2024 CVEs (page 132)
Page 132 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50463 | Medium | 4.7 | 2024-10-28 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Phot… |
CVE-2024-10447 | Medium | 6.3 | 2024-10-28 | A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2024-50498 | Critical | 10.0 | 2024-10-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affect… |
CVE-2024-50492 | High | 8.3 | 2024-10-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart scottcart allows Code Injection.This issue affects ScottCar… |
CVE-2024-50489 | Critical | 9.8 | 2024-10-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in realtyworkstation Realty Workstation realty-workstation allows Authentication Bypass… |
CVE-2024-50487 | Critical | 9.8 | 2024-10-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo MaanStore API maanstore-api allows Authentication Bypass.This issue affects Maa… |
CVE-2024-50486 | Critical | 9.8 | 2024-10-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API acnoo-flutter-api allows Authentication Bypass.This issue aff… |
CVE-2024-50477 | Critical | 9.8 | 2024-10-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypa… |
CVE-2024-50450 | High | 7.3 | 2024-10-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This i… |
CVE-2024-50442 | Medium | 6.5 | 2024-10-28 | Improper Restriction of XML External Entity Reference vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows XML Injection.This issue a… |
CVE-2024-50416 | High | 8.8 | 2024-10-28 | Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affe… |
CVE-2024-50408 | High | 8.8 | 2024-10-28 | Deserialization of Untrusted Data vulnerability in Bob Namaste! LMS namaste-lms allows Object Injection.This issue affects Namaste! LMS: from n/a through <= 2… |
CVE-2024-48074 | High | 8.0 | 2024-10-28 | An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter… |
CVE-2024-10446 | Medium | 6.3 | 2024-10-28 | A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. Affected is an unknown function of the file /timetable… |
CVE-2024-38821 | Critical | 9.1 | 2024-10-28 | Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact… |
CVE-2024-9162 | High | 7.2 | 2024-10-28 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export… |
CVE-2024-50307 | Medium | 5.5 | 2024-10-28 | Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2. If a user clicks a specially crafted link… |
CVE-2024-48936 | Medium | 5.0 | 2024-10-28 | SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under o… |
CVE-2024-10440 | Critical | 9.8 | 2024-10-28 | The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL command to read, modify, and del… |
CVE-2024-10439 | Medium | 5.3 | 2024-10-28 | The eHRD CTMS from Sunnet has an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated remote attackers to modify a specific paramete… |
CVE-2024-10438 | High | 7.5 | 2024-10-28 | The eHRD CTMS from Sunnet has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to bypass authentication by satisfying specific… |
CVE-2024-23843 | Low | 2.2 | 2024-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Genians Genian NAC V5.0, Genians Genian NAC LTS V5.0.This… |
CVE-2024-50067 | High | 7.8 | 2024-10-28 | In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds memory access of fetching args Uprobe needs to fetch args int… |
CVE-2024-10435 | Medium | 6.3 | 2024-10-28 | A vulnerability was found in didi Super-Jacoco 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cov/triggerEnvCov. T… |
CVE-2024-10434 | High | 8.8 | 2024-10-28 | A vulnerability was found in Tenda AC1206 up to 20241027. It has been classified as critical. This affects the function ate_Tenda_mfg_check_usb/ate_Tenda_mfg_c… |
CVE-2024-50624 | Medium | 5.9 | 2024-10-28 | ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is us… |
CVE-2024-50623 | Critical | 9.8 | 2024-10-28 | In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to re… |
CVE-2024-10433 | Low | 3.5 | 2024-10-28 | A vulnerability was found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as problematic. Affected by this issue is some unknown functio… |
CVE-2024-10432 | High | 7.3 | 2024-10-28 | A vulnerability has been found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2024-10431 | High | 7.3 | 2024-10-27 | A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file /deletebir… |
CVE-2024-10430 | High | 7.3 | 2024-10-27 | A vulnerability, which was classified as critical, has been found in Codezips Pet Shop Management System 1.0. This issue affects some unknown processing of the… |
CVE-2024-50616 | High | 8.8 | 2024-10-27 | Ironman PowerShell Universal 5.x before 5.0.12 allows an authenticated attacker to elevate their privileges and view job information. |
CVE-2024-50615 | Medium | 6.5 | 2024-10-27 | TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef. |
CVE-2024-50614 | Medium | 6.5 | 2024-10-27 | TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef. |
CVE-2024-50613 | Medium | 6.5 | 2024-10-27 | libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close. |
CVE-2024-50612 | Medium | 5.5 | 2024-10-27 | libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read. |
CVE-2024-50611 | High | 7.2 | 2024-10-27 | CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a sim… |
CVE-2024-50610 | Low | 3.6 | 2024-10-27 | GSL (GNU Scientific Library) through 2.8 has an integer signedness error in gsl_siman_solve_many in siman/siman.c. When params.n_tries is negative, incorrect m… |
CVE-2024-10429 | High | 7.2 | 2024-10-27 | A vulnerability classified as critical has been found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. Affected is the function set_ipv6 of the file i… |
CVE-2024-10428 | High | 7.2 | 2024-10-27 | A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been rated as critical. This issue affects the function set_ipv6 of… |
CVE-2024-10427 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /de… |
CVE-2024-10426 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file /animalsadd… |
CVE-2024-10425 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this issue is some unknown functional… |
CVE-2024-10424 | Medium | 6.3 | 2024-10-27 | A vulnerability has been found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2024-10423 | Medium | 6.3 | 2024-10-27 | A vulnerability, which was classified as critical, was found in Project Worlds Student Project Allocation System 1.0. Affected is an unknown function of the fi… |
CVE-2024-10422 | Medium | 6.3 | 2024-10-27 | A vulnerability, which was classified as critical, has been found in SourceCodester Attendance and Payroll System 1.0. This issue affects some unknown processi… |
CVE-2024-10421 | Medium | 6.3 | 2024-10-27 | A vulnerability classified as critical was found in SourceCodester Attendance and Payroll System 1.0. This vulnerability affects unknown code of the file /admi… |
CVE-2024-10420 | Medium | 6.3 | 2024-10-27 | A vulnerability classified as critical has been found in SourceCodester Attendance and Payroll System 1.0. This affects the function upload of the file /marima… |
CVE-2024-10419 | Low | 3.5 | 2024-10-27 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functiona… |
CVE-2024-10418 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2024-10417 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /f… |
CVE-2024-10416 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in code-projects Blood Bank Management System 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-10415 | Medium | 6.3 | 2024-10-27 | A vulnerability has been found in code-projects Blood Bank Management System 1.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-10414 | Low | 2.4 | 2024-10-27 | A vulnerability, which was classified as problematic, was found in PHPGurukul Vehicle Record System 1.0. This affects an unknown part of the file /admin/edit-b… |
CVE-2024-10413 | Medium | 6.3 | 2024-10-27 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Hotel Reservation System 1.0. Affected by this issue is the function… |
CVE-2024-10412 | Low | 3.5 | 2024-10-27 | A vulnerability was found in Poco-z Guns-Medical 1.0. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /m… |
CVE-2024-50602 | Medium | 5.9 | 2024-10-27 | An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted pa… |
CVE-2024-10411 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in SourceCodester Online Hotel Reservation System 1.0. It has been classified as critical. Affected is the function doCancelRoom/doCa… |
CVE-2024-10410 | Medium | 6.3 | 2024-10-27 | A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. Affected by this vulnerability is the function upload o… |
CVE-2024-10409 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in code-projects Blood Bank Management 1.0 and classified as critical. This issue affects some unknown processing of the file /file/a… |
CVE-2024-10408 | Medium | 6.3 | 2024-10-27 | A vulnerability has been found in code-projects Blood Bank Management up to 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2024-10407 | Medium | 6.3 | 2024-10-27 | A vulnerability, which was classified as critical, was found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /a… |
CVE-2024-10406 | Medium | 6.3 | 2024-10-26 | A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. Affected by this issue is some unknown… |
CVE-2024-9501 | Critical | 9.8 | 2024-10-26 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.0.7. This i… |
CVE-2024-10402 | High | 7.5 | 2024-10-26 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability c… |
CVE-2024-10117 | Medium | 6.4 | 2024-10-26 | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and includi… |
CVE-2024-9772 | High | 7.3 | 2024-10-26 | The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1… |
CVE-2024-9116 | Medium | 6.4 | 2024-10-26 | The Monkee-Boy Essentials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due… |
CVE-2024-10357 | Medium | 4.3 | 2024-10-26 | The Clever Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.1 via the getTem… |
CVE-2024-9967 | Medium | 6.4 | 2024-10-26 | The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_more shortcode in all versions up to, and including, 1… |
CVE-2024-9853 | Medium | 6.4 | 2024-10-26 | The ID-SK Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.7.2 due to ins… |
CVE-2024-9642 | Medium | 6.4 | 2024-10-26 | The Editor Custom Color Palette plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3… |
CVE-2024-9637 | High | 8.8 | 2024-10-26 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and includi… |
CVE-2024-8392 | High | 7.2 | 2024-10-26 | The WordPress Post Grid Layouts with Pagination – Sogrid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.6… |
CVE-2024-0128 | High | 7.1 | 2024-10-26 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources. A successful exploit of… |
CVE-2024-0127 | High | 7.8 | 2024-10-26 | NVIDIA vGPU software contains a vulnerability in the GPU kernel driver of the vGPU Manager for all supported hypervisors, where a user of the guest OS can caus… |
CVE-2024-10092 | Medium | 4.3 | 2024-10-26 | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actio… |
CVE-2024-0126 | High | 8.2 | 2024-10-26 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit… |
CVE-2024-0121 | High | 7.8 | 2024-10-26 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |
CVE-2024-0120 | High | 7.8 | 2024-10-26 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |
CVE-2024-0119 | High | 7.8 | 2024-10-26 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |
CVE-2024-0118 | High | 7.8 | 2024-10-26 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |
CVE-2024-0117 | High | 7.8 | 2024-10-26 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |
CVE-2024-9456 | Medium | 6.4 | 2024-10-26 | The WP Awesome Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.0 due to… |
CVE-2024-8870 | Medium | 6.1 | 2024-10-26 | The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer… |
CVE-2024-9933 | Critical | 9.8 | 2024-10-26 | The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.10.1. This is due to the 'watchtower_ota_token… |
CVE-2024-9932 | Critical | 9.8 | 2024-10-26 | The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' functio… |
CVE-2024-9931 | Critical | 9.8 | 2024-10-26 | The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missing validation on t… |
CVE-2024-9930 | Critical | 9.8 | 2024-10-26 | The Extensions by HocWP Team plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2.3.2. This is due to missing vali… |
CVE-2024-9890 | High | 8.8 | 2024-10-26 | The User Toolkit plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.3. This is due to an improper capability che… |
CVE-2024-9626 | Medium | 4.3 | 2024-10-26 | The Editorial Assistant by Sovrn plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_zemanta… |
CVE-2024-9613 | Medium | 6.1 | 2024-10-26 | The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parame… |
CVE-2024-9475 | Medium | 4.9 | 2024-10-26 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versi… |
CVE-2024-9462 | Medium | 5.5 | 2024-10-26 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Stored Cross-Site Scripting via poll settings in all versions… |
CVE-2024-9454 | Medium | 6.4 | 2024-10-26 | The PriPre plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.11 due to insuffici… |
CVE-2024-10091 | Medium | 6.4 | 2024-10-26 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all versions up to, and i… |
CVE-2024-47821 | Critical | 9.1 | 2024-10-25 | pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a downl… |
CVE-2024-48239 | Medium | 4.8 | 2024-10-25 | An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Script… |
CVE-2024-48238 | Medium | 4.7 | 2024-10-25 | WTCMS 1.0 is vulnerable to SQL Injection in the edit_post method of /Admin\Controller\NavControl.class.php via the parentid parameter. |
CVE-2024-48237 | Critical | 9.8 | 2024-10-25 | WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php. |