2024 CVEs (page 117)
Page 117 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51783 | High | 7.1 | 2024-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zaus Forms: 3rd-Party Post Again forms-3rdparty-post-agai… |
CVE-2024-51782 | High | 7.1 | 2024-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sanjay Prasad Loginplus loginplus allows Stored XSS.This… |
CVE-2024-51625 | High | 8.5 | 2024-11-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in edckwt Quran Shortcode quran-shortcode allows Blind SQL I… |
CVE-2024-51621 | High | 8.5 | 2024-11-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reza19 Download-Mirror-Counter wp-download-mirror-counter… |
CVE-2024-51620 | High | 8.5 | 2024-11-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in porsline Porsline porsline allows Blind SQL Injection.Thi… |
CVE-2024-51619 | High | 8.5 | 2024-11-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in market360 Market 360 Viewer market-360-viewer allows Blin… |
CVE-2024-51607 | High | 8.5 | 2024-11-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in percent20 Golf Tracker golf-tracker allows SQL Injection… |
CVE-2024-51602 | High | 8.5 | 2024-11-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in oleksandr87 Simple Job Manager simple-job-manager allows… |
CVE-2024-51601 | High | 8.5 | 2024-11-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Maksym Marko Website price calculator price-calculator-to… |
CVE-2024-51579 | High | 8.5 | 2024-11-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-ra… |
CVE-2024-51570 | High | 8.5 | 2024-11-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in odihost Easy Gallery simple-gallery-odihost allows SQL In… |
CVE-2024-10871 | Critical | 9.8 | 2024-11-09 | The Category Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.2 via the 'params[caf-post-layout… |
CVE-2024-10801 | Critical | 9.8 | 2024-11-09 | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_… |
CVE-2024-10589 | Critical | 9.8 | 2024-11-09 | The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a mi… |
CVE-2024-10547 | Critical | 9.8 | 2024-11-09 | The WP Membership plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the user_profile_image_upload() function… |
CVE-2024-10508 | Critical | 9.8 | 2024-11-09 | The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover… |
CVE-2024-9874 | Medium | 4.9 | 2024-11-09 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all v… |
CVE-2024-10876 | Medium | 6.1 | 2024-11-09 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripti… |
CVE-2024-10688 | Medium | 4.3 | 2024-11-09 | The Attesa Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.2 via the 'attesa-template' shortcode due… |
CVE-2024-10683 | Medium | 6.1 | 2024-11-09 | The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query… |
CVE-2024-8756 | Medium | 5.3 | 2024-11-09 | The Quform - WordPress Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the '… |
CVE-2024-10470 | Critical | 9.8 | 2024-11-09 | The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient fil… |
CVE-2024-10814 | Medium | 6.4 | 2024-11-09 | The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the ce_get_file() function. This… |
CVE-2024-10770 | Medium | 4.3 | 2024-11-09 | The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode du… |
CVE-2024-10669 | Medium | 4.3 | 2024-11-09 | The Countdown Timer block – Display the event's date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and i… |
CVE-2024-10667 | Medium | 4.3 | 2024-11-09 | The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to… |
CVE-2024-9226 | Medium | 6.1 | 2024-11-09 | The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use o… |
CVE-2024-10693 | Medium | 4.3 | 2024-11-09 | The SKT Addons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.3 via the Unfold widget due to… |
CVE-2024-10674 | High | 8.8 | 2024-11-09 | The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the th_shop_mania_instal… |
CVE-2024-10673 | High | 8.8 | 2024-11-09 | The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_ac… |
CVE-2024-10627 | Critical | 9.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_… |
CVE-2024-10626 | High | 8.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_uplo… |
CVE-2024-10625 | Critical | 9.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_… |
CVE-2024-9775 | Medium | 5.5 | 2024-11-09 | The Anih - Creative Agency WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and inclu… |
CVE-2024-9270 | Medium | 6.4 | 2024-11-09 | The Lenxel Core for Lenxel(LNX) LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including… |
CVE-2024-9262 | Medium | 6.5 | 2024-11-09 | The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, a… |
CVE-2024-8960 | Medium | 6.4 | 2024-11-09 | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1… |
CVE-2024-10779 | Medium | 5.3 | 2024-11-09 | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'ce_template' s… |
CVE-2024-10588 | Medium | 4.3 | 2024-11-09 | The Debug Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the info() function in all versions up to… |
CVE-2024-10586 | Critical | 9.8 | 2024-11-09 | The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbt_pull_image() function and missing fil… |
CVE-2024-10294 | Medium | 6.5 | 2024-11-09 | The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21_single_sign_on_save_api_s… |
CVE-2024-10285 | Critical | 9.8 | 2024-11-09 | The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This make… |
CVE-2024-10284 | Critical | 9.8 | 2024-11-09 | The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in… |
CVE-2024-52314 | Medium | 4.9 | 2024-11-09 | A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all applica… |
CVE-2024-52313 | Medium | 4.3 | 2024-11-09 | An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user… |
CVE-2024-52312 | Medium | 5.4 | 2024-11-09 | Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against Data… |
CVE-2024-52311 | Medium | 6.3 | 2024-11-09 | Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of author… |
CVE-2024-10953 | Medium | 4.3 | 2024-11-09 | An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their u… |
CVE-2024-52009 | Critical | 9.8 | 2024-11-08 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `gh… |
CVE-2024-52007 | High | 8.6 | 2024-11-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulne… |
CVE-2024-52004 | | 2024-11-08 | MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnerabilities that upon… | |
CVE-2024-52002 | High | 8.8 | 2024-11-08 | Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please… |
CVE-2024-52001 | Medium | 4.3 | 2024-11-08 | Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue… |
CVE-2024-52000 | Medium | 6.1 | 2024-11-08 | Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editi… |
CVE-2024-35427 | Medium | 5.5 | 2024-11-08 | vmir e8117 was discovered to contain a segmentation violation via the export_function function at /src/vmir_wasm_parser.c. |
CVE-2024-35426 | Critical | 9.8 | 2024-11-08 | vmir e8117 was discovered to contain a stack overflow via the init_local_vars function at /src/vmir_wasm_parser.c. |
CVE-2024-48073 | Critical | 9.8 | 2024-11-08 | sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updating the software i… |
CVE-2024-35425 | Medium | 5.5 | 2024-11-08 | vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_function.c. |
CVE-2024-35424 | Medium | 5.5 | 2024-11-08 | vmir e8117 was discovered to contain a segmentation violation via the import_function function at /src/vmir_wasm_parser.c. |
CVE-2024-35423 | High | 7.8 | 2024-11-08 | vmir e8117 was discovered to contain a heap buffer overflow via the wasm_parse_section_functions function at /src/vmir_wasm_parser.c. |
CVE-2024-35422 | High | 7.8 | 2024-11-08 | vmir e8117 was discovered to contain a heap buffer overflow via the wasm_call function at /src/vmir_wasm_parser.c. |
CVE-2024-35421 | Medium | 5.5 | 2024-11-08 | vmir e8117 was discovered to contain a segmentation violation via the wasm_parse_block function at /src/vmir_wasm_parser.c. |
CVE-2024-35420 | Medium | 6.2 | 2024-11-08 | wac commit 385e1 was discovered to contain a heap overflow. |
CVE-2024-35419 | Medium | 5.5 | 2024-11-08 | wac commit 385e1 was discovered to contain a heap overflow via the load_module function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denia… |
CVE-2024-35418 | Medium | 6.2 | 2024-11-08 | wac commit 385e1 was discovered to contain a heap overflow via the setup_call function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial… |
CVE-2024-35410 | Medium | 6.2 | 2024-11-08 | wac commit 385e1 was discovered to contain a heap overflow via the interpret function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial… |
CVE-2024-27532 | High | 7.5 | 2024-11-08 | wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_result_types. |
CVE-2024-27530 | High | 8.4 | 2024-11-08 | wasm3 139076a contains a Use-After-Free in ForEachModule. |
CVE-2024-27529 | High | 8.4 | 2024-11-08 | wasm3 139076a contains memory leaks in Read_utf8. |
CVE-2024-27528 | High | 8.4 | 2024-11-08 | wasm3 139076a suffers from Invalid Memory Read, leading to DoS and potential Code Execution. |
CVE-2024-27527 | High | 7.5 | 2024-11-08 | wasm3 139076a is vulnerable to Denial of Service (DoS). |
CVE-2024-11026 | Low | 3.7 | 2024-11-08 | A vulnerability was found in Intelligent Apps Freenow App 12.10.0 on Android. It has been rated as problematic. Affected by this issue is some unknown function… |
CVE-2024-51157 | Medium | 4.7 | 2024-11-08 | 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component http://erp.07fly.net:80/oa/OaSchedule/add.html. |
CVE-2024-50809 | High | 8.8 | 2024-11-08 | The theme.php file in SDCMS 2.8 has a command execution vulnerability that allows for the execution of system commands |
CVE-2024-50808 | High | 8.8 | 2024-11-08 | SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe hand… |
CVE-2024-21994 | Medium | 4.3 | 2024-11-08 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authent… |
CVE-2024-51997 | High | 8.1 | 2024-11-08 | Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Token**) token, genera… |
CVE-2024-51211 | Critical | 9.8 | 2024-11-08 | SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input… |
CVE-2024-51055 | Medium | 6.5 | 2024-11-08 | An issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component. |
CVE-2024-50811 | Critical | 9.1 | 2024-11-08 | hopetree izone lts c011b48 contains a server-side request forgery (SSRF) vulnerability in the active push function as \\apps\\tool\\apis\\bd_push.py does not s… |
CVE-2024-50810 | Medium | 5.4 | 2024-11-08 | hopetree izone lts c011b48 contains a Cross Site Scripting (XSS) vulnerability in the article comment function. In \apps\comment\views.py, AddCommintView() doe… |
CVE-2024-44765 | Medium | 6.5 | 2024-11-08 | An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass… |
CVE-2024-9841 | Medium | 6.1 | 2024-11-08 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could… |
CVE-2024-51152 | High | 7.2 | 2024-11-08 | File Upload vulnerability in Laravel CMS v.1.4.7 and before allows a remote attacker to execute arbitrary code via the shell.php a component. |
CVE-2024-51032 | Medium | 5.4 | 2024-11-08 | A Cross-site Scripting (XSS) vulnerability in manage_recipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticated users to inject… |
CVE-2024-51031 | Medium | 5.4 | 2024-11-08 | A Cross-site Scripting (XSS) vulnerability in manage_account.php in Sourcecodester Cab Management System 1.0 allows remote authenticated users to inject arbitr… |
CVE-2024-51030 | Medium | 6.5 | 2024-11-08 | A SQL injection vulnerability in manage_client.php and view_cab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to execute arbitrary SQ… |
CVE-2024-40240 | Medium | 6.8 | 2024-11-08 | An incorrect access control issue in HomeServe Home Repair' android app - 3.3.4 allows a physically proximate attacker to escalate privileges via the fingerpri… |
CVE-2024-40239 | Medium | 6.8 | 2024-11-08 | An incorrect access control issue in Life: Personal Diary, Journal android app 17.5.0 allows a physically proximate attacker to escalate privileges via the fin… |
CVE-2024-50634 | High | 8.8 | 2024-11-08 | A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerabilit… |
CVE-2024-45763 | Critical | 9.1 | 2024-11-08 | Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2024-25431 | High | 7.8 | 2024-11-08 | An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file… |
CVE-2024-50966 | Critical | 9.3 | 2024-11-08 | dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addAdmin. |
CVE-2024-47190 | Low | 2.7 | 2024-11-08 | Northern.tech Hosted Mender before 2024.07.11 allows SSRF. |
CVE-2024-46948 | Medium | 4.3 | 2024-11-08 | Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control. |
CVE-2024-46947 | Medium | 6.5 | 2024-11-08 | Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF. |
CVE-2024-45765 | Critical | 9.1 | 2024-11-08 | Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2024-45764 | Critical | 9.0 | 2024-11-08 | Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability. An unauthenticated attacker with remote… |
CVE-2024-50378 | Medium | 4.9 | 2024-11-08 | Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they shou… |
CVE-2024-50592 | High | 7.0 | 2024-11-08 | An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition… |