/fo… |
CVE-2024-11256 | High | 7.3 | 2024-11-15 | A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the fi… |
CVE-2024-10934 | Critical | 9.8 | 2024-11-15 | In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninit… |
CVE-2024-51330 | Medium | 5.1 | 2024-11-15 | An issue in UltiMaker Cura v.4.41 and 5.8.1 and before allows a local attacker to execute arbitrary code via Inter-process communication (IPC) mechanism betwee… |
CVE-2024-51142 | Medium | 5.4 | 2024-11-15 | Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows an attacker to execute arbitrary code via the svkey parameter of the storageapi.php file. |
CVE-2024-51141 | High | 7.8 | 2024-11-15 | An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll compo… |
CVE-2024-51037 | Medium | 5.3 | 2024-11-15 | An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function. |
CVE-2024-45971 | Critical | 9.8 | 2024-11-15 | Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to cau… |
CVE-2024-45970 | Critical | 9.8 | 2024-11-15 | Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to cau… |
CVE-2024-45969 | High | 7.5 | 2024-11-15 | NULL pointer dereference in the MMS Client in MZ Automation LibIEC1850 before commit 7afa40390b26ad1f4cf93deaa0052fe7e357ef33 allows a malicious server to Caus… |
CVE-2024-45608 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17. |
CVE-2024-43418 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflec… |
CVE-2024-43417 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflec… |
CVE-2024-41679 | Medium | 6.5 | 2024-11-15 | GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0… |
CVE-2024-24446 | Medium | 6.5 | 2024-11-15 | An uninitialized pointer dereference in OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted InitialContext… |
CVE-2024-24431 | High | 7.5 | 2024-11-15 | A reachable assertion in the ogs_nas_emm_decode function of Open5GS v2.7.0 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet with a… |
CVE-2024-24426 | High | 7.5 | 2024-11-15 | Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0 allow attackers to cause a Denia… |
CVE-2024-24425 | Medium | 6.5 | 2024-11-15 | Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amf/amf_as.cpp. This… |
CVE-2024-23169 | Medium | 4.6 | 2024-11-15 | The web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule creation. |
CVE-2024-52522 | | 2024-11-15 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --… | |
CVE-2024-52514 | Medium | 4.1 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the us… |
CVE-2024-52513 | Low | 2.6 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to downloa… |
CVE-2024-52512 | Low | 3.3 | 2024-11-15 | user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided UR… |
CVE-2024-52511 | Medium | 6.3 | 2024-11-15 | Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly ins… |
CVE-2024-52510 | Medium | 4.2 | 2024-11-15 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed… |
CVE-2024-52509 | Low | 3.5 | 2024-11-15 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without do… |