2024 CVEs (page 132)
Page 132 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10432 | High | 7.3 | 2024-10-28 | A vulnerability has been found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2024-10431 | High | 7.3 | 2024-10-27 | A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file /deletebir… |
CVE-2024-10430 | High | 7.3 | 2024-10-27 | A vulnerability, which was classified as critical, has been found in Codezips Pet Shop Management System 1.0. This issue affects some unknown processing of the… |
CVE-2024-50616 | High | 8.8 | 2024-10-27 | Ironman PowerShell Universal 5.x before 5.0.12 allows an authenticated attacker to elevate their privileges and view job information. |
CVE-2024-50615 | Medium | 6.5 | 2024-10-27 | TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef. |
CVE-2024-50614 | Medium | 6.5 | 2024-10-27 | TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef. |
CVE-2024-50613 | Medium | 6.5 | 2024-10-27 | libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close. |
CVE-2024-50612 | Medium | 5.5 | 2024-10-27 | libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read. |
CVE-2024-50611 | High | 7.2 | 2024-10-27 | CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a sim… |
CVE-2024-50610 | Low | 3.6 | 2024-10-27 | GSL (GNU Scientific Library) through 2.8 has an integer signedness error in gsl_siman_solve_many in siman/siman.c. When params.n_tries is negative, incorrect m… |
CVE-2024-10429 | High | 7.2 | 2024-10-27 | A vulnerability classified as critical has been found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. Affected is the function set_ipv6 of the file i… |
CVE-2024-10428 | High | 7.2 | 2024-10-27 | A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been rated as critical. This issue affects the function set_ipv6 of… |
CVE-2024-10427 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /de… |
CVE-2024-10426 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file /animalsadd… |
CVE-2024-10425 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this issue is some unknown functional… |
CVE-2024-10424 | Medium | 6.3 | 2024-10-27 | A vulnerability has been found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2024-10423 | Medium | 6.3 | 2024-10-27 | A vulnerability, which was classified as critical, was found in Project Worlds Student Project Allocation System 1.0. Affected is an unknown function of the fi… |
CVE-2024-10422 | Medium | 6.3 | 2024-10-27 | A vulnerability, which was classified as critical, has been found in SourceCodester Attendance and Payroll System 1.0. This issue affects some unknown processi… |
CVE-2024-10421 | Medium | 6.3 | 2024-10-27 | A vulnerability classified as critical was found in SourceCodester Attendance and Payroll System 1.0. This vulnerability affects unknown code of the file /admi… |
CVE-2024-10420 | Medium | 6.3 | 2024-10-27 | A vulnerability classified as critical has been found in SourceCodester Attendance and Payroll System 1.0. This affects the function upload of the file /marima… |
CVE-2024-10419 | Low | 3.5 | 2024-10-27 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functiona… |
CVE-2024-10418 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2024-10417 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /f… |
CVE-2024-10416 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in code-projects Blood Bank Management System 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-10415 | Medium | 6.3 | 2024-10-27 | A vulnerability has been found in code-projects Blood Bank Management System 1.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-10414 | Low | 2.4 | 2024-10-27 | A vulnerability, which was classified as problematic, was found in PHPGurukul Vehicle Record System 1.0. This affects an unknown part of the file /admin/edit-b… |
CVE-2024-10413 | Medium | 6.3 | 2024-10-27 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Hotel Reservation System 1.0. Affected by this issue is the function… |
CVE-2024-10412 | Low | 3.5 | 2024-10-27 | A vulnerability was found in Poco-z Guns-Medical 1.0. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /m… |
CVE-2024-50602 | Medium | 5.9 | 2024-10-27 | An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted pa… |
CVE-2024-10411 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in SourceCodester Online Hotel Reservation System 1.0. It has been classified as critical. Affected is the function doCancelRoom/doCa… |
CVE-2024-10410 | Medium | 6.3 | 2024-10-27 | A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. Affected by this vulnerability is the function upload o… |
CVE-2024-10409 | Medium | 6.3 | 2024-10-27 | A vulnerability was found in code-projects Blood Bank Management 1.0 and classified as critical. This issue affects some unknown processing of the file /file/a… |
CVE-2024-10408 | Medium | 6.3 | 2024-10-27 | A vulnerability has been found in code-projects Blood Bank Management up to 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2024-10407 | Medium | 6.3 | 2024-10-27 | A vulnerability, which was classified as critical, was found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /a… |
CVE-2024-10406 | Medium | 6.3 | 2024-10-26 | A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. Affected by this issue is some unknown… |
CVE-2024-9501 | Critical | 9.8 | 2024-10-26 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.0.7. This i… |
CVE-2024-10402 | High | 7.5 | 2024-10-26 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability c… |
CVE-2024-10117 | Medium | 6.4 | 2024-10-26 | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and includi… |
CVE-2024-9772 | High | 7.3 | 2024-10-26 | The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1… |
CVE-2024-9116 | Medium | 6.4 | 2024-10-26 | The Monkee-Boy Essentials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due… |
CVE-2024-10357 | Medium | 4.3 | 2024-10-26 | The Clever Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.1 via the getTem… |
CVE-2024-9967 | Medium | 6.4 | 2024-10-26 | The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_more shortcode in all versions up to, and including, 1… |
CVE-2024-9853 | Medium | 6.4 | 2024-10-26 | The ID-SK Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.7.2 due to ins… |
CVE-2024-9642 | Medium | 6.4 | 2024-10-26 | The Editor Custom Color Palette plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3… |
CVE-2024-9637 | High | 8.8 | 2024-10-26 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and includi… |
CVE-2024-8392 | High | 7.2 | 2024-10-26 | The WordPress Post Grid Layouts with Pagination – Sogrid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.6… |
CVE-2024-0128 | High | 7.1 | 2024-10-26 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources. A successful exploit of… |
CVE-2024-0127 | High | 7.8 | 2024-10-26 | NVIDIA vGPU software contains a vulnerability in the GPU kernel driver of the vGPU Manager for all supported hypervisors, where a user of the guest OS can caus… |
CVE-2024-10092 | Medium | 4.3 | 2024-10-26 | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actio… |
CVE-2024-0126 | High | 8.2 | 2024-10-26 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit… |
CVE-2024-0121 | High | 7.8 | 2024-10-26 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |
CVE-2024-0120 | High | 7.8 | 2024-10-26 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |
CVE-2024-0119 | High | 7.8 | 2024-10-26 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |
CVE-2024-0118 | High | 7.8 | 2024-10-26 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |
CVE-2024-0117 | High | 7.8 | 2024-10-26 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A su… |
CVE-2024-9456 | Medium | 6.4 | 2024-10-26 | The WP Awesome Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.0 due to… |
CVE-2024-8870 | Medium | 6.1 | 2024-10-26 | The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_quer… |
CVE-2024-9933 | Critical | 9.8 | 2024-10-26 | The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.10.1. This is due to the 'watchtower_ota_token… |
CVE-2024-9932 | Critical | 9.8 | 2024-10-26 | The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' functio… |
CVE-2024-9931 | Critical | 9.8 | 2024-10-26 | The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missing validation on t… |
CVE-2024-9930 | Critical | 9.8 | 2024-10-26 | The Extensions by HocWP Team plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2.3.2. This is due to missing vali… |
CVE-2024-9890 | High | 8.8 | 2024-10-26 | The User Toolkit plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.3. This is due to an improper capability che… |
CVE-2024-9626 | Medium | 4.3 | 2024-10-26 | The Editorial Assistant by Sovrn plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_zemanta… |
CVE-2024-9613 | Medium | 6.1 | 2024-10-26 | The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parame… |
CVE-2024-9475 | Medium | 4.9 | 2024-10-26 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versi… |
CVE-2024-9462 | Medium | 5.5 | 2024-10-26 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Stored Cross-Site Scripting via poll settings in all versions… |
CVE-2024-9454 | Medium | 6.4 | 2024-10-26 | The PriPre plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.11 due to insuffici… |
CVE-2024-10091 | Medium | 6.4 | 2024-10-26 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all versions up to, and i… |
CVE-2024-47821 | Critical | 9.1 | 2024-10-25 | pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a downl… |
CVE-2024-48239 | Medium | 4.8 | 2024-10-25 | An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Script… |
CVE-2024-48238 | Medium | 4.7 | 2024-10-25 | WTCMS 1.0 is vulnerable to SQL Injection in the edit_post method of /Admin\Controller\NavControl.class.php via the parentid parameter. |
CVE-2024-48237 | Critical | 9.8 | 2024-10-25 | WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php. |
CVE-2024-48236 | Medium | 6.5 | 2024-10-25 | An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of the ofcms-admin\src\… |
CVE-2024-48235 | Medium | 6.5 | 2024-10-25 | An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file. |
CVE-2024-48234 | Medium | 4.9 | 2024-10-25 | An issue was discovered in mipjz 5.0.5. In the push method of app\tag\controller\ApiAdminTag.php the value of the postAddress parameter is not processed and is… |
CVE-2024-48228 | Medium | 6.1 | 2024-10-25 | An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the p… |
CVE-2024-48396 | Medium | 6.1 | 2024-10-25 | AIML Chatbot 1.0 (fixed in 2.0) is vulnerable to Cross Site Scripting (XSS). The vulnerability is exploited through the message input field, where attackers ca… |
CVE-2024-48233 | Medium | 4.8 | 2024-10-25 | mipjz 5.0.5 is vulnerable to Cross Site Scripting (XSS) in \app\setting\controller\ApiAdminSetting.php via the ICP parameter. |
CVE-2024-48232 | Medium | 4.9 | 2024-10-25 | An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed a… |
CVE-2024-48230 | High | 7.2 | 2024-10-25 | funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php. |
CVE-2024-48229 | High | 7.2 | 2024-10-25 | funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin. |
CVE-2024-48227 | Medium | 4.9 | 2024-10-25 | Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS). |
CVE-2024-48226 | High | 7.2 | 2024-10-25 | Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield. |
CVE-2024-48225 | Medium | 6.5 | 2024-10-25 | Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile. |
CVE-2024-48224 | Medium | 4.9 | 2024-10-25 | Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile. |
CVE-2024-48223 | High | 7.2 | 2024-10-25 | Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist. |
CVE-2024-48222 | High | 7.2 | 2024-10-25 | Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit. |
CVE-2024-48218 | High | 7.2 | 2024-10-25 | Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list. |
CVE-2024-49767 | High | 7.5 | 2024-10-25 | Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werk… |
CVE-2024-49766 | Medium | 5.3 | 2024-10-25 | Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share… |
CVE-2024-48450 | Medium | 6.5 | 2024-10-25 | An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group. |
CVE-2024-37847 | High | 8.8 | 2024-10-25 | An arbitrary file upload vulnerability in MangoOS before 5.1.4 and Mango API before 4.5.5 allows attackers to execute arbitrary code via a crafted file. |
CVE-2024-37846 | Medium | 4.6 | 2024-10-25 | MangoOS before 5.2.0 was discovered to contain a Client-Side Template Injection (CSTI) vulnerability via the Platform Management Edit page. |
CVE-2024-37845 | High | 7.2 | 2024-10-25 | MangoOS before 5.2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Process Command feature. |
CVE-2024-37844 | Medium | 5.4 | 2024-10-25 | A stored cross-site scripting (XSS) vulnerability in MangoOS before 5.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2024-9585 | Medium | 6.4 | 2024-10-25 | The Image Map Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'save_project' function with an arbitrary shortcode in versions up… |
CVE-2024-9584 | Medium | 5.4 | 2024-10-25 | The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the AJAX functi… |
CVE-2024-48700 | High | 7.2 | 2024-10-25 | Kliqqi-CMS has a background arbitrary code execution vulnerability that attackers can exploit to implant backdoors or getShell via the edit_page.php component. |
CVE-2024-48448 | Medium | 6.1 | 2024-10-25 | An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into the tracker… |
CVE-2024-48343 | Medium | 6.3 | 2024-10-25 | A SQL Injection vulnerability in ESAFENET CDG 5 and earlier allows an attacker to execute arbitrary code via the id parameter of the dataSearch.jsp page. |