2024 CVEs (page 124)
Page 124 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10540 | Medium | 5.3 | 2024-11-02 | The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'service' parameter of… |
CVE-2024-10310 | Medium | 6.4 | 2024-11-02 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-9191 | High | 7.1 | 2024-11-01 | The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compr… |
CVE-2024-44234 | Medium | 5.5 | 2024-11-01 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS S… |
CVE-2024-44233 | Medium | 5.5 | 2024-11-01 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS S… |
CVE-2024-44232 | Medium | 5.5 | 2024-11-01 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS S… |
CVE-2024-51252 | Critical | 9.8 | 2024-11-01 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function. |
CVE-2024-48353 | High | 7.5 | 2024-11-01 | Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based o… |
CVE-2024-51492 | High | 8.8 | 2024-11-01 | Zusam is a free and open-source way to self-host private forums. Prior to version 0.5.6, specially crafted SVG files uploaded to the service as images allow fo… |
CVE-2024-51483 | | 2024-11-01 | changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///e… | |
CVE-2024-51431 | Critical | 9.8 | 2024-11-01 | LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable. |
CVE-2024-51248 | High | 8.8 | 2024-11-01 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the modifyrow function. |
CVE-2024-51247 | High | 8.8 | 2024-11-01 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPPo function. |
CVE-2024-51245 | High | 8.8 | 2024-11-01 | In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename_table function. |
CVE-2024-51244 | High | 8.8 | 2024-11-01 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doIPSec function. |
CVE-2024-49770 | | 2024-11-01 | `oak` is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default `oak` does not allow… | |
CVE-2024-48410 | Medium | 6.1 | 2024-11-01 | Cross Site Scripting vulnerability in Camtrace v.9.16.2.1 allows a remote attacker to execute arbitrary code via the login.php. |
CVE-2024-48352 | High | 7.5 | 2024-11-01 | Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enterprise ID. |
CVE-2024-48217 | High | 8.8 | 2024-11-01 | An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation. |
CVE-2024-41745 | Medium | 6.1 | 2024-11-01 | IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web… |
CVE-2024-41744 | Medium | 6.5 | 2024-11-01 | IBM CICS TX Standard 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted f… |
CVE-2024-41741 | Medium | 5.3 | 2024-11-01 | IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which could be used in furthe… |
CVE-2024-41738 | Medium | 5.9 | 2024-11-01 | IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request w… |
CVE-2024-51432 | Medium | 4.8 | 2024-11-01 | Cross Site Scripting vulnerability in FiberHome HG6544C RP2743 allows an attacker to execute arbitrary code via the SSID field in the WIFI Clients List not bei… |
CVE-2024-51399 | Medium | 5.7 | 2024-11-01 | Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, and attackers can obtain sensitive informa… |
CVE-2024-51398 | Medium | 6.5 | 2024-11-01 | Altai Technologies Ltd Altai X500 Indoor 22 802.11ac Wave 2 AP web Management Weak password leakage in the background may lead to unauthorized access, data the… |
CVE-2024-51377 | Medium | 5.4 | 2024-11-01 | An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject… |
CVE-2024-40490 | High | 7.5 | 2024-11-01 | An issue in Sourcebans++ before v.1.8.0 allows a remote attacker to obtain sensitive information via a crafted XAJAX call to the Forgot Password function. |
CVE-2024-28265 | Critical | 9.1 | 2024-11-01 | IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php. |
CVE-2024-22733 | High | 7.5 | 2024-11-01 | TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Actio… |
CVE-2024-10662 | High | 8.8 | 2024-11-01 | A vulnerability was found in Tenda AC15 15.03.05.19 and classified as critical. This issue affects the function formSetDeviceName of the file /goform/SetOnline… |
CVE-2024-10661 | High | 8.8 | 2024-11-01 | A vulnerability has been found in Tenda AC15 15.03.05.19 and classified as critical. This vulnerability affects the function SetDlnaCfg of the file /goform/Set… |
CVE-2024-10660 | Medium | 6.3 | 2024-11-01 | A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function deleteHook of the file /com/esafenet/servlet/policy/H… |
CVE-2024-10659 | Medium | 6.3 | 2024-11-01 | A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. Affected by this issue is the function delSystemEncryptPolicy of the file… |
CVE-2024-49256 | Medium | 5.4 | 2024-11-01 | Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.Thi… |
CVE-2024-48289 | Medium | 6.5 | 2024-11-01 | An issue in the Bluetooth Low Energy implementation of Cypress Bluetooth SDK v3.66 allows attackers to cause a Denial of Service (DoS) via supplying a crafted… |
CVE-2024-48045 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control S… |
CVE-2024-48044 | Medium | 5.4 | 2024-11-01 | Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control… |
CVE-2024-48039 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2024-47362 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16. |
CVE-2024-47361 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements… |
CVE-2024-47359 | Medium | 5.3 | 2024-11-01 | Cross-Site Request Forgery (CSRF) vulnerability in averta Depicter Slider depicter.This issue affects Depicter Slider: from n/a through <= 3.2.2. |
CVE-2024-47358 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in Daniel Iser Popup Maker popup-maker.This issue affects Popup Maker: from n/a through <= 1.19.2. |
CVE-2024-47321 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in Fahad Mahmood WP Datepicker wp-datepicker.This issue affects WP Datepicker: from n/a through <= 2.1.1. |
CVE-2024-47318 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Magazine3 PWA for WP & AMP pwa-for-wp.This issue affects PWA for WP & AMP: from n/a through <= 1.7.72. |
CVE-2024-47317 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded.This issue affects Ads by WPQuads: from n/a through <= 2.0.84. |
CVE-2024-47314 | High | 7.1 | 2024-11-01 | Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2024-47311 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2024-47308 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in WPDeveloper Templately templately.This issue affects Templately: from n/a through <= 3.1.2. |
CVE-2024-47302 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2024-44052 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.10. |
CVE-2024-44038 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2024-44031 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in beardev JoomSport joomsport-sports-league-results-management.This issue affects JoomSport: from n/a through <= 5.6.3. |
CVE-2024-44021 | Medium | 5.4 | 2024-11-01 | Missing Authorization vulnerability in truepushplugin Truepush truepush-free-web-push-notifications.This issue affects Truepush: from n/a through <= 1.0.8. |
CVE-2024-44020 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issue affects WP Free S… |
CVE-2024-44019 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in Renzo Johnson Contact Form 7 Campaign Monitor Extension contact-form-7-campaign-monitor-extension.This issue affects Con… |
CVE-2024-44006 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Amir Helzer WooCommerce Multilingual & Multicurrency woocommerce-multilingual.This issue affects WooCommerce Multilingua… |
CVE-2024-43998 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n… |
CVE-2024-43982 | High | 8.8 | 2024-11-01 | Missing Authorization vulnerability in Geek Code Lab Login As Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-43981 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2024-43980 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fota WP: f… |
CVE-2024-43979 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster… |
CVE-2024-43974 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: fro… |
CVE-2024-43973 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Get… |
CVE-2024-43968 | Medium | 4.3 | 2024-11-01 | Broken Access Control vulnerability in Automattic Newspack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack… |
CVE-2024-43962 | Medium | 5.4 | 2024-11-01 | Missing Authorization vulnerability in LWS LWS Affiliation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LWS Affil… |
CVE-2024-43956 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in Caseproof, LLC Memberpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberpres… |
CVE-2024-43937 | Medium | 6.4 | 2024-11-01 | Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cr… |
CVE-2024-43932 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects T… |
CVE-2024-43929 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in eyecix JobSearch allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JobSearch: from n/a… |
CVE-2024-43928 | Medium | 5.4 | 2024-11-01 | Missing Authorization vulnerability in eyecix JobSearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: f… |
CVE-2024-43925 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2024-43923 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Timetics: from n/a… |
CVE-2024-43919 | Medium | 5.3 | 2024-11-01 | Access Control vulnerability in YARPP YARPP allows . This issue affects YARPP: from n/a through 5.30.10. |
CVE-2024-43355 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in BearDev JoomSport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JoomSport… |
CVE-2024-43343 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Etoile Web Design Order Tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Orde… |
CVE-2024-43341 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in CozyThemes Hello Agency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hello Agency… |
CVE-2024-43332 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Jordy Meow Photo Engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo… |
CVE-2024-43323 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in ReviewX ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from… |
CVE-2024-43314 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2024-43312 | Medium | 5.4 | 2024-11-01 | Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-43310 | Medium | 6.5 | 2024-11-01 | Missing Authorization vulnerability in UkrSolution Print Barcode Labels for your WooCommerce allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2024-43302 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Fonts Plugin Fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fonts: fro… |
CVE-2024-43298 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a… |
CVE-2024-43297 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a… |
CVE-2024-43296 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2024-43293 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2024-43290 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration.This issue affects Atarim: from n/a through <= 4.0.1. |
CVE-2024-43285 | Medium | 6.3 | 2024-11-01 | Missing Authorization vulnerability in Presto Made, Inc Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2024-43277 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in AyeCode Ltd UsersWP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP… |
CVE-2024-43274 | Medium | 5.8 | 2024-11-01 | Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by A… |
CVE-2024-43273 | Medium | 5.4 | 2024-11-01 | Missing Authorization vulnerability in icegram Icegram Collect plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2024-43270 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in WPBackItUp Backup and Restore WordPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affec… |
CVE-2024-43268 | Medium | 5.4 | 2024-11-01 | Access Control vulnerability in WPBackItUp Backup and Restore WordPress allows . This issue affects Backup and Restore WordPress: from n/a through 1.50. |
CVE-2024-43260 | Medium | 5.4 | 2024-11-01 | Missing Authorization vulnerability in Creative Motion Clearfy Cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-43254 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.This issue affects Smart Online Order for Clover: from n/a th… |
CVE-2024-43253 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.This issue affects Smart Online Order for Clover: from n/a th… |
CVE-2024-43235 | High | 7.1 | 2024-11-01 | Missing Authorization vulnerability in MetaBox.Io Meta Box – WordPress Custom Fields Framework allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-43229 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Cornel Raiu WP Search Analytics search-analytics.This issue affects WP Search Analytics: from n/a through <= 1.4.9. |
CVE-2024-43223 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |