2024 CVEs (page 141)
Page 141 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-49608 | High | 8.8 | 2024-10-20 | Incorrect Privilege Assignment vulnerability in gerryworks GERRYWORKS Post by Mail gerryworks-post-by-mail allows Privilege Escalation.This issue affects GERRY… |
CVE-2024-49607 | Critical | 10.0 | 2024-10-20 | Unrestricted Upload of File with Dangerous Type vulnerability in redhopit WP Dropbox Dropins wp-dropbox-dropins allows Upload a Web Shell to a Web Server.This… |
CVE-2024-49332 | Critical | 9.8 | 2024-10-20 | Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from… |
CVE-2024-49331 | Critical | 9.9 | 2024-10-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Property Lot Management System plms allows Upload a Web Shell to a Web Server… |
CVE-2024-49330 | Critical | 10.0 | 2024-10-20 | Unrestricted Upload of File with Dangerous Type vulnerability in brx8r Nice Backgrounds nicebackgrounds allows Upload a Web Shell to a Web Server.This issue af… |
CVE-2024-49329 | Critical | 10.0 | 2024-10-20 | Unrestricted Upload of File with Dangerous Type vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Upload a Web Shell to a Web Server.This iss… |
CVE-2024-49327 | Critical | 10.0 | 2024-10-20 | Unrestricted Upload of File with Dangerous Type vulnerability in bepitulaz Woostagram Connect woostagram-connect allows Upload a Web Shell to a Web Server.This… |
CVE-2024-49326 | Critical | 10.0 | 2024-10-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Vasileios Kerasiotis Affiliator affiliator-lite allows Upload a Web Shell to a Web Server.This… |
CVE-2024-49324 | Critical | 10.0 | 2024-10-20 | Unrestricted Upload of File with Dangerous Type vulnerability in sovratecdev Sovratec Case Management sovratec-case-management allows Upload a Web Shell to a W… |
CVE-2024-10195 | Medium | 4.7 | 2024-10-20 | A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-49631 | Medium | 6.5 | 2024-10-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abdul Kader Easy Addons for Elementor easy-addons-for-… |
CVE-2024-49630 | Medium | 6.5 | 2024-10-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems WP Education wp-education allows Stored XSS.This… |
CVE-2024-49626 | Critical | 9.8 | 2024-10-20 | Deserialization of Untrusted Data vulnerability in Piyush Patel Shipyaari Shipping Management shipyaari-shipping-managment allows Object Injection.This issue a… |
CVE-2024-49611 | Critical | 10.0 | 2024-10-20 | Unrestricted Upload of File with Dangerous Type vulnerability in paxmanpwnz Product Website Showcase product-websites-showcase allows Upload a Web Shell to a W… |
CVE-2024-49606 | High | 7.1 | 2024-10-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Google Map Locations google-map-locations a… |
CVE-2024-49604 | Critical | 9.8 | 2024-10-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Media Simple User Registration wp-registration allows Authentication Bypass.This is… |
CVE-2024-49334 | High | 7.1 | 2024-10-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unizoe Web Solutions jLayer Parallax Slider jlayer-parall… |
CVE-2024-49328 | Critical | 9.8 | 2024-10-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Authentication Bypass.This issue a… |
CVE-2024-49323 | High | 7.1 | 2024-10-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahriar Alam All in One Slider all-in-one-slider allows… |
CVE-2024-49286 | Critical | 9.6 | 2024-10-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV Events ssv-events allows PHP Local File Inc… |
CVE-2024-48049 | Medium | 6.5 | 2024-10-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mighty Plugins Mighty Builder mighty-builder allows Store… |
CVE-2024-10194 | High | 8.8 | 2024-10-20 | A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been classified as critical. Affected is the function Goto_chidx of… |
CVE-2024-10193 | Medium | 4.7 | 2024-10-20 | A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical. This issue affects the function ping_ddns of the… |
CVE-2024-10192 | Low | 3.5 | 2024-10-20 | A vulnerability has been found in PHPGurukul IFSC Code Finder Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file se… |
CVE-2024-10191 | Low | 3.5 | 2024-10-20 | A vulnerability, which was classified as problematic, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file /admin/book-det… |
CVE-2024-10173 | High | 7.3 | 2024-10-20 | A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console… |
CVE-2024-10171 | Medium | 4.7 | 2024-10-20 | A vulnerability, which was classified as critical, was found in code-projects Blood Bank System up to 1.0. Affected is an unknown function of the file /admin/m… |
CVE-2024-10170 | Medium | 6.3 | 2024-10-20 | A vulnerability, which was classified as critical, has been found in code-projects Hospital Management System 1.0. This issue affects some unknown processing o… |
CVE-2024-10169 | Medium | 6.3 | 2024-10-20 | A vulnerability classified as critical was found in code-projects Hospital Management System 1.0. This vulnerability affects unknown code of the file change-pa… |
CVE-2024-10167 | High | 7.3 | 2024-10-20 | A vulnerability classified as critical has been found in Codezips Sales Management System 1.0. This affects an unknown part of the file deletecustind.php. The… |
CVE-2024-10166 | High | 7.3 | 2024-10-20 | A vulnerability was found in Codezips Sales Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-10165 | High | 7.3 | 2024-10-20 | A vulnerability was found in Codezips Sales Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2024-10163 | Medium | 6.3 | 2024-10-20 | A vulnerability was found in SourceCodester Sentiment Based Movie Rating System 1.0. It has been classified as critical. Affected is an unknown function of the… |
CVE-2024-10162 | Medium | 6.3 | 2024-10-20 | A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edi… |
CVE-2024-10161 | Medium | 6.3 | 2024-10-20 | A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file change-image.php o… |
CVE-2024-10160 | Medium | 6.3 | 2024-10-20 | A vulnerability, which was classified as critical, has been found in PHPGurukul Boat Booking System 1.0. Affected by this issue is some unknown functionality o… |
CVE-2024-10159 | High | 7.3 | 2024-10-20 | A vulnerability classified as critical was found in PHPGurukul Boat Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-10158 | Medium | 4.3 | 2024-10-19 | A vulnerability classified as problematic has been found in PHPGurukul Boat Booking System 1.0. Affected is the function session_start. The manipulation leads… |
CVE-2024-10157 | High | 7.3 | 2024-10-19 | A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/p… |
CVE-2024-10156 | High | 7.3 | 2024-10-19 | A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/i… |
CVE-2024-10155 | Low | 3.5 | 2024-10-19 | A vulnerability was found in PHPGurukul Boat Booking System 1.0. It has been classified as problematic. This affects an unknown part of the file book-boat.php?… |
CVE-2024-10154 | Medium | 6.3 | 2024-10-19 | A vulnerability was found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file st… |
CVE-2024-10153 | Medium | 6.3 | 2024-10-19 | A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-10142 | Low | 3.5 | 2024-10-19 | A vulnerability has been found in code-projects Blood Bank System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /viewr… |
CVE-2024-10141 | Low | 3.7 | 2024-10-19 | A vulnerability, which was classified as problematic, was found in jsbroks COCO Annotator 0.11.1. This affects an unknown part of the component Session Handler… |
CVE-2024-10140 | Medium | 6.3 | 2024-10-19 | A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. Affected by this issue is some unknown funct… |
CVE-2024-10139 | Medium | 6.3 | 2024-10-19 | A vulnerability classified as critical was found in code-projects Pharmacy Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-10138 | Medium | 6.3 | 2024-10-19 | A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. Affected is an unknown function of the file /add_new_pur… |
CVE-2024-10137 | Medium | 6.3 | 2024-10-19 | A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fil… |
CVE-2024-10136 | Medium | 6.3 | 2024-10-19 | A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fil… |
CVE-2024-10135 | Medium | 6.3 | 2024-10-19 | A vulnerability was found in ESAFENET CDG 5. It has been classified as critical. This affects the function actionDelNetSecConfig of the file /com/esafenet/serv… |
CVE-2024-9897 | Medium | 6.4 | 2024-10-19 | The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-twitch-embed shortcode in all versio… |
CVE-2024-10134 | Medium | 6.3 | 2024-10-19 | A vulnerability was found in ESAFENET CDG 5 and classified as critical. Affected by this issue is the function connectLogout of the file /com/esafenet/servlet/… |
CVE-2024-10133 | Medium | 6.3 | 2024-10-19 | A vulnerability has been found in ESAFENET CDG 5 and classified as critical. Affected by this vulnerability is the function updateNetSecPolicyPriority of the f… |
CVE-2024-9889 | Medium | 4.3 | 2024-10-19 | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.9 via th… |
CVE-2024-21536 | High | 7.5 | 2024-10-19 | Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRej… |
CVE-2024-9219 | Medium | 6.1 | 2024-10-19 | The WordPress Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc… |
CVE-2024-10131 | High | 8.8 | 2024-10-19 | The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-suppli… |
CVE-2024-43577 | Medium | 4.3 | 2024-10-18 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-37404 | High | 8.8 | 2024-10-18 | Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote au… |
CVE-2024-29821 | High | 7.8 | 2024-10-18 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vec… |
CVE-2024-29213 | High | 7.8 | 2024-10-18 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vec… |
CVE-2024-10130 | High | 8.8 | 2024-10-18 | A vulnerability classified as critical was found in Tenda AC8 16.03.34.06. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSy… |
CVE-2024-10129 | Medium | 6.3 | 2024-10-18 | A vulnerability classified as critical has been found in HFO4 shudong-share up to 2.4.7. This affects an unknown part of the file /includes/create_share.php of… |
CVE-2024-10128 | Low | 2.7 | 2024-10-18 | A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been rated as problematic. Affected by this issue is some unknown functionality of t… |
CVE-2024-10123 | High | 8.8 | 2024-10-18 | A vulnerability was found in Tenda AC8 16.03.34.06. It has been declared as critical. Affected by this vulnerability is the function compare_parentcontrol_time… |
CVE-2024-49361 | | 2024-10-18 | ACON is a widely-used library of tools for machine learning that focuses on adaptive correlation optimization. A potential vulnerability has been identified in… | |
CVE-2024-45944 | Critical | 9.8 | 2024-10-18 | In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execu… |
CVE-2024-10122 | Low | 2.7 | 2024-10-18 | A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been classified as problematic. Affected is an unknown function of the file /InnerRe… |
CVE-2024-10121 | High | 7.3 | 2024-10-18 | A vulnerability was found in wfh45678 Radar up to 1.0.8 and classified as critical. This issue affects some unknown processing of the component Interface Handl… |
CVE-2024-9593 | High | 8.3 | 2024-10-18 | The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock)… |
CVE-2024-48016 | Medium | 4.6 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. A low privil… |
CVE-2024-47241 | Medium | 5.5 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains an Improper Certificate Validation vulnerability. A low privileged attacker wi… |
CVE-2024-10120 | High | 7.3 | 2024-10-18 | A vulnerability has been found in wfh45678 Radar up to 1.0.8 and classified as critical. This vulnerability affects unknown code of the file /services/v1/commo… |
CVE-2024-42508 | Medium | 5.5 | 2024-10-18 | This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users. |
CVE-2024-9537 | Critical | 9.8 | 2024-10-18 | ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The vulnerability… |
CVE-2024-47240 | Medium | 5.5 | 2024-10-18 | Dell Secure Connect Gateway (SCG) 5.24 contains an Incorrect Default Permissions vulnerability. A local attacker with low privileges can access the file system… |
CVE-2024-9674 | Medium | 6.4 | 2024-10-18 | The Debrandify · Remove or Replace WordPress Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up… |
CVE-2024-43300 | Medium | 5.9 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bert Movie Database movie-database allows Stored XSS.This… |
CVE-2024-9425 | Medium | 6.4 | 2024-10-18 | The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ad_tax_image shortcode in al… |
CVE-2024-49243 | High | 7.5 | 2024-10-18 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ramjon27 Dynamic Elementor Addons dyna… |
CVE-2024-49241 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tady Tito tito allows DOM-Based XSS.This issue affects Ti… |
CVE-2024-49240 | High | 7.1 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajberasategui AB Categories Search Widget ab-categories-… |
CVE-2024-49239 | High | 7.1 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nikhilvaghela Add Categories Post Footer add-categories-p… |
CVE-2024-49238 | High | 7.1 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emka73 ADIF Log Search Widget adif-log-search-widget allo… |
CVE-2024-49236 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box crazy-call-to-… |
CVE-2024-49234 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeworm Plexx Elementor Extension plexx-elementor-exten… |
CVE-2024-49233 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MadrasThemes MAS Elementor mas-addons-for-elementor allow… |
CVE-2024-49232 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in derethor El mejor Cluster mejorcluster allows DOM-Based X… |
CVE-2024-49231 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cyclop WordPress Video wordpress-video allows Stored XSS… |
CVE-2024-49230 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harry005 Ajax Custom CSS/JS ajax-awesome-css allows Refle… |
CVE-2024-49228 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edwin Rivera bVerse Convert bverse-convert allows Stored… |
CVE-2024-49225 | Medium | 6.5 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in swebdeveloper wpPricing Builder wppricing-builder-lite-re… |
CVE-2024-49224 | High | 7.1 | 2024-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mahesh_9696 Mitm Bug Tracker mitm-bug-tracker allows Refl… |
CVE-2024-10057 | Medium | 6.4 | 2024-10-18 | The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and… |
CVE-2024-4740 | Medium | 5.3 | 2024-10-18 | MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials. This vulnerability could allow an attacker to tamper… |
CVE-2024-4739 | Medium | 5.3 | 2024-10-18 | The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authe… |
CVE-2024-47487 | High | 8.8 | 2024-10-18 | There is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitrary SQL queries. |
CVE-2024-47486 | Medium | 6.1 | 2024-10-18 | There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious… |
CVE-2024-47485 | Critical | 9.8 | 2024-10-18 | There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable com… |