2024 CVEs (page 127)
Page 127 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51430 | Medium | 6.4 | 2024-10-31 | Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test N… |
CVE-2024-8185 | High | 7.5 | 2024-10-31 | Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through mem… |
CVE-2024-51260 | Critical | 9.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process functi… |
CVE-2024-51255 | Critical | 9.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificat… |
CVE-2024-50354 | Medium | 5.5 | 2024-10-31 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys all… |
CVE-2024-8553 | Medium | 6.3 | 2024-10-31 | A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view an… |
CVE-2024-48910 | Critical | 9.1 | 2024-10-31 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability… |
CVE-2024-51259 | Critical | 9.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate… |
CVE-2024-51254 | High | 8.8 | 2024-10-31 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate… |
CVE-2024-42835 | Critical | 9.8 | 2024-10-31 | langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component. |
CVE-2024-8934 | Medium | 6.5 | 2024-10-31 | A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which t… |
CVE-2024-10454 | Medium | 6.1 | 2024-10-31 | Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the absence of an X-Fra… |
CVE-2024-49685 | Medium | 5.4 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Custom Twitter Feeds (Tweets Widget) custom-twitter-feeds allows Cross Site Request Forgery.This… |
CVE-2024-49674 | Critical | 9.6 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a Web Shell to a Web Server.This issu… |
CVE-2024-43984 | Critical | 9.6 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher allows Code Injection.This issue affects Podlove Podcast Publisher: from n… |
CVE-2024-43933 | Medium | 4.3 | 2024-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja allows Stored XSS.This iss… |
CVE-2024-43930 | Medium | 4.3 | 2024-10-31 | Cross-Site Request Forgery (CSRF) vulnerability in eyecix JobSearch allows Cross Site Request Forgery.This issue affects JobSearch: from n/a through 2.5.3. |
CVE-2024-43383 | High | 8.0 | 2024-10-31 | Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta000… |
CVE-2024-30149 | Medium | 4.8 | 2024-10-31 | HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable. |
CVE-2024-9446 | Medium | 6.4 | 2024-10-31 | The WP Simple Anchors Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpanchor shortcode in all versions up to, and in… |
CVE-2024-9434 | Medium | 6.1 | 2024-10-31 | The WPGlobus Translate Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to mis… |
CVE-2024-9430 | Medium | 5.3 | 2024-10-31 | The Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress is vulnerable to unauthorized access of Quote data due to a missing capabi… |
CVE-2024-9165 | Medium | 6.4 | 2024-10-31 | The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in a… |
CVE-2024-9700 | Medium | 5.3 | 2024-10-31 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2024-10392 | Critical | 9.8 | 2024-10-31 | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_image_upload' fu… |
CVE-2024-21537 | High | 8.8 | 2024-10-31 | Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport… |
CVE-2024-9708 | Medium | 6.4 | 2024-10-31 | The Easy SVG Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due to ins… |
CVE-2024-48311 | High | 8.8 | 2024-10-31 | Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function. |
CVE-2024-10561 | High | 7.3 | 2024-10-31 | A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file birdsupdate… |
CVE-2024-10559 | Medium | 5.3 | 2024-10-31 | A vulnerability was found in SourceCodester Airport Booking Management System 1.0 and classified as critical. Affected by this issue is the function Details. T… |
CVE-2024-10544 | Medium | 5.3 | 2024-10-31 | The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly e… |
CVE-2024-48307 | Critical | 9.8 | 2024-10-31 | JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData. |
CVE-2024-10557 | Medium | 4.3 | 2024-10-31 | A vulnerability has been found in code-projects Blood Bank Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown fu… |
CVE-2024-10556 | High | 7.3 | 2024-10-31 | A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file birdsadd.p… |
CVE-2024-10086 | Medium | 6.1 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-p… |
CVE-2024-10006 | High | 8.3 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based acces… |
CVE-2024-10005 | High | 8.1 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-bas… |
CVE-2024-51427 | Critical | 9.8 | 2024-10-30 | An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint functi… |
CVE-2024-51426 | High | 8.8 | 2024-10-30 | An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer f… |
CVE-2024-51425 | High | 8.8 | 2024-10-30 | An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is di… |
CVE-2024-51424 | Critical | 9.8 | 2024-10-30 | An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOw… |
CVE-2024-51419 | Medium | 6.1 | 2024-10-30 | Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to… |
CVE-2024-51243 | High | 7.2 | 2024-10-30 | The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system… |
CVE-2024-51242 | Medium | 6.5 | 2024-10-30 | A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP… |
CVE-2024-48807 | Medium | 5.4 | 2024-10-30 | Cross Site Scripting vulnerability in PHPGurukul Doctor Appointment Management System v.1.0 allows a local attacker to execute arbitrary code via the search pa… |
CVE-2024-48735 | High | 7.7 | 2024-10-30 | Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by ma… |
CVE-2024-48734 | High | 8.8 | 2024-10-30 | Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: t… |
CVE-2024-48733 | High | 8.8 | 2024-10-30 | SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the P… |
CVE-2024-48346 | Medium | 6.1 | 2024-10-30 | xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path. The vulnerability is triggered through the fileUrl… |
CVE-2024-48112 | Critical | 9.8 | 2024-10-30 | A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code. |
CVE-2024-48093 | High | 8.0 | 2024-10-30 | Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading and executing mali… |
CVE-2024-43382 | Medium | 5.9 | 2024-10-30 | Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without t… |
CVE-2024-48272 | Medium | 6.5 | 2024-10-30 | D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforc… |
CVE-2024-48271 | High | 8.8 | 2024-10-30 | D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers to bypass authentica… |
CVE-2024-10546 | Medium | 6.3 | 2024-10-30 | A vulnerability classified as critical was found in open-scratch Teaching 在线教学平台 up to 2.7. This vulnerability affects unknown code of the file /api/sys/ng-ala… |
CVE-2024-48202 | Critical | 9.8 | 2024-10-30 | icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile. |
CVE-2024-46531 | Medium | 6.3 | 2024-10-30 | phpgurukul Vehicle Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchinputdata parameter at /index.php. |
CVE-2024-9419 | High | 7.8 | 2024-10-30 | Client / Server PCs with the HP Smart Universal Printing Driver installed are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege. A… |
CVE-2024-48648 | Medium | 6.1 | 2024-10-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. This vulnerability allows attackers to inject malicious scripts into URLs… |
CVE-2024-48647 | High | 7.2 | 2024-10-30 | A file disclosure vulnerability exists in Sage 1000 v7.0.0. This vulnerability allows remote attackers to retrieve arbitrary files from the server's file syste… |
CVE-2024-48646 | High | 8.1 | 2024-10-30 | An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validation. An attacker coul… |
CVE-2024-48569 | Medium | 5.4 | 2024-10-30 | Proactive Risk Manager version 9.1.1.0 is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in the add/edit form fields, at the urls starting wit… |
CVE-2024-48241 | Medium | 5.5 | 2024-10-30 | An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the __bf_div function. |
CVE-2024-48214 | High | 8.4 | 2024-10-30 | KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code. This vulnerability a… |
CVE-2024-42041 | High | 8.1 | 2024-10-30 | The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an attacker to execut… |
CVE-2024-37573 | High | 8.4 | 2024-10-30 | The Talkatone com.talkatone.android application 8.4.6 for Android enables any installed application (with no permissions) to place phone calls without user int… |
CVE-2024-36060 | High | 8.8 | 2024-10-30 | EnGenius EnStation5-AC A8J-ENS500AC 1.0.0 devices allow blind OS command injection via shell metacharacters in the Ping and Speed Test parameters. |
CVE-2024-31975 | Medium | 4.8 | 2024-10-30 | EnGenius EWS356-Fit devices through 1.1.30 allow a remote attacker to conduct stored XSS attacks via the Wi-Fi SSID parameters. JavaScript embedded into a vuln… |
CVE-2024-31973 | Medium | 5.2 | 2024-10-30 | Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via the 'Network Name (SSID)'… |
CVE-2024-31972 | Medium | 4.3 | 2024-10-30 | EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execution (under the con… |
CVE-2024-10456 | Critical | 9.8 | 2024-10-30 | Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which coul… |
CVE-2024-9110 | Medium | 6.4 | 2024-10-30 | A medium severity vulnerability has been identified within Privileged Identity which can allow an attacker to perform reflected cross-site scripting attacks. |
CVE-2024-51258 | High | 8.8 | 2024-10-30 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel functio… |
CVE-2024-50344 | Medium | 4.6 | 2024-10-30 | I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIM… |
CVE-2024-50419 | Medium | 5.4 | 2024-10-30 | Incorrect Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control… |
CVE-2024-51301 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor functi… |
CVE-2024-51300 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function. |
CVE-2024-51299 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function. |
CVE-2024-51298 | Critical | 9.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function. |
CVE-2024-51296 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function. |
CVE-2024-51257 | High | 8.8 | 2024-10-30 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate funct… |
CVE-2024-50353 | Medium | 5.3 | 2024-10-30 | ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload. Users of this library… |
CVE-2024-33700 | High | 7.5 | 2024-10-30 | The LevelOne WBR-6012 router firmware R0.40e6 suffers from an input validation vulnerability within its FTP functionality, enabling attackers to cause a denial… |
CVE-2024-33699 | Critical | 9.9 | 2024-10-30 | The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the administrator password and… |
CVE-2024-33626 | Medium | 5.3 | 2024-10-30 | The LevelOne WBR-6012 router contains a vulnerability within its web application that allows unauthenticated disclosure of sensitive information, such as the W… |
CVE-2024-33623 | Low | 3.7 | 2024-10-30 | A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6. A specially crafted HTTP request can lead to a rebo… |
CVE-2024-33603 | Medium | 5.3 | 2024-10-30 | The LevelOne WBR-6012 router has an information disclosure vulnerability in its web application, which allows unauthenticated users to access a verbose system… |
CVE-2024-32946 | Medium | 5.9 | 2024-10-30 | A vulnerability in the LevelOne WBR-6012 router's firmware version R0.40e6 allows sensitive information to be transmitted in cleartext via Web and FTP services… |
CVE-2024-31152 | Medium | 5.3 | 2024-10-30 | The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series of crafted HTTP req… |
CVE-2024-31151 | High | 8.1 | 2024-10-30 | A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds p… |
CVE-2024-28875 | High | 8.1 | 2024-10-30 | A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds p… |
CVE-2024-28052 | Medium | 5.3 | 2024-10-30 | The WBR-6012 is a wireless SOHO router. It is a low-cost device which functions as an internet gateway for homes and small offices while aiming to be easy to c… |
CVE-2024-24777 | High | 8.8 | 2024-10-30 | A cross-site request forgery (CSRF) vulnerability exists in the Web Application functionality of the LevelOne WBR-6012 R0.40e6. A specially crafted HTTP reques… |
CVE-2024-23309 | Critical | 9.0 | 2024-10-30 | The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on client IP addresses for… |
CVE-2024-51304 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldap_search_dn functi… |
CVE-2024-3935 | Medium | 6.5 | 2024-10-30 | In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connectio… |
CVE-2024-10525 | Critical | 9.8 | 2024-10-30 | In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto… |
CVE-2024-9388 | Medium | 6.4 | 2024-10-30 | The Black Widgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1… |
CVE-2024-8512 | Critical | 9.1 | 2024-10-30 | The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBe… |
CVE-2024-9632 | High | 7.8 | 2024-10-30 | A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow… |