2024 CVEs (page 11)
Page 11 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-48853 | Critical | 9.0 | 2025-05-22 | An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as a "non" root ASPECT user. This issue aff… |
CVE-2024-48850 | High | 7.2 | 2025-05-22 | Absolute File Traversal vulnerabilities in ASPECT allows access and modification of unintended resources. This issue affects ASPECT-Enterprise: through 3.08.03… |
CVE-2024-54188 | Medium | 5.3 | 2025-05-22 | Infoblox NETMRI before 7.6.1 has a vulnerability allowing remote authenticated users to read arbitrary files with root access. |
CVE-2024-12093 | Medium | 6.8 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath vali… |
CVE-2024-25010 | High | 8.8 | 2025-05-22 | Ericsson RAN Compute and Site Controller 6610 contains in certain configurations a high severity vulnerability where improper input validation could be exploit… |
CVE-2024-9544 | Medium | 6.4 | 2025-05-22 | The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 8.6.4 due to insufficie… |
CVE-2024-57529 | Medium | 6.1 | 2025-05-21 | Cross Site Scripting vulnerability in Jeppesen JetPlanner Pro v.1.6.2.20 allows a remote attacker to execute arbitrary code. |
CVE-2024-56428 | Medium | 5.5 | 2025-05-21 | The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for their servers configu… |
CVE-2024-23337 | Medium | 4.3 | 2025-05-21 | jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the s… |
CVE-2024-56429 | High | 7.7 | 2025-05-21 | itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users to read or write to the database. |
CVE-2024-42922 | Medium | 6.5 | 2025-05-21 | AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability. |
CVE-2024-12561 | Medium | 6.1 | 2025-05-21 | The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.0.0. This i… |
CVE-2024-45641 | Medium | 6.5 | 2025-05-20 | IBM Security ReaQta EDR 3.12 could allow an attacker to perform unauthorized actions due to improper SSL certificate validation. |
CVE-2024-53359 | High | 7.5 | 2025-05-20 | An issue in Zalo v23.09.01 allows attackers to obtain sensitive user information via a crafted GET request. |
CVE-2024-5878 | Medium | 6.4 | 2025-05-20 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in vari… |
CVE-2024-33939 | Medium | 5.3 | 2025-05-19 | Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - L… |
CVE-2024-55063 | High | 8.8 | 2025-05-19 | Multiple Code Injection vulnerabilities in EasyVirt DC NetScope <= 8.7.0 allows remote authenticated attackers to execute arbitrary code via the (1) lang param… |
CVE-2024-51106 | Medium | 4.6 | 2025-05-19 | A cross-site scripting (XSS) vulnerability in the component mcgs/admin/aboutus.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows… |
CVE-2024-13613 | High | 7.5 | 2025-05-17 | The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uploads' directory. Thi… |
CVE-2024-47893 | Medium | 6.5 | 2025-05-17 | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside the Guest's virtualis… |
CVE-2024-40120 | Medium | 6.5 | 2025-05-16 | seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_store.go. |
CVE-2024-53827 | High | 7.5 | 2025-05-16 | Ericsson Packet Core Controller (PCC) contains a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degrada… |
CVE-2024-8201 | Medium | 5.4 | 2025-05-16 | Cross-Site WebSocket Hijacking vulnerability in Hitachi Ops Center Analyzer (RAID Agent component).This issue affects Hitachi Ops Center Analyzer: from 10.8.0-… |
CVE-2024-51475 | Medium | 5.4 | 2025-05-16 | IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would b… |
CVE-2024-9882 | Medium | 4.8 | 2025-05-15 | The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its set… |
CVE-2024-9879 | Medium | 5.4 | 2025-05-15 | The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perfor… |
CVE-2024-9838 | Medium | 5.4 | 2025-05-15 | The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform… |
CVE-2024-9831 | High | 7.2 | 2025-05-15 | The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL inje… |
CVE-2024-9765 | Medium | 6.5 | 2025-05-15 | The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory |
CVE-2024-9711 | Medium | 5.4 | 2025-05-15 | The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2024-9709 | Medium | 5.4 | 2025-05-15 | The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2024-9663 | Medium | 5.4 | 2025-05-15 | The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-9662 | Medium | 5.4 | 2025-05-15 | The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-9645 | Medium | 5.4 | 2025-05-15 | The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options be… |
CVE-2024-9599 | Medium | 5.4 | 2025-05-15 | The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-9450 | Medium | 6.5 | 2025-05-15 | The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, w… |
CVE-2024-9390 | Medium | 4.8 | 2025-05-15 | The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-9238 | Medium | 5.4 | 2025-05-15 | The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a maliciou… |
CVE-2024-9236 | Medium | 4.8 | 2025-05-15 | The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor… |
CVE-2024-9233 | Medium | 4.3 | 2025-05-15 | The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-9227 | Medium | 4.8 | 2025-05-15 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which coul… |
CVE-2024-9182 | Medium | 4.8 | 2025-05-15 | The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cr… |
CVE-2024-8854 | Medium | 5.4 | 2025-05-15 | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to per… |
CVE-2024-8851 | Medium | 5.4 | 2025-05-15 | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to per… |
CVE-2024-8759 | Medium | 4.8 | 2025-05-15 | The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-8703 | Medium | 6.1 | 2025-05-15 | The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated… |
CVE-2024-8702 | Medium | 4.8 | 2025-05-15 | The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-8701 | Medium | 4.8 | 2025-05-15 | The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8700 | High | 7.5 | 2025-05-15 | The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calend… |
CVE-2024-8699 | High | 7.2 | 2025-05-15 | The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files… |
CVE-2024-8673 | Critical | 9.1 | 2025-05-15 | The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript. |
CVE-2024-8670 | Medium | 4.8 | 2025-05-15 | The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-8620 | Medium | 4.8 | 2025-05-15 | The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8619 | Medium | 4.8 | 2025-05-15 | The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-8618 | Medium | 4.8 | 2025-05-15 | The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-8617 | Medium | 4.8 | 2025-05-15 | The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perfo… |
CVE-2024-8542 | Medium | 4.8 | 2025-05-15 | The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8493 | Medium | 4.8 | 2025-05-15 | The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-8492 | Medium | 4.8 | 2025-05-15 | The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform… |
CVE-2024-8426 | Medium | 4.8 | 2025-05-15 | The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-8398 | Medium | 4.3 | 2025-05-15 | The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logg… |
CVE-2024-8397 | Medium | 5.4 | 2025-05-15 | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to co… |
CVE-2024-8286 | Medium | 6.5 | 2025-05-15 | The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in a… |
CVE-2024-8284 | Medium | 4.8 | 2025-05-15 | The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors t… |
CVE-2024-8245 | Medium | 4.3 | 2025-05-15 | The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admi… |
CVE-2024-8187 | Medium | 4.8 | 2025-05-15 | The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-8095 | Medium | 6.1 | 2025-05-15 | The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacker… |
CVE-2024-8094 | Medium | 6.5 | 2025-05-15 | The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-8090 | Medium | 6.1 | 2025-05-15 | The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow a… |
CVE-2024-8085 | Medium | 6.1 | 2025-05-15 | The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attac… |
CVE-2024-8082 | Medium | 4.3 | 2025-05-15 | The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-8050 | Medium | 4.3 | 2025-05-15 | The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logge… |
CVE-2024-8032 | Medium | 6.1 | 2025-05-15 | The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which cou… |
CVE-2024-8031 | Medium | 6.5 | 2025-05-15 | The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authentic… |
CVE-2024-8009 | Medium | 4.3 | 2025-05-15 | The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page |
CVE-2024-7984 | Medium | 4.3 | 2025-05-15 | The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-7769 | Medium | 4.8 | 2025-05-15 | The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-7762 | Low | 3.7 | 2025-05-15 | The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download up… |
CVE-2024-7761 | Medium | 6.1 | 2025-05-15 | In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of t… |
CVE-2024-7759 | Medium | 4.8 | 2025-05-15 | The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-7758 | Medium | 4.8 | 2025-05-15 | The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor… |
CVE-2024-7556 | Medium | 4.8 | 2025-05-15 | The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-6809 | Critical | 9.8 | 2025-05-15 | The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX actio… |
CVE-2024-6798 | Medium | 4.8 | 2025-05-15 | The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-6797 | Medium | 4.8 | 2025-05-15 | The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-6719 | High | 8.1 | 2025-05-15 | The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update… |
CVE-2024-6718 | Medium | 5.4 | 2025-05-15 | The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2024-6713 | Medium | 4.8 | 2025-05-15 | The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-6712 | Medium | 6.1 | 2025-05-15 | The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow at… |
CVE-2024-6711 | Low | 3.5 | 2025-05-15 | The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as… |
CVE-2024-6708 | Medium | 4.8 | 2025-05-15 | The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which al… |
CVE-2024-6693 | Medium | 4.8 | 2025-05-15 | The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-6690 | Medium | 6.1 | 2025-05-15 | The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites |
CVE-2024-6668 | Medium | 5.4 | 2025-05-15 | The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role… |
CVE-2024-6667 | Medium | 6.1 | 2025-05-15 | The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a… |
CVE-2024-6665 | Medium | 4.8 | 2025-05-15 | The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users su… |
CVE-2024-6584 | Critical | 9.1 | 2025-05-15 | The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs. |
CVE-2024-6486 | High | 7.2 | 2025-05-15 | The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This… |
CVE-2024-6478 | Medium | 4.8 | 2025-05-15 | The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2024-6462 | Medium | 4.8 | 2025-05-15 | The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |