2024 CVEs (page 105)
Page 105 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52941 | Medium | 5.4 | 2024-11-18 | An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24695. It allows an authenticated remote attacker to inject a parameter into… |
CVE-2024-11310 | High | 7.5 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. |
CVE-2024-11309 | High | 7.5 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. |
CVE-2024-11308 | Medium | 6.2 | 2024-11-18 | The DVC from TRCore encrypts files using a hardcoded key. Attackers can use this key to decrypt the files and restore the original content. |
CVE-2024-52940 | High | 7.5 | 2024-11-18 | AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must… |
CVE-2024-43704 | High | 8.4 | 2024-11-18 | Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent process. |
CVE-2024-52926 | Medium | 6.5 | 2024-11-18 | Delinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent. |
CVE-2024-52922 | Medium | 6.5 | 2024-11-18 | In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stall… |
CVE-2024-52921 | Medium | 5.3 | 2024-11-18 | In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block. |
CVE-2024-52920 | High | 7.5 | 2024-11-18 | Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message. |
CVE-2024-52919 | Medium | 6.5 | 2024-11-18 | Bitcoin Core before 22.0 has a CAddrMan nIdCount integer overflow and resultant assertion failure (and daemon exit) via a flood of addr messages. |
CVE-2024-52918 | Medium | 6.5 | 2024-11-18 | Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) via a BIP21 r paramete… |
CVE-2024-52917 | Medium | 6.5 | 2024-11-18 | Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH… |
CVE-2024-52916 | High | 7.5 | 2024-11-18 | Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers. |
CVE-2024-52915 | High | 7.5 | 2024-11-18 | Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message. |
CVE-2024-52914 | High | 7.5 | 2024-11-18 | In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction. |
CVE-2024-52913 | Medium | 5.3 | 2024-11-18 | In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled. |
CVE-2024-52912 | High | 7.5 | 2024-11-18 | Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an ab… |
CVE-2024-38828 | Medium | 5.3 | 2024-11-18 | Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack. |
CVE-2024-11306 | Medium | 5.3 | 2024-11-18 | A vulnerability, which was classified as critical, has been found in Altenergy Power Control Software up to 20241108. This issue affects some unknown processin… |
CVE-2024-11305 | Medium | 6.3 | 2024-11-18 | A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function get_status_zigbee… |
CVE-2024-0793 | High | 7.7 | 2024-11-17 | A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes… |
CVE-2024-52876 | High | 7.5 | 2024-11-17 | Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions… |
CVE-2024-52872 | High | 7.5 | 2024-11-17 | In Flagsmith before 2.134.1, the get_document endpoint is not correctly protected by permissions. |
CVE-2024-52871 | High | 7.5 | 2024-11-17 | In Flagsmith before 2.134.1, it is possible to bypass the ALLOW_REGISTRATION_WITHOUT_INVITE setting. |
CVE-2024-52867 | High | 8.1 | 2024-11-17 | guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns (e.g., for… |
CVE-2024-52397 | Critical | 9.1 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Davor Zeljkovic Convert Docx2post convert-docx2post allows Upload a Web Shell to a Web Server… |
CVE-2024-52416 | Critical | 10.0 | 2024-11-16 | Missing Authorization vulnerability in Eugen Bobrowski Debug Tool debug-tool allows Upload a Web Shell to a Web Server.This issue affects Debug Tool: from n/a… |
CVE-2024-52415 | High | 8.8 | 2024-11-16 | Cross-Site Request Forgery (CSRF) vulnerability in skipstorm SK WP Settings Backup sk-wp-settings-backup allows Object Injection.This issue affects SK WP Setti… |
CVE-2024-52414 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu wdes-responsive-mobile-menu allows Object Injection.This issue af… |
CVE-2024-52413 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in dmcwebzone Airin Blog airin-blog allows Object Injection.This issue affects Airin Blog: from n/a through <=… |
CVE-2024-52412 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Stephen Cui Xin allows Object Injection.This issue affects Xin: from n/a through 1.0.8.1. |
CVE-2024-52411 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in flowcraft Advanced Personalization personalization-by-flowcraft allows Object Injection.This issue affects A… |
CVE-2024-52410 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Phoenixheart Referrer Detector referrer-detector allows Object Injection.This issue affects Referrer Detecto… |
CVE-2024-52409 | Critical | 9.8 | 2024-11-16 | Deserialization of Untrusted Data vulnerability in Phoenixheart AJAX Random Posts ajax-random-posts allows Object Injection.This issue affects AJAX Random Post… |
CVE-2024-52408 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in pushassist Push Notifications for WordPress by PushAssist push-notification-for-wp-by-pushassi… |
CVE-2024-52407 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in BasePress BasePress Migration Tools basepress-migration-tools allows Upload a Web Shell to a W… |
CVE-2024-52406 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in wibergsweb CSV to html csv-to-html allows Upload a Web Shell to a Web Server.This issue affect… |
CVE-2024-52405 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in bikramjoshii B-Banner Slider b-banner-slider allows Upload a Web Shell to a Web Server.This is… |
CVE-2024-52404 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in bigfiveagency CF7 Reply Manager cf7-reply-manager.This issue affects CF7 Reply Manager: from n… |
CVE-2024-52403 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Saad Iqbal User Management user-management allows Upload a Web Shell to a Web Server.This issu… |
CVE-2024-52400 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Subhasis Laha Gallerio gallerio allows Upload a Web Shell to a Web Server.This issue affects G… |
CVE-2024-52399 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Clarisse K. Writer Helper writer-helper allows Upload a Web Shell to a Web Server.This issue a… |
CVE-2024-52398 | Critical | 9.1 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Halyra CDI collect-and-deliver-interface-for-woocommerce.This issue affects CDI: from n/a thro… |
CVE-2024-52386 | Medium | 5.3 | 2024-11-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classif… |
CVE-2024-9887 | High | 7.2 | 2024-11-16 | The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to… |
CVE-2024-11094 | Medium | 5.3 | 2024-11-16 | The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the export feature. Thi… |
CVE-2024-10592 | Medium | 6.4 | 2024-11-16 | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup class parameter in all versions up to, and including, 1.6.0… |
CVE-2024-10645 | High | 7.5 | 2024-11-16 | The Blogger 301 Redirect plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘br’ parameter in all versions up to, and including, 2.5… |
CVE-2024-10614 | Medium | 4.3 | 2024-11-16 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cancel_import() functio… |
CVE-2024-8856 | Critical | 9.8 | 2024-11-16 | The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHan… |
CVE-2024-10728 | High | 8.8 | 2024-11-16 | The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a mis… |
CVE-2024-9938 | Medium | 6.1 | 2024-11-16 | The Bounce Handler MailPoet 3 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and includin… |
CVE-2024-9935 | High | 7.5 | 2024-11-16 | The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw… |
CVE-2024-9850 | Medium | 6.4 | 2024-11-16 | The SVG Case Study plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insu… |
CVE-2024-9849 | High | 8.8 | 2024-11-16 | The Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati… |
CVE-2024-9839 | High | 7.3 | 2024-11-16 | The The Uix Slideshow plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.5. This is due to the softw… |
CVE-2024-9615 | Medium | 6.1 | 2024-11-16 | The BulkPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in a… |
CVE-2024-9386 | Medium | 6.4 | 2024-11-16 | The Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in a… |
CVE-2024-9192 | High | 8.8 | 2024-11-16 | The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to privilege escalation due to insufficient validation on user meta… |
CVE-2024-8873 | Medium | 6.1 | 2024-11-16 | The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropri… |
CVE-2024-6628 | Medium | 4.3 | 2024-11-16 | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a… |
CVE-2024-11118 | Medium | 5.3 | 2024-11-16 | The 404 Error Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or inc… |
CVE-2024-11092 | Medium | 6.4 | 2024-11-16 | The SVGPlus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.0 due to… |
CVE-2024-11085 | Medium | 5.4 | 2024-11-16 | The WP Log Viewer plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on several AJAX actions in all vers… |
CVE-2024-10884 | Medium | 6.1 | 2024-11-16 | The SimpleForm Contact Form Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg… |
CVE-2024-10883 | Medium | 6.1 | 2024-11-16 | The SimpleForm – Contact form made simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_a… |
CVE-2024-10875 | Medium | 6.1 | 2024-11-16 | The Gallery Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_Query_Arg without appropriate escaping on the… |
CVE-2024-10533 | Medium | 4.3 | 2024-11-16 | The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install_plugin() function… |
CVE-2024-10262 | Medium | 6.3 | 2024-11-16 | The The Drop Shadow Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.14. This is due to the… |
CVE-2024-10147 | Medium | 6.4 | 2024-11-16 | The Steel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn shortcode in all versions up to, and including, 1.3.0 due to i… |
CVE-2024-10017 | Medium | 6.4 | 2024-11-16 | The PJW Mime Config plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to ins… |
CVE-2024-10015 | Medium | 6.4 | 2024-11-16 | The ConvertCalculator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'type' parameters in all versions up to… |
CVE-2024-10861 | Medium | 5.3 | 2024-11-16 | The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2024-10795 | Medium | 4.3 | 2024-11-16 | The Popularis Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.7 via the 'elementor-template' shortco… |
CVE-2024-10786 | Medium | 4.3 | 2024-11-16 | The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache f… |
CVE-2024-11263 | Critical | 9.3 | 2024-11-15 | When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is… |
CVE-2024-11262 | Medium | 5.3 | 2024-11-15 | A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as critical. Affected by this vulnerability is the functio… |
CVE-2024-9500 | High | 7.8 | 2024-11-15 | A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges t… |
CVE-2024-51765 | Medium | 5.5 | 2024-11-15 | A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on configuration, this vulnerability may lead to local/cl… |
CVE-2024-51764 | Medium | 5.5 | 2024-11-15 | A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerability may lead to lo… |
CVE-2024-50983 | Medium | 5.4 | 2024-11-15 | FlightPath 7.5 contains a Cross Site Scripting (XSS) vulnerability, which allows authenticated remote attackers with administrative rights to inject arbitrary… |
CVE-2024-38370 | Medium | 5.3 | 2024-11-15 | GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from the API without appr… |
CVE-2024-11261 | Medium | 5.3 | 2024-11-15 | A vulnerability, which was classified as critical, was found in SourceCodester Student Record Management System 1.0. Affected is an unknown function of the fil… |
CVE-2024-49592 | Medium | 6.7 | 2024-11-15 | Trial installer for McAfee Total Protection (legacy trial installer software) 16.0.53 allows local privilege escalation because of an Uncontrolled Search Path… |
CVE-2024-49060 | High | 8.8 | 2024-11-15 | Azure Stack HCI Elevation of Privilege Vulnerability |
CVE-2024-45611 | Medium | 5.7 | 2024-11-15 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-45610 | Medium | 6.5 | 2024-11-15 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthent… |
CVE-2024-44758 | Critical | 9.8 | 2024-11-15 | An arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to execute arbitrary c… |
CVE-2024-11217 | Medium | 4.9 | 2024-11-15 | A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs… |
CVE-2024-49536 | Medium | 5.5 | 2024-11-15 | Audition versions 23.6.9, 24.4.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2024-45609 | Medium | 6.5 | 2024-11-15 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated… |
CVE-2024-44759 | High | 7.5 | 2024-11-15 | An arbitrary file download vulnerability in the component /Doc/DownloadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to download arbitrary fil… |
CVE-2024-3334 | Medium | 4.3 | 2024-11-15 | A security bypass vulnerability exists in the Removable Media Encryption (RME)component of Digital Guardian Windows Agents prior to version 8.2.0. This allows… |
CVE-2024-24459 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of S1Setup Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Se… |
CVE-2024-24458 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ENB Configuration Transfer messages containing invalid PLMN Identities in Athonet vEPC MME v11.4.0 allows attackers… |
CVE-2024-24457 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB Setup List Context SURes messages in Athonet vEPC MME v11.4.0 allows attackers to cause… |
CVE-2024-24455 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a… |
CVE-2024-24454 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB Modify Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial… |
CVE-2024-24453 | Medium | 5.9 | 2024-11-15 | An invalid memory access when handling the ProtocolIE_ID field of E-RAB NotToBeModifiedBearerModInd information element in Athonet vEPC MME v11.4.0 allows atta… |