2024 CVEs (page 110)
Page 110 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52293 | High | 7.2 | 2024-11-13 | Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Re… |
CVE-2024-50972 | High | 7.2 | 2024-11-13 | A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via… |
CVE-2024-50971 | High | 7.2 | 2024-11-13 | A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the… |
CVE-2024-50970 | High | 8.8 | 2024-11-13 | A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arbitrary SQL commands… |
CVE-2024-50969 | Medium | 6.1 | 2024-11-13 | A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbitrary web scripts o… |
CVE-2024-11175 | Low | 3.5 | 2024-11-13 | A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of… |
CVE-2024-10013 | High | 7.8 | 2024-11-13 | In Progress Telerik UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerabil… |
CVE-2024-10012 | High | 7.8 | 2024-11-13 | In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1111), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-9477 | Medium | 6.1 | 2024-11-13 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripti… |
CVE-2024-50854 | High | 8.8 | 2024-11-13 | Tenda G3 v3.0 v15.11.0.20 was discovered to contain a stack overflow via the formSetPortMapping function. |
CVE-2024-50853 | High | 8.8 | 2024-11-13 | Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetDebugCfg function. |
CVE-2024-50852 | High | 8.8 | 2024-11-13 | Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetUSBPartitionUmount function. |
CVE-2024-49506 | | 2024-11-13 | Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a f… | |
CVE-2024-49505 | Medium | 6.1 | 2024-11-13 | A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of… |
CVE-2024-49504 | | 2024-11-13 | grub2 allowed attackers with access to the grub shell to access files on the encrypted disks. | |
CVE-2024-48900 | Medium | 4.3 | 2024-11-13 | A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those the… |
CVE-2024-48510 | Critical | 9.8 | 2024-11-13 | Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.c… |
CVE-2024-11165 | | 2024-11-13 | An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversi… | |
CVE-2024-48989 | High | 7.5 | 2024-11-13 | A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, renderi… |
CVE-2024-11159 | Medium | 4.3 | 2024-11-13 | Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird <… |
CVE-2024-47574 | High | 7.8 | 2024-11-13 | A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through… |
CVE-2024-4741 | High | 7.5 | 2024-11-13 | Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary… |
CVE-2024-8001 | Medium | 5.3 | 2024-11-13 | A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulati… |
CVE-2024-11028 | Critical | 9.8 | 2024-11-13 | The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including… |
CVE-2024-9682 | Medium | 6.4 | 2024-11-13 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Form Builder widget in all versions… |
CVE-2024-9668 | Medium | 6.4 | 2024-11-13 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up… |
CVE-2024-9059 | Medium | 6.4 | 2024-11-13 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, an… |
CVE-2024-10877 | Medium | 6.1 | 2024-11-13 | The AFI – The Easiest Integration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_ar… |
CVE-2024-52268 | Medium | 4.8 | 2024-11-13 | Cross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. If this vulnerability is exploited, an arbitrary script… |
CVE-2024-9409 | High | 7.5 | 2024-11-13 | CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communication loss when a la… |
CVE-2024-8938 | High | 8.1 | 2024-11-13 | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution aft… |
CVE-2024-8937 | Medium | 6.5 | 2024-11-13 | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution aft… |
CVE-2024-8936 | Medium | 6.5 | 2024-11-13 | CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Man-In-The-Middle att… |
CVE-2024-8935 | High | 7.5 | 2024-11-13 | CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integrity of controllers w… |
CVE-2024-21541 | High | 7.3 | 2024-11-13 | Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sani… |
CVE-2024-11150 | Critical | 9.8 | 2024-11-13 | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_upload… |
CVE-2024-10800 | High | 8.8 | 2024-11-13 | The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_save_fields() function… |
CVE-2024-10575 | Critical | 9.8 | 2024-11-13 | CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected device… |
CVE-2024-8933 | High | 7.5 | 2024-11-13 | CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password h… |
CVE-2024-10828 | High | 8.1 | 2024-11-13 | The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserializ… |
CVE-2024-10820 | Critical | 9.8 | 2024-11-13 | The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in… |
CVE-2024-10816 | High | 7.5 | 2024-11-13 | The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.24.01.24 via the js/fallback.php file… |
CVE-2024-10802 | Medium | 5.3 | 2024-11-13 | The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_i… |
CVE-2024-10794 | Medium | 4.3 | 2024-11-13 | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.6 via the… |
CVE-2024-10174 | High | 7.3 | 2024-11-13 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direc… |
CVE-2024-11143 | Medium | 4.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.8. This is due t… |
CVE-2024-10882 | Medium | 6.1 | 2024-11-13 | The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_… |
CVE-2024-10684 | Medium | 6.1 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dir' parameter in all versions up to, and inc… |
CVE-2024-10593 | Medium | 4.3 | 2024-11-13 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery… |
CVE-2024-10531 | Medium | 5.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_ass… |
CVE-2024-10530 | Medium | 4.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the add_new_as… |
CVE-2024-10529 | Medium | 5.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_ass… |
CVE-2024-9614 | Medium | 6.1 | 2024-11-13 | The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriat… |
CVE-2024-9578 | Medium | 5.3 | 2024-11-13 | The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to do_shortcode being hooked through the comment_text filter in all v… |
CVE-2024-9426 | Medium | 6.4 | 2024-11-13 | The Aqua SVG Sprite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.14 due to… |
CVE-2024-8985 | Medium | 6.4 | 2024-11-13 | The Social Proof (Testimonial) Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spslider-block shortcode in all versio… |
CVE-2024-8874 | Medium | 6.1 | 2024-11-13 | The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg… |
CVE-2024-39712 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated… |
CVE-2024-39711 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticate… |
CVE-2024-39710 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated… |
CVE-2024-39709 | High | 7.8 | 2024-11-13 | Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applica… |
CVE-2024-38656 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated… |
CVE-2024-38655 | High | 7.2 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote… |
CVE-2024-38654 | Medium | 4.4 | 2024-11-13 | Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges to cause a denial of… |
CVE-2024-38649 | High | 7.5 | 2024-11-13 | An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated attacker to cause a d… |
CVE-2024-37400 | High | 7.5 | 2024-11-13 | An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial o… |
CVE-2024-37398 | High | 7.8 | 2024-11-13 | Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. |
CVE-2024-37376 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-34787 | High | 7.8 | 2024-11-13 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to… |
CVE-2024-34784 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-34782 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-34781 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-34780 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-32847 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-32844 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-32841 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-32839 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-29211 | Medium | 4.7 | 2024-11-13 | A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuration files. |
CVE-2024-10887 | Medium | 6.4 | 2024-11-13 | The NiceJob plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes (nicejob-lead, nicejob-review, nicejob-eng… |
CVE-2024-10854 | Medium | 4.3 | 2024-11-13 | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buy_one_click_im… |
CVE-2024-10853 | Medium | 4.3 | 2024-11-13 | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX… |
CVE-2024-10852 | Medium | 4.3 | 2024-11-13 | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the buy_one_click_export_o… |
CVE-2024-10851 | Medium | 6.1 | 2024-11-13 | The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg with… |
CVE-2024-10850 | Medium | 6.1 | 2024-11-13 | The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_quer… |
CVE-2024-10778 | Medium | 4.3 | 2024-11-13 | The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via… |
CVE-2024-10717 | Medium | 6.5 | 2024-11-13 | The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capabi… |
CVE-2024-10629 | High | 8.8 | 2024-11-13 | The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload… |
CVE-2024-10577 | Medium | 6.1 | 2024-11-13 | The 胖鼠采集(Fat Rat Collect) 微信知乎简书腾讯新闻列表分页采集, 还有自动采集、自动发布、自动标签、等多项功能。开源插件 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to missing esc… |
CVE-2024-10038 | Medium | 6.1 | 2024-11-13 | The WP-Strava plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.1 due to insuffic… |
CVE-2024-28731 | Medium | 4.3 | 2024-11-12 | Cross Site Request Forgery vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to obtain s… |
CVE-2024-28730 | Medium | 5.4 | 2024-11-12 | Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to obtain sensiti… |
CVE-2024-28729 | Critical | 9.8 | 2024-11-12 | An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to execute arbitrary code via a crafted req… |
CVE-2024-28728 | Medium | 6.6 | 2024-11-12 | Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to obtain sensiti… |
CVE-2024-28726 | High | 8.0 | 2024-11-12 | An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to execute arbitrary code via a crafted pay… |
CVE-2024-51179 | High | 7.5 | 2024-11-12 | An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as the User Plane Funct… |
CVE-2024-48075 | Medium | 5.3 | 2024-11-12 | A Heap buffer overflow in the server-site handshake implementation in Real Time Logic SharkSSL from 09/09/24 and earlier allows a remote attacker to trigger a… |
CVE-2024-11168 | Low | 3.7 | 2024-11-12 | The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior… |
CVE-2024-51094 | High | 8.0 | 2024-11-12 | An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. W… |
CVE-2024-51093 | High | 8.7 | 2024-11-12 | Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can le… |
CVE-2024-49512 | Medium | 5.5 | 2024-11-12 | InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |