2024 CVEs (page 136)
Page 136 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-49669 | Critical | 9.9 | 2024-10-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Alexander De Ridder INK Official ink-official allows Upload a Web Shell to a Web Server.This i… |
CVE-2024-49668 | Critical | 10.0 | 2024-10-23 | Unrestricted Upload of File with Dangerous Type vulnerability in christopherdewese1099 Verbalize WP verbalize-wp allows Upload a Web Shell to a Web Server.This… |
CVE-2024-49658 | Critical | 9.9 | 2024-10-23 | Unrestricted Upload of File with Dangerous Type vulnerability in ecomerciar Woocommerce Custom Profile Picture woo-custom-profile-picture allows Upload a Web S… |
CVE-2024-49657 | High | 7.7 | 2024-10-23 | Missing Authorization vulnerability in Renata Bracichowicz 3D Work In Progress renee-work-in-progress allows Exploiting Incorrectly Configured Access Control S… |
CVE-2024-49653 | Critical | 9.9 | 2024-10-23 | Unrestricted Upload of File with Dangerous Type vulnerability in james-eggers Portfolleo portfolleo allows Upload a Web Shell to a Web Server.This issue affect… |
CVE-2024-49652 | Critical | 9.9 | 2024-10-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Renata Bracichowicz 3D Work In Progress renee-work-in-progress allows Upload a Web Shell to a… |
CVE-2024-30124 | Medium | 4.0 | 2024-10-23 | HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol… |
CVE-2024-10293 | Medium | 6.3 | 2024-10-23 | A vulnerability was found in ZZCMS 2023. It has been classified as critical. Affected is the function Ebak_SetGotoPak of the file 3/Ebbak5.1/upload/class/funct… |
CVE-2024-10292 | Medium | 6.3 | 2024-10-23 | A vulnerability was found in ZZCMS 2023 and classified as critical. This issue affects some unknown processing of the file 3/Ebak5.1/upload/ChangeTable.php. Th… |
CVE-2024-10291 | Medium | 6.3 | 2024-10-23 | A vulnerability has been found in ZZCMS 2023 and classified as critical. This vulnerability affects the function Ebak_DoExecSQL/Ebak_DotranExecutSQL of the fil… |
CVE-2024-5764 | Medium | 6.5 | 2024-10-23 | Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the N… |
CVE-2024-49675 | High | 8.8 | 2024-10-23 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Vitalii iBryl Switch User ibryl-switch-user allows Authentication Bypass.This issue a… |
CVE-2024-49370 | Medium | 4.9 | 2024-10-23 | Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is… |
CVE-2024-47904 | High | 7.8 | 2024-10-23 | A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 on… |
CVE-2024-47903 | Medium | 5.8 | 2024-10-23 | A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 on… |
CVE-2024-47902 | High | 7.2 | 2024-10-23 | A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 on… |
CVE-2024-47901 | Critical | 10.0 | 2024-10-23 | A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 on… |
CVE-2024-47575 | Critical | 9.8 | 2024-10-23 | A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 th… |
CVE-2024-30122 | Medium | 5.8 | 2024-10-23 | HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This w… |
CVE-2024-10290 | Medium | 5.3 | 2024-10-23 | A vulnerability, which was classified as problematic, was found in ZZCMS 2023. This affects an unknown part of the file 3/qq-connect2.0/API/com/inc.php. The ma… |
CVE-2024-10283 | High | 8.8 | 2024-10-23 | A vulnerability, which was classified as critical, has been found in Tenda RX9 and RX9 Pro 22.03.02.20. Affected by this issue is the function sub_4337EC of th… |
CVE-2024-10282 | High | 8.8 | 2024-10-23 | A vulnerability classified as critical was found in Tenda RX9 and RX9 Pro 22.03.02.10/22.03.02.20. Affected by this vulnerability is the function sub_42EA38 of… |
CVE-2024-50050 | Medium | 6.3 | 2024-10-23 | Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for… |
CVE-2024-10281 | High | 8.8 | 2024-10-23 | A vulnerability classified as critical has been found in Tenda RX9 and RX9 Pro 22.03.02.10/22.03.02.20. Affected is the function sub_42EEE0 of the file /goform… |
CVE-2024-10280 | Medium | 6.5 | 2024-10-23 | A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue a… |
CVE-2024-10250 | Medium | 6.1 | 2024-10-23 | The Nioland theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in all versions up to, and including, 1.2.6 due to insuff… |
CVE-2024-10041 | Medium | 4.7 | 2024-10-23 | A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending character… |
CVE-2024-10279 | Medium | 6.3 | 2024-10-23 | A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. This vulnerability affects unknown code of the file /com/esafenet/servlet/policy… |
CVE-2024-10278 | Medium | 6.3 | 2024-10-23 | A vulnerability was found in ESAFENET CDG 5. It has been classified as critical. This affects an unknown part of the file /com/esafenet/servlet/user/ReUserOrga… |
CVE-2024-10289 | Medium | 6.1 | 2024-10-23 | Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user… |
CVE-2024-10288 | Medium | 6.1 | 2024-10-23 | Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user… |
CVE-2024-10287 | Medium | 6.1 | 2024-10-23 | Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user… |
CVE-2024-10286 | Medium | 6.1 | 2024-10-23 | Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user… |
CVE-2024-10277 | Medium | 6.3 | 2024-10-23 | A vulnerability was found in ESAFENET CDG 5 and classified as critical. Affected by this issue is some unknown functionality of the file /com/esafenet/servlet/… |
CVE-2024-8500 | Medium | 5.4 | 2024-10-23 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up… |
CVE-2024-10276 | Low | 3.5 | 2024-10-23 | A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-9530 | Medium | 4.3 | 2024-10-23 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templa… |
CVE-2024-43924 | Medium | 5.3 | 2024-10-23 | Missing Authorization vulnerability in dFactory Responsive Lightbox allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Responsi… |
CVE-2024-10045 | Medium | 4.3 | 2024-10-23 | The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or… |
CVE-2024-9947 | High | 8.1 | 2024-10-23 | The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient veri… |
CVE-2024-9583 | Medium | 4.3 | 2024-10-23 | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functionality due to a mi… |
CVE-2024-9829 | Medium | 6.5 | 2024-10-23 | The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwap_handle_download_user' an… |
CVE-2024-50066 | High | 7.8 | 2024-10-23 | In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix move_normal_pmd/retract_page_tables race In mremap(), move_page_tables() l… |
CVE-2024-9927 | High | 7.2 | 2024-10-23 | The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and including 2.0.5. This is… |
CVE-2024-31880 | Medium | 5.3 | 2024-10-23 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service, under specific configurations, as… |
CVE-2024-7587 | High | 7.8 | 2024-10-22 | Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, M… |
CVE-2024-48657 | High | 7.2 | 2024-10-22 | SQL Injection vulnerability in hospital management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code. |
CVE-2024-48656 | Medium | 4.8 | 2024-10-22 | Cross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code. |
CVE-2024-48652 | Medium | 4.8 | 2024-10-22 | Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field. |
CVE-2024-48644 | Medium | 5.3 | 2024-10-22 | Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote attackers to deter… |
CVE-2024-48415 | Medium | 5.0 | 2024-10-22 | itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middlename, address, con… |
CVE-2024-46483 | Critical | 9.8 | 2024-10-22 | Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap overflow with attacke… |
CVE-2024-46482 | High | 8.2 | 2024-10-22 | An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to execute arbitrary c… |
CVE-2024-44812 | Critical | 9.8 | 2024-10-22 | SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the username and password parameters in the /adm… |
CVE-2024-44331 | High | 7.5 | 2024-10-22 | Incorrect Access Control in GStreamer RTSP server 1.25.0 in gst-rtsp-server/rtsp-media.c allows remote attackers to cause a denial of service via a series of s… |
CVE-2024-43812 | High | 8.4 | 2024-10-22 | Kieback & Peter's DDC4000 series has an insufficiently protected credentials vulnerability, which may allow an unauthenticated attacker with access to /etc/pas… |
CVE-2024-43698 | Critical | 9.8 | 2024-10-22 | Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin rights on the system. |
CVE-2024-42643 | High | 7.5 | 2024-10-22 | Integer Overflow in fast_ping.c in SmartDNS Release46 allows remote attackers to cause a Denial of Service via misaligned memory access. |
CVE-2024-41717 | Critical | 9.8 | 2024-10-22 | Kieback & Peter's DDC4000 series is vulnerable to a path traversal vulnerability, which may allow an unauthenticated attacker to read files on the system. |
CVE-2024-40494 | Critical | 9.8 | 2024-10-22 | Buffer Overflow in coap_msg.c in FreeCoAP allows remote attackers to execute arbitrary code or cause a denial of service (stack buffer overflow) via a crafted… |
CVE-2024-40493 | Critical | 9.8 | 2024-10-22 | Null Pointer Dereference in `coap_client_exchange_blockwise2` function in Keith Cullen FreeCoAP 1.0 allows remote attackers to cause a denial of service and po… |
CVE-2024-31029 | High | 8.2 | 2024-10-22 | An issue in the server_handle_regular function of the test_coap_server.c file within the FreeCoAP project allows remote attackers to cause a Denial of Service… |
CVE-2024-26519 | Critical | 9.0 | 2024-10-22 | An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.c… |
CVE-2024-10231 | High | 8.8 | 2024-10-22 | Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-10230 | High | 8.8 | 2024-10-22 | Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-10229 | High | 8.1 | 2024-10-22 | Inappropriate implementation in Extensions in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to bypass site isolation via a crafted Chrome Exte… |
CVE-2024-48919 | | 2024-10-22 | Cursor is a code editor built for programming with AI. Prior to Sep 27, 2024, if a user generated a terminal command via Cursor's Terminal Cmd-K/Ctrl-K feature… | |
CVE-2024-45526 | Medium | 5.3 | 2024-10-22 | An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and ca… |
CVE-2024-48904 | Critical | 9.8 | 2024-10-22 | An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. Please note: au… |
CVE-2024-48903 | High | 7.8 | 2024-10-22 | An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affected installations. … |
CVE-2024-46903 | Medium | 6.5 | 2024-10-22 | A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive information affected install… |
CVE-2024-46902 | High | 8.4 | 2024-10-22 | A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive information affected install… |
CVE-2024-45335 | High | 8.4 | 2024-10-22 | Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted virus to allow itself t… |
CVE-2024-45334 | High | 7.8 | 2024-10-22 | Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthorized access to produ… |
CVE-2024-41183 | High | 7.8 | 2024-10-22 | Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevation of privileges. |
CVE-2024-39753 | High | 7.5 | 2024-10-22 | An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please not… |
CVE-2024-10183 | | 2024-10-22 | A vulnerability in Jamf Pro's Jamf Remote Assist tool allows a local, non-privileged user to escalate their privileges to root on MacOS systems. | |
CVE-2024-9287 | High | 7.8 | 2024-10-22 | A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, all… |
CVE-2024-9129 | | 2024-10-22 | In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan Marino | |
CVE-2024-49211 | Medium | 5.2 | 2024-10-22 | Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker co… |
CVE-2024-49210 | Medium | 5.2 | 2024-10-22 | Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could po… |
CVE-2024-49209 | Medium | 6.5 | 2024-10-22 | Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application files. A remote unpri… |
CVE-2024-49208 | Medium | 5.9 | 2024-10-22 | Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. A remote unprivile… |
CVE-2024-48708 | Medium | 5.4 | 2024-10-22 | Collabtive 3.1 is vulnerable to Cross-Site Scripting (XSS) via the name parameter in (a) file tasklist.php under action = add/edit and in (b) file admin.php un… |
CVE-2024-48707 | Medium | 5.4 | 2024-10-22 | Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under (a) action=add or action=edit within managemilestone.php file and (b) a… |
CVE-2024-48706 | Medium | 5.4 | 2024-10-22 | Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the title parameter with action=add or action=editform within the (a) managemessage.php file and… |
CVE-2024-48570 | High | 7.5 | 2024-10-22 | Client Management System 1.0 was discovered to contain a SQL injection vulnerability via the Between Dates Reports parameter at /admin/bwdates-reports-ds.php. |
CVE-2024-46538 | Medium | 4.8 | 2024-10-22 | A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-45518 | High | 8.8 | 2024-10-22 | An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows… |
CVE-2024-49373 | Medium | 4.1 | 2024-10-22 | No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user can view projects wit… |
CVE-2024-48929 | Medium | 4.2 | 2024-10-22 | Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8… |
CVE-2024-48927 | Medium | 4.6 | 2024-10-22 | Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to… |
CVE-2024-48926 | Medium | 4.2 | 2024-10-22 | Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10… |
CVE-2024-48925 | Unrated | | 2024-10-22 | Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. Th… |
CVE-2024-48605 | High | 7.8 | 2024-10-22 | An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper validation of the wow64log.dll file. |
CVE-2024-47819 | Medium | 4.2 | 2024-10-22 | Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3… |
CVE-2024-46240 | Medium | 4.8 | 2024-10-22 | Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under action=system and the company/contact parameters under action=addcust w… |
CVE-2024-8980 | Critical | 9.6 | 2024-10-22 | The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35… |
CVE-2024-43177 | Medium | 5.9 | 2024-10-22 | IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. |
CVE-2024-43173 | Low | 3.7 | 2024-10-22 | IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. |