2024 CVEs (page 131)
Page 131 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-44197 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able… |
CVE-2024-44196 | Medium | 5.5 | 2024-10-28 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app ma… |
CVE-2024-44194 | Medium | 5.5 | 2024-10-28 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1, w… |
CVE-2024-44175 | Medium | 5.5 | 2024-10-28 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1. An app may be able to access sensi… |
CVE-2024-44174 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An attacker may be able to view restricted content from the lock screen. |
CVE-2024-44159 | High | 7.1 | 2024-10-28 | A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma… |
CVE-2024-44156 | High | 7.1 | 2024-10-28 | A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma… |
CVE-2024-44155 | Medium | 6.5 | 2024-10-28 | A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in Safari 18, iOS 17.7.1 and iPadOS 17.7.1, iOS 18 and iPa… |
CVE-2024-44144 | Medium | 5.5 | 2024-10-28 | A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18 and iPadOS 18, macOS Sequoia 15, mac… |
CVE-2024-44137 | Medium | 4.6 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An attacker with physical acc… |
CVE-2024-44126 | High | 7.8 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS… |
CVE-2024-44123 | Low | 2.3 | 2024-10-28 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. A malicious app with root privil… |
CVE-2024-44122 | High | 8.8 | 2024-10-28 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An… |
CVE-2024-42011 | High | 7.5 | 2024-10-28 | The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat. |
CVE-2024-40867 | Critical | 9.6 | 2024-10-28 | A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in iOS 18.1 and iPadOS 18.1. A remote attacker may be able… |
CVE-2024-40855 | Medium | 5.5 | 2024-10-28 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, visionOS 2. A sandboxed app m… |
CVE-2024-40853 | Low | 3.3 | 2024-10-28 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to use Siri to… |
CVE-2024-40851 | Low | 2.4 | 2024-10-28 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacker with physical access m… |
CVE-2024-40792 | Low | 3.3 | 2024-10-28 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A malicious app may be able to change network settings. |
CVE-2024-27849 | Low | 3.3 | 2024-10-28 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15. An app may be able to read sensiti… |
CVE-2024-50457 | High | 7.5 | 2024-10-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Qode Qode Essential Addons qode-essent… |
CVE-2024-50453 | High | 7.5 | 2024-10-28 | Relative Path Traversal vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elemento… |
CVE-2024-50436 | High | 7.5 | 2024-10-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Clean Retina clean-retina.T… |
CVE-2024-50435 | High | 7.5 | 2024-10-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Meta News meta-news.This is… |
CVE-2024-50434 | High | 7.5 | 2024-10-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse NewsCard newscard.This issu… |
CVE-2024-49755 | Low | 3.1 | 2024-10-28 | Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient va… |
CVE-2024-48826 | High | 8.8 | 2024-10-28 | Tenda AC7 v.15.03.06.44 ate_iwpriv_set has pre-authentication command injection allowing remote attackers to execute arbitrary code. |
CVE-2024-48825 | High | 8.8 | 2024-10-28 | Tenda AC7 v.15.03.06.44 ate_ifconfig_set has pre-authentication command injection allowing remote attackers to execute arbitrary code. |
CVE-2024-48465 | Critical | 9.8 | 2024-10-28 | The MRBS version 1.5.0 has an SQL injection vulnerability in the edit_entry_handler.php file, specifically in the rooms%5B%5D parameter |
CVE-2024-48357 | Critical | 9.8 | 2024-10-28 | LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php. |
CVE-2024-48196 | High | 7.5 | 2024-10-28 | An issue in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter. |
CVE-2024-48195 | Medium | 6.1 | 2024-10-28 | Cross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter. |
CVE-2024-48178 | High | 8.1 | 2024-10-28 | newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter. |
CVE-2024-42930 | Medium | 6.1 | 2024-10-28 | PbootCMS 3.2.8 is vulnerable to URL Redirect. |
CVE-2024-39205 | Critical | 9.8 | 2024-10-28 | An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request. |
CVE-2024-9825 | Medium | 5.4 | 2024-10-28 | The Chef Habitat builder-api on-prem-builder package with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object ref… |
CVE-2024-5532 | Medium | 4.8 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Operations Agent. The XSS vulnerabilit… |
CVE-2024-50437 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This is… |
CVE-2024-50433 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor sky-elementor-addons all… |
CVE-2024-50432 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allo… |
CVE-2024-50431 | Medium | 5.9 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze allows Stored XSS.This issue affe… |
CVE-2024-50429 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlockArt Magazine Blocks magazine-blocks allows DOM-Based… |
CVE-2024-9629 | Medium | 5.4 | 2024-10-28 | The Contact Form 7 + Telegram plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the… |
CVE-2024-50469 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brightvesseldev Textboxes textboxes allows DOM-Based XSS… |
CVE-2024-50468 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faceleg Raptor Editor wp-raptor allows DOM-Based XSS.This… |
CVE-2024-50467 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in siteengineai Scrollbar by webxapp – Best vertical/horizon… |
CVE-2024-50464 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes kodex-posts-likes.This i… |
CVE-2024-50462 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in html5maps Interactive World Map interactive-world-map all… |
CVE-2024-50461 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper EmbedPress embedpress allows Stored XSS.This… |
CVE-2024-50460 | Medium | 5.9 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored… |
CVE-2024-50458 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored… |
CVE-2024-50451 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter.T… |
CVE-2024-50449 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page B… |
CVE-2024-50448 | High | 7.1 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerc… |
CVE-2024-50447 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCo… |
CVE-2024-50446 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra.This issue affects… |
CVE-2024-50445 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Selection Lite selection-lite allows Stored XSS… |
CVE-2024-50441 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This… |
CVE-2024-50440 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Coyier CodePen Embedded Pens Shortcode codepen-embe… |
CVE-2024-50439 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Store… |
CVE-2024-50438 | High | 7.1 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Reflected XSS… |
CVE-2024-6245 | High | 7.4 | 2024-10-28 | Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and… |
CVE-2024-49771 | Medium | 5.3 | 2024-10-28 | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-202… |
CVE-2024-47827 | Medium | 5.7 | 2024-10-28 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable i… |
CVE-2024-42028 | High | 8.8 | 2024-10-28 | A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and earlier) allows a mal… |
CVE-2024-10469 | Medium | 6.5 | 2024-10-28 | VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. |
CVE-2024-49761 | High | 7.5 | 2024-10-28 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex… |
CVE-2024-48291 | Medium | 6.3 | 2024-10-28 | dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=editAdmin&id=17 |
CVE-2024-45802 | High | 7.5 | 2024-10-28 | Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected… |
CVE-2024-10450 | Medium | 6.3 | 2024-10-28 | A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This vulnerability affects unkno… |
CVE-2024-10449 | High | 7.3 | 2024-10-28 | A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0. This affects an unknown part of the file /loginAction… |
CVE-2024-10214 | Low | 3.5 | 2024-10-28 | Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorre… |
CVE-2024-50443 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from… |
CVE-2024-48191 | Medium | 6.3 | 2024-10-28 | dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=delAdmin&id=17 |
CVE-2024-34537 | Medium | 4.9 | 2024-10-28 | TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user accoun… |
CVE-2024-10455 | High | 7.5 | 2024-10-28 | Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block |
CVE-2024-10448 | Medium | 4.3 | 2024-10-28 | A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank Management System 1.0. Affected by this issue is some unknown… |
CVE-2024-8013 | Low | 2.2 | 2024-10-28 | A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to… |
CVE-2024-50582 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements |
CVE-2024-50581 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag |
CVE-2024-50580 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule |
CVE-2024-50579 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible |
CVE-2024-50578 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page |
CVE-2024-50577 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings |
CVE-2024-50576 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest |
CVE-2024-50575 | Medium | 5.4 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API |
CVE-2024-50574 | Medium | 5.3 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality |
CVE-2024-50573 | Medium | 4.3 | 2024-10-28 | In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services |
CVE-2024-50502 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows DOM-Based XSS.T… |
CVE-2024-50501 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Climax Themes Kata Plus kata-plus allows DOM-Based XSS.Th… |
CVE-2024-50497 | High | 8.1 | 2024-10-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wdesco Advanced Online Ordering and De… |
CVE-2024-50491 | Critical | 9.3 | 2024-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MicahBlu RSVP ME rsvp-me allows SQL Injection.This issue… |
CVE-2024-50488 | High | 8.8 | 2024-10-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in yespbs Token Login token-login allows Authentication Bypass.This issue affects Token… |
CVE-2024-50483 | Critical | 9.8 | 2024-10-28 | Authorization Bypass Through User-Controlled Key vulnerability in Tareq Hasan Meetup meetup allows Privilege Escalation.This issue affects Meetup: from n/a thr… |
CVE-2024-50479 | Critical | 9.3 | 2024-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chenyenming Woocommerce Quote Calculator woo-quote-calcul… |
CVE-2024-50478 | Critical | 9.8 | 2024-10-28 | Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-C… |
CVE-2024-50472 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martindrapeau Amilia Store amilia-store allows Stored XSS… |
CVE-2024-50471 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in checklistcom Trip Plan tripplan allows DOM-Based XSS.This… |
CVE-2024-50470 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themes4WP Themes4WP YouTube External Subtitles themes4wp-… |
CVE-2024-50465 | High | 8.5 | 2024-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP SEO – Calin Vingan Premium SEO Pack allows SQL Injecti… |