2024 CVEs (page 127)
Page 127 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10561 | High | 7.3 | 2024-10-31 | A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file birdsupdate… |
CVE-2024-10559 | Medium | 5.3 | 2024-10-31 | A vulnerability was found in SourceCodester Airport Booking Management System 1.0 and classified as critical. Affected by this issue is the function Details. T… |
CVE-2024-10544 | Medium | 5.3 | 2024-10-31 | The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly e… |
CVE-2024-48307 | Critical | 9.8 | 2024-10-31 | JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData. |
CVE-2024-10557 | Medium | 4.3 | 2024-10-31 | A vulnerability has been found in code-projects Blood Bank Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown fu… |
CVE-2024-10556 | High | 7.3 | 2024-10-31 | A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file birdsadd.p… |
CVE-2024-10086 | Medium | 6.1 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-p… |
CVE-2024-10006 | High | 8.3 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based acces… |
CVE-2024-10005 | High | 8.1 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-bas… |
CVE-2024-51427 | Critical | 9.8 | 2024-10-30 | An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint functi… |
CVE-2024-51426 | High | 8.8 | 2024-10-30 | An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer f… |
CVE-2024-51425 | High | 8.8 | 2024-10-30 | An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is di… |
CVE-2024-51424 | Critical | 9.8 | 2024-10-30 | An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOw… |
CVE-2024-51419 | Medium | 6.1 | 2024-10-30 | Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to… |
CVE-2024-51243 | High | 7.2 | 2024-10-30 | The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system… |
CVE-2024-51242 | Medium | 6.5 | 2024-10-30 | A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP… |
CVE-2024-48807 | Medium | 5.4 | 2024-10-30 | Cross Site Scripting vulnerability in PHPGurukul Doctor Appointment Management System v.1.0 allows a local attacker to execute arbitrary code via the search pa… |
CVE-2024-48735 | High | 7.7 | 2024-10-30 | Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by ma… |
CVE-2024-48734 | High | 8.8 | 2024-10-30 | Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: t… |
CVE-2024-48733 | High | 8.8 | 2024-10-30 | SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the P… |
CVE-2024-48346 | Medium | 6.1 | 2024-10-30 | xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path. The vulnerability is triggered through the fileUrl… |
CVE-2024-48112 | Critical | 9.8 | 2024-10-30 | A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code. |
CVE-2024-48093 | High | 8.0 | 2024-10-30 | Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading and executing mali… |
CVE-2024-43382 | Medium | 5.9 | 2024-10-30 | Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without t… |
CVE-2024-48272 | Medium | 6.5 | 2024-10-30 | D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforc… |
CVE-2024-48271 | High | 8.8 | 2024-10-30 | D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers to bypass authentica… |
CVE-2024-10546 | Medium | 6.3 | 2024-10-30 | A vulnerability classified as critical was found in open-scratch Teaching 在线教学平台 up to 2.7. This vulnerability affects unknown code of the file /api/sys/ng-ala… |
CVE-2024-48202 | Critical | 9.8 | 2024-10-30 | icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile. |
CVE-2024-46531 | Medium | 6.3 | 2024-10-30 | phpgurukul Vehicle Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchinputdata parameter at /index.php. |
CVE-2024-9419 | High | 7.8 | 2024-10-30 | Client / Server PCs with the HP Smart Universal Printing Driver installed are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege. A… |
CVE-2024-48648 | Medium | 6.1 | 2024-10-30 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. This vulnerability allows attackers to inject malicious scripts into URLs… |
CVE-2024-48647 | High | 7.2 | 2024-10-30 | A file disclosure vulnerability exists in Sage 1000 v7.0.0. This vulnerability allows remote attackers to retrieve arbitrary files from the server's file syste… |
CVE-2024-48646 | High | 8.1 | 2024-10-30 | An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validation. An attacker coul… |
CVE-2024-48569 | Medium | 5.4 | 2024-10-30 | Proactive Risk Manager version 9.1.1.0 is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in the add/edit form fields, at the urls starting wit… |
CVE-2024-48241 | Medium | 5.5 | 2024-10-30 | An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the __bf_div function. |
CVE-2024-48214 | High | 8.4 | 2024-10-30 | KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code. This vulnerability a… |
CVE-2024-42041 | High | 8.1 | 2024-10-30 | The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an attacker to execut… |
CVE-2024-37573 | High | 8.4 | 2024-10-30 | The Talkatone com.talkatone.android application 8.4.6 for Android enables any installed application (with no permissions) to place phone calls without user int… |
CVE-2024-36060 | High | 8.8 | 2024-10-30 | EnGenius EnStation5-AC A8J-ENS500AC 1.0.0 devices allow blind OS command injection via shell metacharacters in the Ping and Speed Test parameters. |
CVE-2024-31975 | Medium | 4.8 | 2024-10-30 | EnGenius EWS356-Fit devices through 1.1.30 allow a remote attacker to conduct stored XSS attacks via the Wi-Fi SSID parameters. JavaScript embedded into a vuln… |
CVE-2024-31973 | Medium | 5.2 | 2024-10-30 | Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via the 'Network Name (SSID)'… |
CVE-2024-31972 | Medium | 4.3 | 2024-10-30 | EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execution (under the con… |
CVE-2024-10456 | Critical | 9.8 | 2024-10-30 | Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which coul… |
CVE-2024-9110 | Medium | 6.4 | 2024-10-30 | A medium severity vulnerability has been identified within Privileged Identity which can allow an attacker to perform reflected cross-site scripting attacks. |
CVE-2024-51258 | High | 8.8 | 2024-10-30 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel functio… |
CVE-2024-50344 | Medium | 4.6 | 2024-10-30 | I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIM… |
CVE-2024-50419 | Medium | 5.4 | 2024-10-30 | Incorrect Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control… |
CVE-2024-51301 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor functi… |
CVE-2024-51300 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function. |
CVE-2024-51299 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function. |
CVE-2024-51298 | Critical | 9.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function. |
CVE-2024-51296 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function. |
CVE-2024-51257 | High | 8.8 | 2024-10-30 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate funct… |
CVE-2024-50353 | Medium | 5.3 | 2024-10-30 | ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload. Users of this library… |
CVE-2024-33700 | High | 7.5 | 2024-10-30 | The LevelOne WBR-6012 router firmware R0.40e6 suffers from an input validation vulnerability within its FTP functionality, enabling attackers to cause a denial… |
CVE-2024-33699 | Critical | 9.9 | 2024-10-30 | The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the administrator password and… |
CVE-2024-33626 | Medium | 5.3 | 2024-10-30 | The LevelOne WBR-6012 router contains a vulnerability within its web application that allows unauthenticated disclosure of sensitive information, such as the W… |
CVE-2024-33623 | Low | 3.7 | 2024-10-30 | A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6. A specially crafted HTTP request can lead to a rebo… |
CVE-2024-33603 | Medium | 5.3 | 2024-10-30 | The LevelOne WBR-6012 router has an information disclosure vulnerability in its web application, which allows unauthenticated users to access a verbose system… |
CVE-2024-32946 | Medium | 5.9 | 2024-10-30 | A vulnerability in the LevelOne WBR-6012 router's firmware version R0.40e6 allows sensitive information to be transmitted in cleartext via Web and FTP services… |
CVE-2024-31152 | Medium | 5.3 | 2024-10-30 | The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series of crafted HTTP req… |
CVE-2024-31151 | High | 8.1 | 2024-10-30 | A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds p… |
CVE-2024-28875 | High | 8.1 | 2024-10-30 | A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds p… |
CVE-2024-28052 | Medium | 5.3 | 2024-10-30 | The WBR-6012 is a wireless SOHO router. It is a low-cost device which functions as an internet gateway for homes and small offices while aiming to be easy to c… |
CVE-2024-24777 | High | 8.8 | 2024-10-30 | A cross-site request forgery (CSRF) vulnerability exists in the Web Application functionality of the LevelOne WBR-6012 R0.40e6. A specially crafted HTTP reques… |
CVE-2024-23309 | Critical | 9.0 | 2024-10-30 | The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on client IP addresses for… |
CVE-2024-51304 | High | 8.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldap_search_dn functi… |
CVE-2024-3935 | Medium | 6.5 | 2024-10-30 | In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connectio… |
CVE-2024-10525 | Critical | 9.8 | 2024-10-30 | In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto… |
CVE-2024-9388 | Medium | 6.4 | 2024-10-30 | The Black Widgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1… |
CVE-2024-8512 | Critical | 9.1 | 2024-10-30 | The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBe… |
CVE-2024-9632 | High | 7.8 | 2024-10-30 | A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow… |
CVE-2024-50512 | Medium | 5.3 | 2024-10-30 | Generation of Error Message Containing Sensitive Information vulnerability in Posti Posti Shipping posti-shipping allows Retrieve Embedded Sensitive Data.This… |
CVE-2024-50511 | Critical | 9.9 | 2024-10-30 | Unrestricted Upload of File with Dangerous Type vulnerability in donimedia WP donimedia carousel wp-donimedia-carousel allows Upload a Web Shell to a Web Serve… |
CVE-2024-50510 | Critical | 10.0 | 2024-10-30 | Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.Th… |
CVE-2024-50509 | High | 8.6 | 2024-10-30 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design al… |
CVE-2024-50508 | High | 7.5 | 2024-10-30 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design al… |
CVE-2024-50507 | Critical | 9.8 | 2024-10-30 | Deserialization of Untrusted Data vulnerability in Daschmi DS.DownloadList dsdownloadlist allows Object Injection.This issue affects DS.DownloadList: from n/a… |
CVE-2024-50506 | High | 8.8 | 2024-10-30 | Incorrect Privilege Assignment vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Privilege Escalation.This issue affect… |
CVE-2024-50504 | High | 8.8 | 2024-10-30 | Incorrect Privilege Assignment vulnerability in webxmedia Bulk Change Role bulk-role-change allows Privilege Escalation.This issue affects Bulk Change Role: fr… |
CVE-2024-50503 | Critical | 9.8 | 2024-10-30 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck User Toolkit user-toolkit allows Authentication Bypass.This issue affects User… |
CVE-2024-8444 | Medium | 5.4 | 2024-10-30 | The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting. |
CVE-2024-10223 | Medium | 6.4 | 2024-10-30 | The WP Team – WordPress Team Member Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's htteamember shortcode in all vers… |
CVE-2024-10108 | High | 7.2 | 2024-10-30 | The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adverts_add shortcode in all versions up… |
CVE-2024-8871 | Medium | 6.1 | 2024-10-30 | The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg… |
CVE-2024-10399 | Medium | 4.3 | 2024-10-30 | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users functio… |
CVE-2024-9886 | Medium | 6.4 | 2024-10-30 | The WP Baidu Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'baidu_map' shortcode in all versions up to, and including… |
CVE-2024-9885 | Medium | 6.4 | 2024-10-30 | The Widget or Sidebar Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sidebar' shortcode in all versions up to, a… |
CVE-2024-9884 | Medium | 6.4 | 2024-10-30 | The T(-) Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tminus' shortcode in all versions up to, and including… |
CVE-2024-9846 | High | 7.3 | 2024-10-30 | The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and in… |
CVE-2024-8792 | Medium | 6.1 | 2024-10-30 | The Subscribe to Comments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on… |
CVE-2024-8627 | Medium | 6.4 | 2024-10-30 | The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due… |
CVE-2024-10509 | High | 7.3 | 2024-10-30 | A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0. This issue affects some unknown processin… |
CVE-2024-10507 | High | 7.3 | 2024-10-30 | A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2024-10506 | Medium | 6.3 | 2024-10-30 | A vulnerability classified as critical has been found in code-projects Blood Bank System 1.0. This affects an unknown part of the file /admin/blood/update/B-.p… |
CVE-2024-10505 | Medium | 6.3 | 2024-10-30 | A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/… |
CVE-2024-10503 | Low | 3.5 | 2024-10-30 | A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic. This issue affects some unknown processing of the component URL… |
CVE-2024-10502 | Medium | 6.3 | 2024-10-30 | A vulnerability has been found in ESAFENET CDG 5 and classified as critical. This vulnerability affects the function getOneFileDirectory of the file /com/esafe… |
CVE-2024-10501 | Medium | 6.3 | 2024-10-30 | A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function findById of the file /com/esafenet/servlet/document/E… |
CVE-2024-10500 | Medium | 6.3 | 2024-10-30 | A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. Affected by this issue is some unknown functionality of the file /com/esaf… |