2024 CVEs (page 110)
Page 110 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52268 | Medium | 4.8 | 2024-11-13 | Cross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. If this vulnerability is exploited, an arbitrary script… |
CVE-2024-9409 | High | 7.5 | 2024-11-13 | CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communication loss when a la… |
CVE-2024-8938 | High | 8.1 | 2024-11-13 | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution aft… |
CVE-2024-8937 | Medium | 6.5 | 2024-11-13 | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution aft… |
CVE-2024-8936 | Medium | 6.5 | 2024-11-13 | CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Man-In-The-Middle att… |
CVE-2024-8935 | High | 7.5 | 2024-11-13 | CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integrity of controllers w… |
CVE-2024-21541 | High | 7.3 | 2024-11-13 | Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sani… |
CVE-2024-11150 | Critical | 9.8 | 2024-11-13 | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_upload… |
CVE-2024-10800 | High | 8.8 | 2024-11-13 | The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_save_fields() function… |
CVE-2024-10575 | Critical | 9.8 | 2024-11-13 | CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected device… |
CVE-2024-8933 | High | 7.5 | 2024-11-13 | CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password h… |
CVE-2024-10828 | High | 8.1 | 2024-11-13 | The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserializ… |
CVE-2024-10820 | Critical | 9.8 | 2024-11-13 | The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in… |
CVE-2024-10816 | High | 7.5 | 2024-11-13 | The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.24.01.24 via the js/fallback.php file… |
CVE-2024-10802 | Medium | 5.3 | 2024-11-13 | The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_i… |
CVE-2024-10794 | Medium | 4.3 | 2024-11-13 | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.6 via the… |
CVE-2024-10174 | High | 7.3 | 2024-11-13 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direc… |
CVE-2024-11143 | Medium | 4.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.8. This is due t… |
CVE-2024-10882 | Medium | 6.1 | 2024-11-13 | The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_… |
CVE-2024-10684 | Medium | 6.1 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dir' parameter in all versions up to, and inc… |
CVE-2024-10593 | Medium | 4.3 | 2024-11-13 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery… |
CVE-2024-10531 | Medium | 5.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_ass… |
CVE-2024-10530 | Medium | 4.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the add_new_as… |
CVE-2024-10529 | Medium | 5.3 | 2024-11-13 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_ass… |
CVE-2024-9614 | Medium | 6.1 | 2024-11-13 | The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriat… |
CVE-2024-9578 | Medium | 5.3 | 2024-11-13 | The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to do_shortcode being hooked through the comment_text filter in all v… |
CVE-2024-9426 | Medium | 6.4 | 2024-11-13 | The Aqua SVG Sprite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.14 due to… |
CVE-2024-8985 | Medium | 6.4 | 2024-11-13 | The Social Proof (Testimonial) Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spslider-block shortcode in all versio… |
CVE-2024-8874 | Medium | 6.1 | 2024-11-13 | The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg… |
CVE-2024-39712 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated… |
CVE-2024-39711 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticate… |
CVE-2024-39710 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated… |
CVE-2024-39709 | High | 7.8 | 2024-11-13 | Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applica… |
CVE-2024-38656 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated… |
CVE-2024-38655 | High | 7.2 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote… |
CVE-2024-38654 | Medium | 4.4 | 2024-11-13 | Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges to cause a denial of… |
CVE-2024-38649 | High | 7.5 | 2024-11-13 | An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated attacker to cause a d… |
CVE-2024-37400 | High | 7.5 | 2024-11-13 | An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial o… |
CVE-2024-37398 | High | 7.8 | 2024-11-13 | Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. |
CVE-2024-37376 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-34787 | High | 7.8 | 2024-11-13 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to… |
CVE-2024-34784 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-34782 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-34781 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-34780 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-32847 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-32844 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-32841 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-32839 | High | 7.2 | 2024-11-13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with… |
CVE-2024-29211 | Medium | 4.7 | 2024-11-13 | A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuration files. |
CVE-2024-10887 | Medium | 6.4 | 2024-11-13 | The NiceJob plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes (nicejob-lead, nicejob-review, nicejob-eng… |
CVE-2024-10854 | Medium | 4.3 | 2024-11-13 | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buy_one_click_im… |
CVE-2024-10853 | Medium | 4.3 | 2024-11-13 | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX… |
CVE-2024-10852 | Medium | 4.3 | 2024-11-13 | The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the buy_one_click_export_o… |
CVE-2024-10851 | Medium | 6.1 | 2024-11-13 | The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg with… |
CVE-2024-10850 | Medium | 6.1 | 2024-11-13 | The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_quer… |
CVE-2024-10778 | Medium | 4.3 | 2024-11-13 | The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via… |
CVE-2024-10717 | Medium | 6.5 | 2024-11-13 | The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capabi… |
CVE-2024-10629 | High | 8.8 | 2024-11-13 | The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload… |
CVE-2024-10577 | Medium | 6.1 | 2024-11-13 | The 胖鼠采集(Fat Rat Collect) 微信知乎简书腾讯新闻列表分页采集, 还有自动采集、自动发布、自动标签、等多项功能。开源插件 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to missing esc… |
CVE-2024-10038 | Medium | 6.1 | 2024-11-13 | The WP-Strava plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.1 due to insuffic… |
CVE-2024-28731 | Medium | 4.3 | 2024-11-12 | Cross Site Request Forgery vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to obtain s… |
CVE-2024-28730 | Medium | 5.4 | 2024-11-12 | Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to obtain sensiti… |
CVE-2024-28729 | Critical | 9.8 | 2024-11-12 | An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to execute arbitrary code via a crafted req… |
CVE-2024-28728 | Medium | 6.6 | 2024-11-12 | Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to obtain sensiti… |
CVE-2024-28726 | High | 8.0 | 2024-11-12 | An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to execute arbitrary code via a crafted pay… |
CVE-2024-51179 | High | 7.5 | 2024-11-12 | An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as the User Plane Funct… |
CVE-2024-48075 | Medium | 5.3 | 2024-11-12 | A Heap buffer overflow in the server-site handshake implementation in Real Time Logic SharkSSL from 09/09/24 and earlier allows a remote attacker to trigger a… |
CVE-2024-11168 | Low | 3.7 | 2024-11-12 | The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior… |
CVE-2024-51094 | High | 8.0 | 2024-11-12 | An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. W… |
CVE-2024-51093 | High | 8.7 | 2024-11-12 | Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can le… |
CVE-2024-49512 | Medium | 5.5 | 2024-11-12 | InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2024-49511 | Medium | 5.5 | 2024-11-12 | InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2024-49510 | Medium | 5.5 | 2024-11-12 | InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2024-49509 | High | 7.8 | 2024-11-12 | InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2024-49508 | High | 7.8 | 2024-11-12 | InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2024-49507 | High | 7.8 | 2024-11-12 | InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2024-11117 | Medium | 4.3 | 2024-11-12 | Inappropriate implementation in FileSystem in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass filesystem restrictions via a crafted HT… |
CVE-2024-11116 | Medium | 4.3 | 2024-11-12 | Inappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2024-11115 | High | 8.8 | 2024-11-12 | Insufficient policy enforcement in Navigation in Google Chrome on iOS prior to 131.0.6778.69 allowed a remote attacker to perform privilege escalation via a se… |
CVE-2024-11114 | High | 8.3 | 2024-11-12 | Inappropriate implementation in Views in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker who had compromised the renderer process to… |
CVE-2024-11113 | High | 8.8 | 2024-11-12 | Use after free in Accessibility in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who had compromised the renderer process to potentially explo… |
CVE-2024-11112 | High | 8.8 | 2024-11-12 | Use after free in Media in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2024-11111 | Medium | 4.3 | 2024-11-12 | Inappropriate implementation in Autofill in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2024-11110 | Medium | 6.5 | 2024-11-12 | Inappropriate implementation in Extensions in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass site isolation via a crafted Chrome Exte… |
CVE-2024-52301 | High | 7.5 | 2024-11-12 | Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, th… |
CVE-2024-49525 | High | 7.8 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in t… |
CVE-2024-49520 | High | 7.8 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2024-49519 | High | 7.8 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2024-49518 | High | 7.8 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2024-49517 | High | 7.8 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in t… |
CVE-2024-49516 | High | 7.8 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2024-49515 | High | 7.8 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code… |
CVE-2024-47440 | Medium | 5.5 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An att… |
CVE-2024-47439 | Medium | 5.5 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-servic… |
CVE-2024-47438 | Medium | 5.5 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerabili… |
CVE-2024-47437 | Medium | 5.5 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An att… |
CVE-2024-47436 | Medium | 5.5 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An att… |
CVE-2024-47435 | Medium | 5.5 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An att… |
CVE-2024-47434 | High | 7.8 | 2024-11-12 | Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |