2024 CVEs (page 122)
Page 122 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-9667 | Medium | 6.1 | 2024-11-05 | The Seriously Simple Podcasting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapi… |
CVE-2024-9443 | Medium | 6.4 | 2024-11-05 | The Basticom Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.5.0 due t… |
CVE-2024-51516 | Medium | 6.2 | 2024-11-05 | Permission control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to function abnormally. |
CVE-2024-51515 | Medium | 6.2 | 2024-11-05 | Race condition vulnerability in the kernel network module Impact:Successful exploitation of this vulnerability may affect availability. |
CVE-2024-51514 | Medium | 5.3 | 2024-11-05 | Vulnerability of pop-up windows belonging to no app in the VPN module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-51513 | Medium | 5.5 | 2024-11-05 | Vulnerability of processes not being fully terminated in the VPN module Impact: Successful exploitation of this vulnerability will affect power consumption. |
CVE-2024-51512 | Medium | 6.2 | 2024-11-05 | Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-51511 | Medium | 6.2 | 2024-11-05 | Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-51510 | High | 7.6 | 2024-11-05 | Out-of-bounds access vulnerability in the logo module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-10711 | High | 8.8 | 2024-11-05 | The WooCommerce Report plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is due to missing or… |
CVE-2024-10114 | High | 8.1 | 2024-11-05 | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.7.7. This is due to insuffic… |
CVE-2024-47797 | High | 8.4 | 2024-11-05 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through out-of-b… |
CVE-2024-47404 | High | 8.4 | 2024-11-05 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through double f… |
CVE-2024-47402 | Low | 3.3 | 2024-11-05 | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2024-47137 | High | 8.4 | 2024-11-05 | in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through out-of-b… |
CVE-2024-10097 | High | 8.1 | 2024-11-05 | The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9.2. This is due to… |
CVE-2024-9883 | Medium | 4.8 | 2024-11-05 | The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-9689 | Medium | 4.3 | 2024-11-05 | The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform… |
CVE-2024-9459 | High | 8.3 | 2024-11-05 | Zohocorp ManageEngine Exchange Reporter Plus versions 5718 and prior are vulnerable to authenticated SQL Injection in reports module. |
CVE-2024-7877 | Medium | 4.8 | 2024-11-05 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notifi… |
CVE-2024-7876 | Medium | 4.8 | 2024-11-05 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appoin… |
CVE-2024-5578 | Medium | 4.8 | 2024-11-05 | The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege users such as edit… |
CVE-2024-10810 | Medium | 6.3 | 2024-11-05 | A vulnerability was found in code-projects E-Health Care System 1.0. It has been classified as critical. Affected is an unknown function of the file Doctor/app… |
CVE-2024-10809 | Medium | 6.3 | 2024-11-05 | A vulnerability was found in code-projects E-Health Care System 1.0 and classified as critical. This issue affects some unknown processing of the file /Doctor/… |
CVE-2024-10808 | Medium | 6.3 | 2024-11-05 | A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code of the file Admin/… |
CVE-2024-10807 | Low | 2.4 | 2024-11-05 | A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been rated as problematic. This issue affects some unknown processing of the fil… |
CVE-2024-10340 | Medium | 6.4 | 2024-11-05 | The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'scu' shortcode in versions up to, and including… |
CVE-2024-10806 | Low | 2.4 | 2024-11-05 | A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as problematic. This vulnerability affects unknown code of the fil… |
CVE-2024-51498 | | 2024-11-05 | cobalt is a media downloader that doesn't piss you off. A malicious cobalt instance could serve links with the `javascript:` protocol, resulting in Cross-site… | |
CVE-2024-50346 | | 2024-11-05 | WebFeed is a lightweight web feed reader extension for Firefox/Chrome. Multiple HTML injection vulnerabilities in WebFeed can lead to CSRF and UI spoofing atta… | |
CVE-2024-32870 | Medium | 5.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone havin… |
CVE-2024-31998 | High | 8.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versions 3.1.2 a… |
CVE-2024-31448 | High | 8.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be perform… |
CVE-2024-51734 | | 2024-11-04 | Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `Acces… | |
CVE-2024-51502 | | 2024-11-04 | loona is an experimental, HTTP/1.1 and HTTP/2 implementation in Rust on top of io-uring. `loona-hpack` suffers from the same vulnerability as the original `hpa… | |
CVE-2024-51501 | | 2024-11-04 | Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes (Header, HeaderCollection and Authoriz… | |
CVE-2024-51500 | Medium | 5.3 | 2024-11-04 | Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadca… |
CVE-2024-48061 | Critical | 9.8 | 2024-11-04 | langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rat… |
CVE-2024-48059 | Medium | 6.1 | 2024-11-04 | gaizhenbiao/chuanhuchatgpt project, version <=20240802 is vulnerable to stored Cross-Site Scripting (XSS) in WebSocket session transmission. An attacker can in… |
CVE-2024-48057 | Medium | 6.1 | 2024-11-04 | localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time s… |
CVE-2024-48052 | Medium | 6.5 | 2024-11-04 | In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cac… |
CVE-2024-48050 | Critical | 9.8 | 2024-11-04 | In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result =… |
CVE-2024-10805 | Medium | 6.3 | 2024-11-04 | A vulnerability was found in code-projects University Event Management System 1.0. It has been classified as critical. This affects an unknown part of the file… |
CVE-2024-51744 | Low | 3.1 | 2024-11-04 | golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are po… |
CVE-2024-48463 | Medium | 6.5 | 2024-11-04 | Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer. |
CVE-2024-45185 | Medium | 5.1 | 2024-11-04 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480… |
CVE-2024-45086 | Medium | 5.5 | 2024-11-04 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could e… |
CVE-2024-10791 | High | 7.3 | 2024-11-04 | A vulnerability, which was classified as critical, has been found in Codezips Hospital Appointment System 1.0. This issue affects some unknown processing of th… |
CVE-2024-34891 | Medium | 6.8 | 2024-11-04 | Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange account passwords vi… |
CVE-2024-34885 | Medium | 6.8 | 2024-11-04 | Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via… |
CVE-2024-30619 | High | 7.5 | 2024-11-04 | Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online… |
CVE-2024-30618 | Medium | 6.1 | 2024-11-04 | A Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web browser by including… |
CVE-2024-30617 | Medium | 5.4 | 2024-11-04 | A Cross-Site Request Forgery (CSRF) vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post… |
CVE-2024-30616 | High | 8.8 | 2024-11-04 | Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a si… |
CVE-2024-10768 | Low | 3.5 | 2024-11-04 | A vulnerability classified as problematic was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /admin/assets… |
CVE-2024-51329 | High | 8.8 | 2024-11-04 | A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset… |
CVE-2024-51328 | Medium | 6.1 | 2024-11-04 | Cross Site Scripting vulnerability in addcategory.php in projectworld's Travel Management System v1.0 allows remote attacker to inject arbitrary code via the t… |
CVE-2024-51327 | Critical | 9.8 | 2024-11-04 | SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL Injection in the 'usern… |
CVE-2024-51326 | High | 7.5 | 2024-11-04 | SQL Injection vulnerability in projectworlds Travel management System v.1.0 allows a remote attacker to execute arbitrary code via the 't2' parameter in delete… |
CVE-2024-51127 | High | 7.1 | 2024-11-04 | An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information. |
CVE-2024-48336 | High | 8.4 | 2024-11-04 | The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local… |
CVE-2024-34887 | Medium | 4.9 | 2024-11-04 | Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators ac… |
CVE-2024-34883 | Medium | 4.9 | 2024-11-04 | Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts password… |
CVE-2024-34882 | Medium | 4.9 | 2024-11-04 | Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP account passwords to an… |
CVE-2024-10766 | Medium | 6.3 | 2024-11-04 | A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown pro… |
CVE-2024-51136 | Critical | 9.8 | 2024-11-04 | An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitrary code via suppl… |
CVE-2024-48809 | High | 7.5 | 2024-11-04 | An issue in Open Networking Foundations sdran-in-a-box v.1.4.3 and onos-a1t v.0.2.3 allows a remote attacker to cause a denial of service via the onos-a1t comp… |
CVE-2024-10765 | Medium | 6.3 | 2024-11-04 | A vulnerability classified as critical was found in Codezips Online Institute Management System up to 1.0. This vulnerability affects unknown code of the file… |
CVE-2024-10764 | Medium | 6.3 | 2024-11-04 | A vulnerability classified as critical has been found in Codezips Online Institute Management System 1.0. This affects an unknown part of the file /pages/save_… |
CVE-2024-51685 | Medium | 5.9 | 2024-11-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Gangolf Accordion title for Elementor allo… |
CVE-2024-51683 | Medium | 6.5 | 2024-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Custom post type templates for Elementor custom-p… |
CVE-2024-51682 | Medium | 6.5 | 2024-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Builder – WordPress Theme Builder for Elemen… |
CVE-2024-51681 | Medium | 6.5 | 2024-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution WP Pocket URLs wp-pocket-urls allows Store… |
CVE-2024-51680 | Medium | 6.5 | 2024-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrestaProject Cresta Addons for Elementor cresta-addons-f… |
CVE-2024-51678 | Medium | 6.5 | 2024-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allo… |
CVE-2024-51677 | Medium | 6.5 | 2024-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Knowledge Base knowledgebase allows Stored XSS.This… |
CVE-2024-51626 | High | 8.5 | 2024-11-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chenyenming Woocommerce Quote Calculator woo-quote-calcul… |
CVE-2024-45893 | High | 8.0 | 2024-11-04 | DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mai… |
CVE-2024-45891 | High | 8.0 | 2024-11-04 | DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mai… |
CVE-2024-45890 | High | 8.0 | 2024-11-04 | DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/main… |
CVE-2024-45889 | High | 8.0 | 2024-11-04 | DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mai… |
CVE-2024-45888 | High | 8.0 | 2024-11-04 | DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is se… |
CVE-2024-45887 | High | 8.0 | 2024-11-04 | DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mai… |
CVE-2024-45885 | High | 8.0 | 2024-11-04 | DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mai… |
CVE-2024-45884 | High | 8.0 | 2024-11-04 | DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mai… |
CVE-2024-45882 | High | 8.0 | 2024-11-04 | DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is se… |
CVE-2024-51672 | High | 7.6 | 2024-11-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPDeveloper BetterLinks betterlinks allows SQL Injection… |
CVE-2024-51665 | Medium | 4.9 | 2024-11-04 | Server-Side Request Forgery (SSRF) vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Server Side Request Forgery.This… |
CVE-2024-51582 | High | 7.5 | 2024-11-04 | Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.This issue affects WP Hotel Booking: f… |
CVE-2024-51408 | High | 8.5 | 2024-11-04 | AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials. |
CVE-2024-51253 | High | 8.0 | 2024-11-04 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function. |
CVE-2024-51251 | High | 8.0 | 2024-11-04 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the backup function. |
CVE-2024-51249 | High | 8.0 | 2024-11-04 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function. |
CVE-2024-51246 | High | 8.0 | 2024-11-04 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPTP function. |
CVE-2024-50531 | Critical | 10.0 | 2024-11-04 | Unrestricted Upload of File with Dangerous Type vulnerability in davidfcarr RSVPMaker for Toastmasters rsvpmaker-for-toastmasters allows Upload a Web Shell to… |
CVE-2024-50530 | Critical | 9.9 | 2024-11-04 | Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allows Upload a Web Shell to a Web Server… |
CVE-2024-50529 | Critical | 9.9 | 2024-11-04 | Unrestricted Upload of File with Dangerous Type vulnerability in rudrainn Training – Courses training allows Upload a Web Shell to a Web Server.This issue affe… |
CVE-2024-50528 | High | 7.5 | 2024-11-04 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows R… |
CVE-2024-50527 | Critical | 10.0 | 2024-11-04 | Unrestricted Upload of File with Dangerous Type vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Upload a Web Shell to a Web… |
CVE-2024-50526 | Critical | 10.0 | 2024-11-04 | Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to… |