2024 CVEs (page 128)
Page 128 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50512 | Medium | 5.3 | 2024-10-30 | Generation of Error Message Containing Sensitive Information vulnerability in Posti Posti Shipping posti-shipping allows Retrieve Embedded Sensitive Data.This… |
CVE-2024-50511 | Critical | 9.9 | 2024-10-30 | Unrestricted Upload of File with Dangerous Type vulnerability in donimedia WP donimedia carousel wp-donimedia-carousel allows Upload a Web Shell to a Web Serve… |
CVE-2024-50510 | Critical | 10.0 | 2024-10-30 | Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.Th… |
CVE-2024-50509 | High | 8.6 | 2024-10-30 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design al… |
CVE-2024-50508 | High | 7.5 | 2024-10-30 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design al… |
CVE-2024-50507 | Critical | 9.8 | 2024-10-30 | Deserialization of Untrusted Data vulnerability in Daschmi DS.DownloadList dsdownloadlist allows Object Injection.This issue affects DS.DownloadList: from n/a… |
CVE-2024-50506 | High | 8.8 | 2024-10-30 | Incorrect Privilege Assignment vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Privilege Escalation.This issue affect… |
CVE-2024-50504 | High | 8.8 | 2024-10-30 | Incorrect Privilege Assignment vulnerability in webxmedia Bulk Change Role bulk-role-change allows Privilege Escalation.This issue affects Bulk Change Role: fr… |
CVE-2024-50503 | Critical | 9.8 | 2024-10-30 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck User Toolkit user-toolkit allows Authentication Bypass.This issue affects User… |
CVE-2024-8444 | Medium | 5.4 | 2024-10-30 | The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting. |
CVE-2024-10223 | Medium | 6.4 | 2024-10-30 | The WP Team – WordPress Team Member Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's htteamember shortcode in all vers… |
CVE-2024-10108 | High | 7.2 | 2024-10-30 | The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adverts_add shortcode in all versions up… |
CVE-2024-8871 | Medium | 6.1 | 2024-10-30 | The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg… |
CVE-2024-10399 | Medium | 4.3 | 2024-10-30 | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users functio… |
CVE-2024-9886 | Medium | 6.4 | 2024-10-30 | The WP Baidu Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'baidu_map' shortcode in all versions up to, and including… |
CVE-2024-9885 | Medium | 6.4 | 2024-10-30 | The Widget or Sidebar Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sidebar' shortcode in all versions up to, a… |
CVE-2024-9884 | Medium | 6.4 | 2024-10-30 | The T(-) Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tminus' shortcode in all versions up to, and including… |
CVE-2024-9846 | High | 7.3 | 2024-10-30 | The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and in… |
CVE-2024-8792 | Medium | 6.1 | 2024-10-30 | The Subscribe to Comments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on… |
CVE-2024-8627 | Medium | 6.4 | 2024-10-30 | The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due… |
CVE-2024-10509 | High | 7.3 | 2024-10-30 | A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0. This issue affects some unknown processin… |
CVE-2024-10507 | High | 7.3 | 2024-10-30 | A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2024-10506 | Medium | 6.3 | 2024-10-30 | A vulnerability classified as critical has been found in code-projects Blood Bank System 1.0. This affects an unknown part of the file /admin/blood/update/B-.p… |
CVE-2024-10505 | Medium | 6.3 | 2024-10-30 | A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/… |
CVE-2024-10503 | Low | 3.5 | 2024-10-30 | A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic. This issue affects some unknown processing of the component URL… |
CVE-2024-10502 | Medium | 6.3 | 2024-10-30 | A vulnerability has been found in ESAFENET CDG 5 and classified as critical. This vulnerability affects the function getOneFileDirectory of the file /com/esafe… |
CVE-2024-10501 | Medium | 6.3 | 2024-10-30 | A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function findById of the file /com/esafenet/servlet/document/E… |
CVE-2024-10500 | Medium | 6.3 | 2024-10-30 | A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. Affected by this issue is some unknown functionality of the file /com/esaf… |
CVE-2024-51568 | Critical | 10.0 | 2024-10-29 | CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upl… |
CVE-2024-51567 | Critical | 10.0 | 2024-10-29 | upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary… |
CVE-2024-51378 | Critical | 10.0 | 2024-10-29 | getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arb… |
CVE-2024-50348 | Medium | 5.4 | 2024-10-29 | InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due… |
CVE-2024-9997 | High | 7.8 | 2024-10-29 | A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage t… |
CVE-2024-9996 | High | 7.8 | 2024-10-29 | A maliciously crafted DWG file, when parsed in acdb25.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may lever… |
CVE-2024-9827 | High | 7.8 | 2024-10-29 | A maliciously crafted CATPART file when parsed in CC5Dll.dll through Autodesk AutoCAD can force an Out-of-Bounds Read vulnerability. A malicious actor can lev… |
CVE-2024-9826 | High | 7.8 | 2024-10-29 | A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage thi… |
CVE-2024-9489 | High | 7.8 | 2024-10-29 | A maliciously crafted DWG file when parsed in ACAD.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage thi… |
CVE-2024-8896 | High | 7.8 | 2024-10-29 | A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A malicious actor can… |
CVE-2024-8600 | High | 7.8 | 2024-10-29 | A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can lev… |
CVE-2024-8599 | High | 7.8 | 2024-10-29 | A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can lev… |
CVE-2024-8598 | High | 7.8 | 2024-10-29 | A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can lev… |
CVE-2024-8597 | High | 7.8 | 2024-10-29 | A maliciously crafted STP file when parsed in ASMDATAX230A.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leve… |
CVE-2024-8596 | High | 7.8 | 2024-10-29 | A maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may… |
CVE-2024-8595 | High | 7.8 | 2024-10-29 | A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage… |
CVE-2024-8594 | High | 7.8 | 2024-10-29 | A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Heap-Based Overflow vulnerability. A malicious actor can lev… |
CVE-2024-8593 | High | 7.8 | 2024-10-29 | A maliciously crafted CATPART file, when parsed in ASMKERN230A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor… |
CVE-2024-8592 | High | 7.8 | 2024-10-29 | A maliciously crafted CATPART file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor ca… |
CVE-2024-8591 | High | 7.8 | 2024-10-29 | A maliciously crafted 3DM file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Heap-Based Buffer Overflow vulnerability. A malicious act… |
CVE-2024-8590 | High | 7.8 | 2024-10-29 | A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage th… |
CVE-2024-8589 | High | 7.8 | 2024-10-29 | A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can le… |
CVE-2024-8588 | High | 7.8 | 2024-10-29 | A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can le… |
CVE-2024-7992 | High | 7.8 | 2024-10-29 | A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force a Stack-based Buffer Overflow. A malicious a… |
CVE-2024-7991 | High | 7.8 | 2024-10-29 | A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, may force an Out-of-Bounds Write vulnerability. A mali… |
CVE-2024-50454 | Medium | 5.3 | 2024-10-29 | Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2024-50428 | Medium | 4.3 | 2024-10-29 | Missing Authorization vulnerability in mondula2016 Multi Step Form multi-step-form allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2024-50425 | Medium | 6.5 | 2024-10-29 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Murg WP Booking System wp-booking-system.This issue affects… |
CVE-2024-50424 | Medium | 6.5 | 2024-10-29 | Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2024-50423 | Medium | 5.4 | 2024-10-29 | Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2024-50422 | Medium | 5.3 | 2024-10-29 | Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breez… |
CVE-2024-50421 | Medium | 5.3 | 2024-10-29 | Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrect… |
CVE-2024-48573 | Critical | 9.8 | 2024-10-29 | A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Res… |
CVE-2024-48572 | Medium | 5.3 | 2024-10-29 | A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The v… |
CVE-2024-48138 | Critical | 9.8 | 2024-10-29 | A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute… |
CVE-2024-44081 | Critical | 9.8 | 2024-10-29 | In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrar… |
CVE-2024-44080 | High | 7.5 | 2024-10-29 | In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients loading GIFs from any a… |
CVE-2024-10488 | High | 8.8 | 2024-10-29 | Use after free in WebRTC in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2024-10487 | High | 8.8 | 2024-10-29 | Out of bounds write in Dawn in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (… |
CVE-2024-10228 | Low | 3.8 | 2024-10-29 | The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing p… |
CVE-2024-8587 | High | 7.8 | 2024-10-29 | A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Heap Based Buffer Overflow vulnerability. A malicious acto… |
CVE-2024-50456 | Medium | 5.4 | 2024-10-29 | Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2024-50455 | Medium | 4.3 | 2024-10-29 | Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2024-48461 | Medium | 4.8 | 2024-10-29 | Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New Journey field. |
CVE-2024-48206 | Critical | 9.8 | 2024-10-29 | A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code. |
CVE-2024-48063 | Critical | 9.8 | 2024-10-29 | In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distribut… |
CVE-2024-48955 | High | 8.1 | 2024-10-29 | Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the return of this cal… |
CVE-2024-9990 | High | 8.8 | 2024-10-29 | The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This is due to missing nonce validation in… |
CVE-2024-9989 | Critical | 9.8 | 2024-10-29 | The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18. This is due to a limited arbitrary method call t… |
CVE-2024-9988 | Critical | 9.8 | 2024-10-29 | The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19. This is due to missing validation on the user be… |
CVE-2024-8924 | High | 7.5 | 2024-10-29 | ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user t… |
CVE-2024-50466 | Medium | 4.3 | 2024-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite – Advanced Dark Mode Plugin for WordPress darkmysite allows Cross Site Request Forgery… |
CVE-2024-50459 | Medium | 5.3 | 2024-10-29 | Missing Authorization vulnerability in Hossni Mubarak AidWP wp-stripe-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2024-10491 | Medium | 4.0 | 2024-10-29 | A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data… |
CVE-2024-8923 | Critical | 9.8 | 2024-10-29 | ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to… |
CVE-2024-7985 | High | 7.5 | 2024-10-29 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… |
CVE-2024-25566 | Medium | 6.1 | 2024-10-29 | An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to red… |
CVE-2024-10452 | Low | 2.2 | 2024-10-29 | Organization admins can delete pending invites created in an organization they are not part of. |
CVE-2024-50334 | Medium | 5.3 | 2024-10-29 | Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a sem… |
CVE-2024-49769 | High | 7.5 | 2024-10-29 | Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to cal… |
CVE-2024-49768 | Critical | 9.1 | 2024-10-29 | Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, fo… |
CVE-2024-48921 | Low | 2.7 | 2024-10-29 | Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a Polic… |
CVE-2024-9505 | Medium | 6.4 | 2024-10-29 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up… |
CVE-2024-51076 | Medium | 6.1 | 2024-10-29 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /odms/admin/booking-search.php in PHPGurukul Online DJ Booking Management System 1.0, which a… |
CVE-2024-51075 | Medium | 6.1 | 2024-10-29 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /odms/admin/user-search.php in PHPGurukul Online DJ Booking Management System v1.0, which all… |
CVE-2024-49634 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rimon Habib BP Member Type Manager bp-member-type-manager… |
CVE-2024-49632 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Senthil Vel CWD 3D Image Gallery cwd-3d-image-gallery all… |
CVE-2024-47640 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP ERP erp allows Reflected XSS.This issue affects… |
CVE-2024-10226 | Medium | 6.4 | 2024-10-29 | The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including… |
CVE-2024-8309 | Critical | 9.8 | 2024-10-29 | A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability c… |
CVE-2024-8143 | Medium | 4.3 | 2024-10-29 | In the latest version (20240628) of gaizhenbiao/chuanhuchatgpt, an issue exists in the /file endpoint that allows authenticated users to access the chat histor… |
CVE-2024-7962 | High | 7.5 | 2024-10-29 | An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. A… |