2024 CVEs (page 129)
Page 129 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10474 | Medium | 6.5 | 2024-10-29 | Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL sa… |
CVE-2024-10468 | Medium | 5.3 | 2024-10-29 | Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Firefox < 13… |
CVE-2024-10467 | High | 8.8 | 2024-10-29 | Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-10466 | High | 7.5 | 2024-10-29 | By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability… |
CVE-2024-10465 | Medium | 6.5 | 2024-10-29 | A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbir… |
CVE-2024-10464 | Medium | 6.5 | 2024-10-29 | Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressed by introducing r… |
CVE-2024-10463 | Medium | 6.5 | 2024-10-29 | Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Th… |
CVE-2024-10462 | Medium | 6.5 | 2024-10-29 | Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird… |
CVE-2024-10461 | Medium | 6.1 | 2024-10-29 | In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could al… |
CVE-2024-10460 | Medium | 5.3 | 2024-10-29 | The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Fire… |
CVE-2024-10459 | High | 7.5 | 2024-10-29 | An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox <… |
CVE-2024-10458 | High | 7.5 | 2024-10-29 | A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Fire… |
CVE-2024-49667 | Medium | 6.5 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asaduzzaman Abir Local Business Addons For Elementor map-… |
CVE-2024-49665 | Medium | 6.5 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Web Bricks Web Bricks Addons for Elementor allows… |
CVE-2024-49664 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chatplusjp chatplusjp chatplusjp allows Reflected XSS.Thi… |
CVE-2024-49663 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elenkadark uCAT – Next Story ucat-next-story allows Refle… |
CVE-2024-49662 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webgensis Simple Load More simple-load-more allows Reflec… |
CVE-2024-49661 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lew Ayotte leenk.me leenkme allows Reflected XSS.This iss… |
CVE-2024-49660 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CampusExplorer Campus Explorer Widget campus-explorer-wid… |
CVE-2024-49659 | Medium | 6.5 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Coub Coub coub allows DOM-Based XSS.This issue affects Co… |
CVE-2024-49656 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifthsegment DocumentPress documentpress-display-any-docu… |
CVE-2024-49654 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marian Heddesheimer Extra Privacy for Elementor extra-pri… |
CVE-2024-49651 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Royal WooCommerce Maintenance Mode woocommerce-maint… |
CVE-2024-49650 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xarbo BuddyPress Greeting Message bp-greeting-message all… |
CVE-2024-49648 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi SVG Captcha svg-captcha allows Reflected XSS.Th… |
CVE-2024-49647 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carl Alberto Simple Custom Admin simple-custom-admin allo… |
CVE-2024-49646 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ioannup Code Generate code-generator allows Reflected XSS… |
CVE-2024-10181 | Medium | 6.4 | 2024-10-29 | The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video shortcode in all versions up to, and inclu… |
CVE-2024-50410 | Medium | 6.5 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue… |
CVE-2024-50409 | Medium | 6.5 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue… |
CVE-2024-50407 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Reflected XSS.This is… |
CVE-2024-49692 | Medium | 6.5 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCenter AffiliateX affiliatex allows Stored XSS.This iss… |
CVE-2024-49679 | Medium | 5.9 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates… |
CVE-2024-49678 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jinwen js allows Reflected XSS.This issue affects… |
CVE-2024-49673 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Van Abel LaTeX2HTML latex2html allows Reflected XSS.This… |
CVE-2024-49672 | High | 7.1 | 2024-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in giffordcheung Google Docs RSVP google-docs-rsvp-guestlist allows Stored XSS.This issue affects Google Docs R… |
CVE-2024-49670 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Glover Client Power Tools Portal client-power-tools a… |
CVE-2024-10360 | Medium | 4.3 | 2024-10-29 | The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the render f… |
CVE-2024-10266 | Medium | 6.4 | 2024-10-29 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Box widget in all versions up to, and… |
CVE-2024-10233 | Medium | 6.4 | 2024-10-29 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_subscribe shortcode in al… |
CVE-2024-10185 | Medium | 6.4 | 2024-10-29 | The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-youtube-embed shortcode in all vers… |
CVE-2024-10184 | Medium | 6.4 | 2024-10-29 | The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-kick-embed shortcode in all versions u… |
CVE-2024-9376 | Medium | 6.4 | 2024-10-29 | The Kata Plus – Addons for Elementor – Widgets, Extensions and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads… |
CVE-2024-50550 | High | 8.1 | 2024-10-29 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed… |
CVE-2024-10437 | Medium | 4.3 | 2024-10-29 | The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability chec… |
CVE-2024-10436 | High | 8.8 | 2024-10-29 | The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the get_condi… |
CVE-2024-10227 | Medium | 6.4 | 2024-10-29 | The affiliate-toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atkp_product shortcode in all versions up to, and incl… |
CVE-2024-9438 | Medium | 6.1 | 2024-10-29 | The SEUR Oficial plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'change_service' parameter in all versions up to, and including… |
CVE-2024-50490 | Critical | 9.8 | 2024-10-29 | Missing Authorization vulnerability in lowcage PegaPoll pegapoll allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PegaPoll: f… |
CVE-2024-50485 | Critical | 9.8 | 2024-10-29 | Incorrect Privilege Assignment vulnerability in Udit Rawat Exam Matrix exam-matrix allows Privilege Escalation.This issue affects Exam Matrix: from n/a through… |
CVE-2024-50481 | High | 8.8 | 2024-10-29 | Incorrect Privilege Assignment vulnerability in stackthemes Bstone Demo Importer bstone-demo-importer allows Privilege Escalation.This issue affects Bstone Dem… |
CVE-2024-50476 | Critical | 9.8 | 2024-10-29 | Missing Authorization vulnerability in GRÜN Software Group GmbH GRÜN spendino Spendenformular spendino allows Privilege Escalation.This issue affects GRÜN spen… |
CVE-2024-50475 | Critical | 9.8 | 2024-10-29 | Missing Authorization vulnerability in Scott Gamon Signup Page signup-page allows Privilege Escalation.This issue affects Signup Page: from n/a through <= 1.0. |
CVE-2024-50473 | Critical | 10.0 | 2024-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed ajar-productions-in5-embed allows Upload a Web Shell to a Web… |
CVE-2024-50427 | Critical | 9.9 | 2024-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in devsoftbaltic SurveyJS surveyjs.This issue affects SurveyJS: from n/a through <= 1.9.136. |
CVE-2024-50426 | Medium | 5.9 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This… |
CVE-2024-50420 | Critical | 10.0 | 2024-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in aDirectory aDirectory adirectory allows Upload a Web Shell to a Web Server.This issue affects… |
CVE-2024-50418 | Medium | 6.5 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Time Slot Booking Time Slot timeslot allows DOM-Based XSS… |
CVE-2024-50415 | Medium | 5.9 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Ads.txt & App-ads.txt Manager for WordPress app-ads… |
CVE-2024-50414 | Medium | 5.9 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buttonizer Button contact VR button-contact-vr allows Sto… |
CVE-2024-50413 | Medium | 5.9 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Javier Carazo Import and export users and customers impor… |
CVE-2024-50412 | Medium | 5.9 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-con… |
CVE-2024-50411 | Medium | 5.9 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manage… |
CVE-2024-49642 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi Todo Custom Field todo-custom-field allows Refl… |
CVE-2024-47401 | Medium | 4.3 | 2024-10-29 | Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allow… |
CVE-2024-46872 | Medium | 4.6 | 2024-10-29 | Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows… |
CVE-2024-45477 | Medium | 4.6 | 2024-10-29 | Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnera… |
CVE-2024-22066 | High | 7.5 | 2024-10-29 | There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . An authenticated attacker could use the vulnerability to o… |
CVE-2024-10048 | Medium | 6.1 | 2024-10-29 | The Post Status Notifier Lite and Premium plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to… |
CVE-2024-50494 | Critical | 10.0 | 2024-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce wc-sudan-payment-gateway allows Upload a Web S… |
CVE-2024-50493 | Critical | 10.0 | 2024-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in masterhomepage Automatic Translation automatic-translation allows Upload a Web Shell to a Web… |
CVE-2024-50484 | Critical | 10.0 | 2024-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to… |
CVE-2024-50482 | Critical | 10.0 | 2024-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a We… |
CVE-2024-50480 | Critical | 9.9 | 2024-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Upload a Web Shell to… |
CVE-2024-50052 | Medium | 4.3 | 2024-10-29 | Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the o… |
CVE-2024-10312 | Medium | 4.3 | 2024-10-29 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.4 via the ren… |
CVE-2024-10241 | Medium | 4.3 | 2024-10-29 | Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by u… |
CVE-2024-10008 | High | 8.8 | 2024-10-29 | The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missi… |
CVE-2024-10000 | Medium | 6.4 | 2024-10-29 | The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's cont… |
CVE-2024-22065 | Medium | 6.8 | 2024-10-29 | There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated att… |
CVE-2024-10479 | Low | 2.4 | 2024-10-29 | A vulnerability, which was classified as problematic, was found in LinZhaoguan pb-cms up to 2.0.1. Affected is an unknown function of the file /admin#themes of… |
CVE-2024-50088 | High | 7.8 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix uninitialized pointer free in add_inode_ref() The add_inode_ref() function doe… |
CVE-2024-50087 | High | 7.8 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix uninitialized pointer free on read_alloc_one_name() error The function read_al… |
CVE-2024-50086 | Critical | 9.8 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is racy issue between smb2 session… |
CVE-2024-50085 | Critical | 9.8 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow Syzkaller reported this splat: … |
CVE-2024-50084 | Medium | 5.5 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test() Commit a3c1e451… |
CVE-2024-50083 | High | 7.5 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix mptcp DSS corruption due to large pmtu xmit Syzkaller was able to trigger a DSS… |
CVE-2024-50082 | High | 7.8 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race We're seeing crashes f… |
CVE-2024-50081 | Medium | 5.5 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: blk-mq: setup queue ->tag_set before initializing hctx Commit 7b815817aa58 ("blk-mq: add… |
CVE-2024-50080 | Medium | 5.5 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: ublk: don't allow user copy for unprivileged device UBLK_F_USER_COPY requires userspace t… |
CVE-2024-50079 | Medium | 5.5 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work When the sqpoll… |
CVE-2024-50078 | High | 7.8 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Call iso_exit() on module unload If iso_init() has been called, iso_exit() mus… |
CVE-2024-50077 | High | 7.8 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix multiple init when debugfs is disabled If bt_debugfs is not created s… |
CVE-2024-50076 | Medium | 6.5 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: vt: prevent kernel-infoleak in con_font_get() font.data may not initialize all memory spa… |
CVE-2024-50075 | High | 8.0 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: xhci: tegra: fix checked USB2 port number If USB virtualizatoin is enabled, USB2 ports ar… |
CVE-2024-50074 | High | 7.8 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access The recent fix for array out-of-bounds… |
CVE-2024-50073 | High | 7.8 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux BUG: KASAN: slab-use-after-free in gsm_… |
CVE-2024-50072 | Medium | 5.5 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Use code segment selector for VERW operand Robert Gill reported below #GP in 32… |
CVE-2024-50071 | High | 7.8 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func() 'new_map' is al… |
CVE-2024-50070 | Medium | 5.5 | 2024-10-29 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: stm32: check devm_kasprintf() returned value devm_kasprintf() can return a NULL… |