2024 CVEs (page 141)
Page 141 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10169 | Medium | 6.3 | 2024-10-20 | A vulnerability classified as critical was found in code-projects Hospital Management System 1.0. This vulnerability affects unknown code of the file change-pa… |
CVE-2024-10167 | High | 7.3 | 2024-10-20 | A vulnerability classified as critical has been found in Codezips Sales Management System 1.0. This affects an unknown part of the file deletecustind.php. The… |
CVE-2024-10166 | High | 7.3 | 2024-10-20 | A vulnerability was found in Codezips Sales Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-10165 | High | 7.3 | 2024-10-20 | A vulnerability was found in Codezips Sales Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2024-10163 | Medium | 6.3 | 2024-10-20 | A vulnerability was found in SourceCodester Sentiment Based Movie Rating System 1.0. It has been classified as critical. Affected is an unknown function of the… |
CVE-2024-10162 | Medium | 6.3 | 2024-10-20 | A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edi… |
CVE-2024-10161 | Medium | 6.3 | 2024-10-20 | A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file change-image.php o… |
CVE-2024-10160 | Medium | 6.3 | 2024-10-20 | A vulnerability, which was classified as critical, has been found in PHPGurukul Boat Booking System 1.0. Affected by this issue is some unknown functionality o… |
CVE-2024-10159 | High | 7.3 | 2024-10-20 | A vulnerability classified as critical was found in PHPGurukul Boat Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-10158 | Medium | 4.3 | 2024-10-19 | A vulnerability classified as problematic has been found in PHPGurukul Boat Booking System 1.0. Affected is the function session_start. The manipulation leads… |
CVE-2024-10157 | High | 7.3 | 2024-10-19 | A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/p… |
CVE-2024-10156 | High | 7.3 | 2024-10-19 | A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/i… |
CVE-2024-10155 | Low | 3.5 | 2024-10-19 | A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been classified as problematic. This affects an unknown part of the file book-boat.php?… |
CVE-2024-10154 | Medium | 6.3 | 2024-10-19 | A vulnerability was found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file st… |
CVE-2024-10153 | Medium | 6.3 | 2024-10-19 | A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-10142 | Low | 3.5 | 2024-10-19 | A vulnerability has been found in code-projects Blood Bank System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /viewr… |
CVE-2024-10141 | Low | 3.7 | 2024-10-19 | A vulnerability, which was classified as problematic, was found in jsbroks COCO Annotator 0.11.1. This affects an unknown part of the component Session Handler… |
CVE-2024-10140 | Medium | 6.3 | 2024-10-19 | A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2024-10139 | Medium | 6.3 | 2024-10-19 | A vulnerability classified as critical was found in code-projects Pharmacy Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-10138 | Medium | 6.3 | 2024-10-19 | A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. Affected is an unknown function of the file /add_new_pur… |
CVE-2024-10137 | Medium | 6.3 | 2024-10-19 | A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fil… |
CVE-2024-10136 | Medium | 6.3 | 2024-10-19 | A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-10135 | Medium | 6.3 | 2024-10-19 | A vulnerability was found in ESAFENET CDG 5. It has been classified as critical. This affects the function actionDelNetSecConfig of the file /com/esafenet/serv… |
CVE-2024-9897 | Medium | 6.4 | 2024-10-19 | The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-twitch-embed shortcode in all versio… |
CVE-2024-10134 | Medium | 6.3 | 2024-10-19 | A vulnerability was found in ESAFENET CDG 5 and classified as critical. Affected by this issue is the function connectLogout of the file /com/esafenet/servlet/… |
CVE-2024-10133 | Medium | 6.3 | 2024-10-19 | A vulnerability has been found in ESAFENET CDG 5 and classified as critical. Affected by this vulnerability is the function updateNetSecPolicyPriority of the f… |
CVE-2024-9889 | Medium | 4.3 | 2024-10-19 | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.9 via th… |
CVE-2024-21536 | High | 7.5 | 2024-10-19 | Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRej… |
CVE-2024-9219 | Medium | 6.1 | 2024-10-19 | The WordPress Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc… |
CVE-2024-10131 | High | 8.8 | 2024-10-19 | The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-suppli… |
CVE-2024-43577 | Medium | 4.3 | 2024-10-18 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-37404 | High | 8.8 | 2024-10-18 | Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote au… |
CVE-2024-29821 | High | 7.8 | 2024-10-18 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vec… |
CVE-2024-29213 | High | 7.8 | 2024-10-18 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vec… |
CVE-2024-10130 | High | 8.8 | 2024-10-18 | A vulnerability classified as critical was found in Tenda AC8 16.03.34.06. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSy… |
CVE-2024-10129 | Medium | 6.3 | 2024-10-18 | A vulnerability classified as critical has been found in HFO4 shudong-share up to 2.4.7. This affects an unknown part of the file /includes/create_share.php of… |
CVE-2024-10128 | Low | 2.7 | 2024-10-18 | A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been rated as problematic. Affected by this issue is some unknown functionality of t… |
CVE-2024-10123 | High | 8.8 | 2024-10-18 | A vulnerability was found in Tenda AC8 16.03.34.06. It has been declared as critical. Affected by this vulnerability is the function compare_parentcontrol_time… |
CVE-2024-49361 | | 2024-10-18 | ACON is a widely-used library of tools for machine learning that focuses on adaptive correlation optimization. A potential vulnerability has been identified in… | |
CVE-2024-45944 | Critical | 9.8 | 2024-10-18 | In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execu… |
CVE-2024-10122 | Low | 2.7 | 2024-10-18 | A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been classified as problematic. Affected is an unknown function of the file /InnerRe… |
CVE-2024-10121 | High | 7.3 | 2024-10-18 | A vulnerability was found in wfh45678 Radar up to 1.0.8 and classified as critical. This issue affects some unknown processing of the component Interface Handl… |
CVE-2024-9593 | High | 8.3 | 2024-10-18 | The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock)… |
CVE-2024-48016 | Medium | 4.6 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. A low privil… |
CVE-2024-47241 | Medium | 5.5 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains an Improper Certificate Validation vulnerability. A low privileged attacker wi… |
CVE-2024-10120 | High | 7.3 | 2024-10-18 | A vulnerability has been found in wfh45678 Radar up to 1.0.8 and classified as critical. This vulnerability affects unknown code of the file /services/v1/commo… |
CVE-2024-42508 | Medium | 5.5 | 2024-10-18 | This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users. |
CVE-2024-9537 | Critical | 9.8 | 2024-10-18 | ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The vulnerability… |
CVE-2024-47240 | Medium | 5.5 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.24 contains an Incorrect Default Permissions vulnerability. A local attacker with low privileges can access the file system… |
CVE-2024-9674 | Medium | 6.4 | 2024-10-18 | The Debrandify · Remove or Replace WordPress Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up… |
CVE-2024-43300 | Medium | 5.9 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bert Movie Database movie-database allows Stored XSS.This… |
CVE-2024-9425 | Medium | 6.4 | 2024-10-18 | The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ad_tax_image shortcode in al… |
CVE-2024-49243 | High | 7.5 | 2024-10-18 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ramjon27 Dynamic Elementor Addons dyna… |
CVE-2024-49241 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tady Tito tito allows DOM-Based XSS.This issue affects Ti… |
CVE-2024-49240 | High | 7.1 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajberasategui AB Categories Search Widget ab-categories-… |
CVE-2024-49239 | High | 7.1 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nikhilvaghela Add Categories Post Footer add-categories-p… |
CVE-2024-49238 | High | 7.1 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emka73 ADIF Log Search Widget adif-log-search-widget allo… |
CVE-2024-49236 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box crazy-call-to-… |
CVE-2024-49234 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeworm Plexx Elementor Extension plexx-elementor-exten… |
CVE-2024-49233 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MadrasThemes MAS Elementor mas-addons-for-elementor allow… |
CVE-2024-49232 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in derethor El mejor Cluster mejorcluster allows DOM-Based X… |
CVE-2024-49231 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cyclop WordPress Video wordpress-video allows Stored XSS… |
CVE-2024-49230 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harry005 Ajax Custom CSS/JS ajax-awesome-css allows Refle… |
CVE-2024-49228 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edwin Rivera bVerse Convert bverse-convert allows Stored… |
CVE-2024-49225 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in swebdeveloper wpPricing Builder wppricing-builder-lite-re… |
CVE-2024-49224 | High | 7.1 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mahesh_9696 Mitm Bug Tracker mitm-bug-tracker allows Refl… |
CVE-2024-10057 | Medium | 6.4 | 2024-10-18 | The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and… |
CVE-2024-4740 | Medium | 5.3 | 2024-10-18 | MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials. This vulnerability could allow an attacker to tamper… |
CVE-2024-4739 | Medium | 5.3 | 2024-10-18 | The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authe… |
CVE-2024-47487 | High | 8.8 | 2024-10-18 | There is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitrary SQL queries. |
CVE-2024-47486 | Medium | 6.1 | 2024-10-18 | There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious… |
CVE-2024-47485 | Critical | 9.8 | 2024-10-18 | There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable com… |
CVE-2024-10080 | Medium | 6.4 | 2024-10-18 | The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insuffici… |
CVE-2024-10079 | High | 8.8 | 2024-10-18 | The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted inpu… |
CVE-2024-10078 | Medium | 6.3 | 2024-10-18 | The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple… |
CVE-2024-10055 | Medium | 6.4 | 2024-10-18 | The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaio_snapchat sh… |
CVE-2024-9703 | Medium | 6.4 | 2024-10-18 | The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and includi… |
CVE-2024-9206 | Medium | 6.1 | 2024-10-18 | The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate e… |
CVE-2024-47793 | Medium | 5.4 | 2024-10-18 | Stored cross-site scripting vulnerability exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. When accessing the edit screen containing custom… |
CVE-2024-46897 | Low | 3.8 | 2024-10-18 | Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. A logged-in user with the permi… |
CVE-2024-38820 | Low | 3.1 | 2024-10-18 | The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions th… |
CVE-2024-9892 | Medium | 4.4 | 2024-10-18 | The Add Widget After Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.6 d… |
CVE-2024-9848 | Medium | 6.4 | 2024-10-18 | The Product Customizer Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0… |
CVE-2024-9452 | Medium | 6.4 | 2024-10-18 | The Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficie… |
CVE-2024-9383 | Medium | 6.1 | 2024-10-18 | The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.8.4 due… |
CVE-2024-9382 | Medium | 6.1 | 2024-10-18 | The Gantry 4 Framework plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'override_id' parameter in all versions up to, and includin… |
CVE-2024-9373 | Medium | 6.4 | 2024-10-18 | The Elemenda plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.0.2 due to insuffic… |
CVE-2024-9366 | Medium | 6.4 | 2024-10-18 | The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0… |
CVE-2024-9364 | Medium | 4.3 | 2024-10-18 | The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mailplus_clear_logs' fu… |
CVE-2024-9361 | Medium | 4.3 | 2024-10-18 | The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2024-9350 | Medium | 6.1 | 2024-10-18 | The DPD Baltic Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_value' parameter in all versions up to, and includ… |
CVE-2024-8916 | Medium | 6.4 | 2024-10-18 | The Suki Sites Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to… |
CVE-2024-8790 | Medium | 6.1 | 2024-10-18 | The Social Share With Floating Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc… |
CVE-2024-8740 | Medium | 6.1 | 2024-10-18 | The GetResponse Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc… |
CVE-2024-10119 | Critical | 9.8 | 2024-10-18 | The wireless router WRTM326 from SECOM does not properly validate a specific parameter. An unauthenticated remote attacker could execute arbitrary system comma… |
CVE-2024-10049 | Medium | 6.1 | 2024-10-18 | The Edit WooCommerce Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and includi… |
CVE-2024-10040 | Medium | 5.3 | 2024-10-18 | The Infinite-Scroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or inc… |
CVE-2024-10014 | Medium | 6.4 | 2024-10-18 | The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient inpu… |
CVE-2024-9264 | Critical | 9.9 | 2024-10-18 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanit… |
CVE-2024-10118 | Critical | 9.8 | 2024-10-18 | SECOM WRTR-304GN-304TW-UPSC does not properly filter user input in the specific functionality. Unauthenticated remote attackers can exploit this vulnerability… |