2024 CVEs (page 117)
Page 117 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10674 | High | 8.8 | 2024-11-09 | The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the th_shop_mania_instal… |
CVE-2024-10673 | High | 8.8 | 2024-11-09 | The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_ac… |
CVE-2024-10627 | Critical | 9.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_… |
CVE-2024-10626 | High | 8.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_uplo… |
CVE-2024-10625 | Critical | 9.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_… |
CVE-2024-9775 | Medium | 5.5 | 2024-11-09 | The Anih - Creative Agency WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and inclu… |
CVE-2024-9270 | Medium | 6.4 | 2024-11-09 | The Lenxel Core for Lenxel(LNX) LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including… |
CVE-2024-9262 | Medium | 6.5 | 2024-11-09 | The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, a… |
CVE-2024-8960 | Medium | 6.4 | 2024-11-09 | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1… |
CVE-2024-10779 | Medium | 5.3 | 2024-11-09 | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'ce_template' s… |
CVE-2024-10588 | Medium | 4.3 | 2024-11-09 | The Debug Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the info() function in all versions up to… |
CVE-2024-10586 | Critical | 9.8 | 2024-11-09 | The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbt_pull_image() function and missing fil… |
CVE-2024-10294 | Medium | 6.5 | 2024-11-09 | The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21_single_sign_on_save_api_s… |
CVE-2024-10285 | Critical | 9.8 | 2024-11-09 | The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This make… |
CVE-2024-10284 | Critical | 9.8 | 2024-11-09 | The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in… |
CVE-2024-52314 | Medium | 4.9 | 2024-11-09 | A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all applica… |
CVE-2024-52313 | Medium | 4.3 | 2024-11-09 | An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user… |
CVE-2024-52312 | Medium | 5.4 | 2024-11-09 | Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against Data… |
CVE-2024-52311 | Medium | 6.3 | 2024-11-09 | Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of author… |
CVE-2024-10953 | Medium | 4.3 | 2024-11-09 | An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their u… |
CVE-2024-52009 | Critical | 9.8 | 2024-11-08 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `gh… |
CVE-2024-52007 | High | 8.6 | 2024-11-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulne… |
CVE-2024-52004 | | 2024-11-08 | MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnerabilities that upon… | |
CVE-2024-52002 | High | 8.8 | 2024-11-08 | Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please… |
CVE-2024-52001 | Medium | 4.3 | 2024-11-08 | Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue… |
CVE-2024-52000 | Medium | 6.1 | 2024-11-08 | Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editi… |
CVE-2024-35427 | Medium | 5.5 | 2024-11-08 | vmir e8117 was discovered to contain a segmentation violation via the export_function function at /src/vmir_wasm_parser.c. |
CVE-2024-35426 | Critical | 9.8 | 2024-11-08 | vmir e8117 was discovered to contain a stack overflow via the init_local_vars function at /src/vmir_wasm_parser.c. |
CVE-2024-48073 | Critical | 9.8 | 2024-11-08 | sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updating the software i… |
CVE-2024-35425 | Medium | 5.5 | 2024-11-08 | vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_function.c. |
CVE-2024-35424 | Medium | 5.5 | 2024-11-08 | vmir e8117 was discovered to contain a segmentation violation via the import_function function at /src/vmir_wasm_parser.c. |
CVE-2024-35423 | High | 7.8 | 2024-11-08 | vmir e8117 was discovered to contain a heap buffer overflow via the wasm_parse_section_functions function at /src/vmir_wasm_parser.c. |
CVE-2024-35422 | High | 7.8 | 2024-11-08 | vmir e8117 was discovered to contain a heap buffer overflow via the wasm_call function at /src/vmir_wasm_parser.c. |
CVE-2024-35421 | Medium | 5.5 | 2024-11-08 | vmir e8117 was discovered to contain a segmentation violation via the wasm_parse_block function at /src/vmir_wasm_parser.c. |
CVE-2024-35420 | Medium | 6.2 | 2024-11-08 | wac commit 385e1 was discovered to contain a heap overflow. |
CVE-2024-35419 | Medium | 5.5 | 2024-11-08 | wac commit 385e1 was discovered to contain a heap overflow via the load_module function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denia… |
CVE-2024-35418 | Medium | 6.2 | 2024-11-08 | wac commit 385e1 was discovered to contain a heap overflow via the setup_call function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial… |
CVE-2024-35410 | Medium | 6.2 | 2024-11-08 | wac commit 385e1 was discovered to contain a heap overflow via the interpret function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial… |
CVE-2024-27532 | High | 7.5 | 2024-11-08 | wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_result_types. |
CVE-2024-27530 | High | 8.4 | 2024-11-08 | wasm3 139076a contains a Use-After-Free in ForEachModule. |
CVE-2024-27529 | High | 8.4 | 2024-11-08 | wasm3 139076a contains memory leaks in Read_utf8. |
CVE-2024-27528 | High | 8.4 | 2024-11-08 | wasm3 139076a suffers from Invalid Memory Read, leading to DoS and potential Code Execution. |
CVE-2024-27527 | High | 7.5 | 2024-11-08 | wasm3 139076a is vulnerable to Denial of Service (DoS). |
CVE-2024-11026 | Low | 3.7 | 2024-11-08 | A vulnerability was found in Intelligent Apps Freenow App 12.10.0 on Android. It has been rated as problematic. Affected by this issue is some unknown function… |
CVE-2024-51157 | Medium | 4.7 | 2024-11-08 | 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component http://erp.07fly.net:80/oa/OaSchedule/add.html. |
CVE-2024-50809 | High | 8.8 | 2024-11-08 | The theme.php file in SDCMS 2.8 has a command execution vulnerability that allows for the execution of system commands |
CVE-2024-50808 | High | 8.8 | 2024-11-08 | SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe hand… |
CVE-2024-21994 | Medium | 4.3 | 2024-11-08 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authent… |
CVE-2024-51997 | High | 8.1 | 2024-11-08 | Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Token**) token, genera… |
CVE-2024-51211 | Critical | 9.8 | 2024-11-08 | SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input… |
CVE-2024-51055 | Medium | 6.5 | 2024-11-08 | An issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component. |
CVE-2024-50811 | Critical | 9.1 | 2024-11-08 | hopetree izone lts c011b48 contains a server-side request forgery (SSRF) vulnerability in the active push function as \\apps\\tool\\apis\\bd_push.py does not s… |
CVE-2024-50810 | Medium | 5.4 | 2024-11-08 | hopetree izone lts c011b48 contains a Cross Site Scripting (XSS) vulnerability in the article comment function. In \apps\comment\views.py, AddCommintView() doe… |
CVE-2024-44765 | Medium | 6.5 | 2024-11-08 | An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass… |
CVE-2024-9841 | Medium | 6.1 | 2024-11-08 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could… |
CVE-2024-51152 | High | 7.2 | 2024-11-08 | File Upload vulnerability in Laravel CMS v.1.4.7 and before allows a remote attacker to execute arbitrary code via the shell.php a component. |
CVE-2024-51032 | Medium | 5.4 | 2024-11-08 | A Cross-site Scripting (XSS) vulnerability in manage_recipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticated users to inject… |
CVE-2024-51031 | Medium | 5.4 | 2024-11-08 | A Cross-site Scripting (XSS) vulnerability in manage_account.php in Sourcecodester Cab Management System 1.0 allows remote authenticated users to inject arbitr… |
CVE-2024-51030 | Medium | 6.5 | 2024-11-08 | A SQL injection vulnerability in manage_client.php and view_cab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to execute arbitrary SQ… |
CVE-2024-40240 | Medium | 6.8 | 2024-11-08 | An incorrect access control issue in HomeServe Home Repair' android app - 3.3.4 allows a physically proximate attacker to escalate privileges via the fingerpri… |
CVE-2024-40239 | Medium | 6.8 | 2024-11-08 | An incorrect access control issue in Life: Personal Diary, Journal android app 17.5.0 allows a physically proximate attacker to escalate privileges via the fin… |
CVE-2024-50634 | High | 8.8 | 2024-11-08 | A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerabilit… |
CVE-2024-45763 | Critical | 9.1 | 2024-11-08 | Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2024-25431 | High | 7.8 | 2024-11-08 | An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file… |
CVE-2024-50966 | Critical | 9.3 | 2024-11-08 | dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addAdmin. |
CVE-2024-47190 | Low | 2.7 | 2024-11-08 | Northern.tech Hosted Mender before 2024.07.11 allows SSRF. |
CVE-2024-46948 | Medium | 4.3 | 2024-11-08 | Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control. |
CVE-2024-46947 | Medium | 6.5 | 2024-11-08 | Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF. |
CVE-2024-45765 | Critical | 9.1 | 2024-11-08 | Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2024-45764 | Critical | 9.0 | 2024-11-08 | Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability. An unauthenticated attacker with remote… |
CVE-2024-50378 | Medium | 4.9 | 2024-11-08 | Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they shou… |
CVE-2024-50592 | High | 7.0 | 2024-11-08 | An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition… |
CVE-2024-50593 | High | 7.8 | 2024-11-08 | An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" pass… |
CVE-2024-50591 | High | 7.8 | 2024-11-08 | An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a command inject… |
CVE-2024-50590 | High | 7.8 | 2024-11-08 | Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elef… |
CVE-2024-50589 | High | 7.5 | 2024-11-08 | An unauthenticated attacker with access to the local network of the medical office can query an unprotected Fast Healthcare Interoperability Resources (FHIR)… |
CVE-2024-10325 | Medium | 6.4 | 2024-11-08 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, an… |
CVE-2024-10839 | High | 8.5 | 2024-11-08 | Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option. |
CVE-2024-10187 | Medium | 6.4 | 2024-11-08 | The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credi… |
CVE-2024-50588 | Critical | 9.8 | 2024-11-08 | An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant… |
CVE-2024-24409 | High | 8.8 | 2024-11-08 | Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option. |
CVE-2024-11000 | Medium | 4.7 | 2024-11-08 | A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2024-10999 | Medium | 4.7 | 2024-11-08 | A vulnerability classified as problematic has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /aboutadd… |
CVE-2024-10998 | High | 7.3 | 2024-11-08 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fi… |
CVE-2024-10997 | Medium | 6.3 | 2024-11-08 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2024-10996 | High | 7.3 | 2024-11-08 | A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin… |
CVE-2024-10995 | High | 7.3 | 2024-11-08 | A vulnerability was found in Codezips Hospital Appointment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-10269 | Medium | 6.4 | 2024-11-08 | The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7… |
CVE-2024-7982 | Critical | 9.6 | 2024-11-08 | The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, whic… |
CVE-2024-50211 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: udf: refactor inode_bmap() to handle error Refactor inode_bmap() to handle error since ud… |
CVE-2024-50210 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() If get_clock_desc(… |
CVE-2024-50209 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add a check for memory allocation __alloc_pbl() can return error when memor… |
CVE-2024-50208 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages Avoid memory corruption while… |
CVE-2024-50207 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix reader locking when changing the sub buffer order The function ring_buff… |
CVE-2024-50206 | Critical | 9.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init The loop responsible… |
CVE-2024-50205 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() The step variabl… |
CVE-2024-50204 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: fs: don't try and remove empty rbtree node When copying a namespace we won't have added t… |
CVE-2024-50203 | High | 7.8 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix address emission with tag-based KASAN enabled When BPF_TRAMP_F_CALL_ORIG… |
CVE-2024-50202 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: propagate directory read errors from nilfs_find_entry() Syzbot reported that a ta… |
CVE-2024-50201 | Medium | 5.5 | 2024-11-08 | In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix encoder->possible_clones Include the encoder itself in its possible_clone… |