2024 CVEs (page 107)
Page 107 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11237 | High | 7.5 | 2024-11-15 | A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of… |
CVE-2024-1240 | Medium | 6.1 | 2024-11-15 | An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login fun… |
CVE-2024-1097 | Medium | 5.4 | 2024-11-15 | A stored cross-site scripting (XSS) vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while… |
CVE-2024-11182 | Medium | 6.1 | 2024-11-15 | An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This… |
CVE-2024-10534 | Critical | 9.8 | 2024-11-15 | Origin Validation Error vulnerability in Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) allows Traff… |
CVE-2024-10443 | Critical | 9.8 | 2024-11-15 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before… |
CVE-2024-0875 | Medium | 4.8 | 2024-11-15 | A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field… |
CVE-2024-0787 | Medium | 5.9 | 2024-11-15 | phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded… |
CVE-2024-8979 | High | 8.0 | 2024-11-15 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Info… |
CVE-2024-8978 | Medium | 5.7 | 2024-11-15 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Info… |
CVE-2024-10311 | High | 7.5 | 2024-11-15 | The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing… |
CVE-2024-45784 | High | 7.5 | 2024-11-15 | Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG a… |
CVE-2024-9529 | Medium | 6.6 | 2024-11-15 | The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin befor… |
CVE-2024-8961 | Medium | 6.4 | 2024-11-15 | The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-S… |
CVE-2024-10825 | Medium | 6.1 | 2024-11-15 | The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and includin… |
CVE-2024-10104 | Medium | 5.9 | 2024-11-15 | The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users such as contributor to… |
CVE-2024-9356 | Medium | 6.1 | 2024-11-15 | The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpo_user_email' and 'yotpo_u… |
CVE-2024-42499 | Medium | 5.3 | 2024-11-15 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is ex… |
CVE-2024-39610 | Medium | 6.1 | 2024-11-15 | Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script may be executed on th… |
CVE-2024-10793 | High | 7.2 | 2024-11-15 | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due… |
CVE-2024-10582 | Medium | 4.3 | 2024-11-15 | The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil… |
CVE-2024-10260 | High | 7.2 | 2024-11-15 | The Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 8.0.11 due to insufficien… |
CVE-2024-10113 | Medium | 6.4 | 2024-11-15 | The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpadcenter_ad shortcode in all ve… |
CVE-2024-9609 | Medium | 6.1 | 2024-11-15 | The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_impo… |
CVE-2024-10897 | Medium | 4.3 | 2024-11-15 | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_de… |
CVE-2024-10924 | Critical | 9.8 | 2024-11-15 | The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is d… |
CVE-2024-11120 | Critical | 9.8 | 2024-11-15 | Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute… |
CVE-2024-52613 | Medium | 5.5 | 2024-11-14 | A heap-based buffer under-read in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) via a crafted MOV video file. |
CVE-2024-52308 | High | 8.0 | 2024-11-14 | The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh… |
CVE-2024-49778 | High | 8.8 | 2024-11-14 | A heap-based buffer overflow in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) and Code Execution via a crafted… |
CVE-2024-49777 | High | 8.8 | 2024-11-14 | A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS), Information Disclosure and Code… |
CVE-2024-49776 | Medium | 6.5 | 2024-11-14 | A negative-size-param in tsMuxer version nightly-2024-04-05-01-53-02 allows attackers to cause Denial of Service (DoS) via a crafted TS video file. |
CVE-2024-41217 | Medium | 6.5 | 2024-11-14 | A heap-based buffer overflow in tsMuxer version nightly-2024-05-10-02-00-45 allows attackers to cause Denial of Service (DoS) via a crafted MKV video file. |
CVE-2024-41209 | High | 8.8 | 2024-11-14 | A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS) and Code Execution via a crafted… |
CVE-2024-41206 | Medium | 6.5 | 2024-11-14 | A stack-based buffer over-read in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Information Disclosure via a crafted TS video file. |
CVE-2024-51679 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in gentlesource Appointmind appointmind allows Stored XSS.This issue affects Appointmind: from n/a through <= 4… |
CVE-2024-51659 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in GeekRMX Twitter @Anywhere Plus twitter-anywhere-plus allows Stored XSS.This issue affects Twitter @Anywhere… |
CVE-2024-51658 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from… |
CVE-2024-51156 | Medium | 4.7 | 2024-11-14 | 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component 'erp.07fly.net:80/admin/SysNotifyUser/del.html?id=93'. |
CVE-2024-50968 | High | 7.5 | 2024-11-14 | A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to man… |
CVE-2024-48974 | Critical | 9.3 | 2024-11-14 | The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized chang… |
CVE-2024-48973 | Critical | 9.3 | 2024-11-14 | The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which… |
CVE-2024-48971 | Critical | 9.3 | 2024-11-14 | The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the pa… |
CVE-2024-48970 | Critical | 9.3 | 2024-11-14 | The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an o… |
CVE-2024-48967 | Critical | 10.0 | 2024-11-14 | The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination… |
CVE-2024-48966 | Critical | 10.0 | 2024-11-14 | The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC w… |
CVE-2024-40579 | Medium | 5.4 | 2024-11-14 | Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive information via modifi… |
CVE-2024-39707 | Medium | 5.3 | 2024-11-14 | Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible ro… |
CVE-2024-31695 | Critical | 9.8 | 2024-11-14 | A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authentication when adding… |
CVE-2024-9834 | Critical | 9.3 | 2024-11-14 | Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of in… |
CVE-2024-9832 | Critical | 9.3 | 2024-11-14 | There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execu… |
CVE-2024-51687 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in Platform.ly Platform.ly Official platformly allows Stored XSS.This issue affects Platform.ly Official: from… |
CVE-2024-51684 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu W3P SEO wp-perfect-plugin allows Stored XSS.This issue affects W3P SEO: from n/a through < 1… |
CVE-2024-51688 | High | 7.1 | 2024-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in fraudlabspro FraudLabs Pro SMS Verification fraudlabs-pro-sms-verification allows Stored XSS.This issue affe… |
CVE-2024-49025 | Medium | 5.4 | 2024-11-14 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-10397 | High | 7.8 | 2024-11-14 | A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code. |
CVE-2024-10396 | Medium | 6.5 | 2024-11-14 | An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and… |
CVE-2024-10394 | High | 7.8 | 2024-11-14 | A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existin… |
CVE-2024-52370 | Critical | 9.9 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Hive Support Hive Support hive-support allows Upload a Web Shell to a Web Server.This issue af… |
CVE-2024-52369 | Critical | 9.9 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Optimal Access KBucket kbucket allows Upload a Web Shell to a Web Server.This issue affects KB… |
CVE-2024-3760 | High | 7.5 | 2024-11-14 | In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bombing vulnerability. Attackers can explo… |
CVE-2024-5125 | High | 7.3 | 2024-11-14 | parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files… |
CVE-2024-52524 | | 2024-11-14 | Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub… | |
CVE-2024-52396 | Medium | 4.9 | 2024-11-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue af… |
CVE-2024-52393 | Critical | 9.1 | 2024-11-14 | Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Po… |
CVE-2024-52384 | Critical | 9.9 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in wpmonks Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation ai-content-gen… |
CVE-2024-52383 | High | 7.5 | 2024-11-14 | Missing Authorization vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Exploiting Incorr… |
CVE-2024-52382 | Critical | 9.8 | 2024-11-14 | Missing Authorization vulnerability in medmatech Matix Popup Builder medma-matix allows Privilege Escalation.This issue affects Matix Popup Builder: from n/a t… |
CVE-2024-52381 | High | 8.1 | 2024-11-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Shoaib Rehmat ZIJ KART zij-kart allows… |
CVE-2024-52380 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in softpulseinfotech Picsmize picsmize allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2024-52379 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in faizalbahasan kineticPay for WooCommerce kineticpay-for-woocommerce allows Upload a Web Shell… |
CVE-2024-52378 | High | 7.5 | 2024-11-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 DigiPass digipass allows Absolute Path Traversal.This is… |
CVE-2024-52377 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in bdthemes Instant Image Generator ai-image allows Upload a Web Shell to a Web Server.This issue… |
CVE-2024-52376 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress boat-rental-system allows Upload a Web Shell to a We… |
CVE-2024-52375 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Arttia Creative Datasets Manager by Arttia Creative datasets-manager-by-arttia-creative.This i… |
CVE-2024-52374 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in DoThatTask Do That Task do-that-task allows Upload a Web Shell to a Web Server.This issue affe… |
CVE-2024-52373 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Team Devexhub Devexhub Gallery devexhub-gallery allows Upload a Web Shell to a Web Server.This… |
CVE-2024-52372 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in WebTechGlobal Easy CSV Importer BETA easy-csv-importer allows Upload a Web Shell to a Web Serv… |
CVE-2024-52371 | High | 8.6 | 2024-11-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway | globe-gateway-e4… |
CVE-2024-50831 | High | 7.2 | 2024-11-14 | A SQL Injection was found in /admin/admin_user.php in kashipara E-learning Management System Project 1.0 via the username and password parameters. |
CVE-2024-50830 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/calendar_of_events.php in kashipara E-learning Management System Project 1.0 via the date_start, date_end, an… |
CVE-2024-50829 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/edit_subject.php in kashipara E-learning Management System Project 1.0 via the unit parameter. |
CVE-2024-50828 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/edit_department.php in kashipara E-learning Management System Project 1.0 via the d parameter. |
CVE-2024-50827 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/add_subject.php in kashipara E-learning Management System Project 1.0 via the subject_code parameter. |
CVE-2024-50826 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/add_content.php in kashipara E-learning Management System Project 1.0 via the title and content parameters. |
CVE-2024-50825 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/school_year.php in kashipara E-learning Management System Project 1.0 via the school_year parameter. |
CVE-2024-50824 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/class.php in kashipara E-learning Management System Project 1.0 via the class_name parameter. |
CVE-2024-50823 | Critical | 9.8 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/login.php in kashipara E-learning Management System Project 1.0 via the username and password parameters. |
CVE-2024-4343 | Critical | 9.8 | 2024-11-14 | A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of… |
CVE-2024-4311 | Medium | 5.4 | 2024-11-14 | zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-forc… |
CVE-2024-49362 | High | 7.7 | 2024-11-14 | Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user click… |
CVE-2024-48284 | Medium | 4.8 | 2024-11-14 | A Reflected Cross-Site Scripting (XSS) vulnerability was found in the /search-result.php page of the PHPGurukul User Registration & Login and User Management S… |
CVE-2024-3502 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently… |
CVE-2024-3501 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the respons… |
CVE-2024-3379 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged users to re-generate the private key for project… |
CVE-2024-1682 | Medium | 4.3 | 2024-11-14 | An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external… |
CVE-2024-6068 | High | 7.3 | 2024-11-14 | A memory corruption vulnerability exists in the affected products when parsing DFT files. Local threat actors can exploit this issue to disclose information a… |
CVE-2024-50836 | Medium | 4.8 | 2024-11-14 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability al… |
CVE-2024-50835 | High | 7.2 | 2024-11-14 | A SQL Injection vulnerability was found in /admin/edit_student.php in KASHIPARA E-learning Management System Project 1.0 via the cys, un, ln, fn, and id parame… |
CVE-2024-50834 | High | 7.2 | 2024-11-14 | A SQL Injection was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0 via the firstname and lastname parameters. |