2024 CVEs (page 142)
Page 142 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-49023 | Medium | 5.9 | 2024-10-18 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43596 | Medium | 6.5 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43595 | Medium | 6.5 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43587 | Medium | 5.9 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43580 | Medium | 5.4 | 2024-10-17 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-43579 | High | 7.6 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43578 | High | 7.6 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43566 | High | 7.5 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-10093 | High | 7.8 | 2024-10-17 | A vulnerability, which was classified as critical, was found in VSO ConvertXtoDvd 7.0.0.83. Affected is an unknown function in the library avcodec.dll of the f… |
CVE-2024-7316 | Medium | 5.9 | 2024-10-17 | Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric CNC Series allows a remote unauthenticated attacker to cause Denial of… |
CVE-2024-33453 | High | 8.1 | 2024-10-17 | Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component. |
CVE-2024-30875 | High | 7.1 | 2024-10-17 | Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1.13.1 allows a remote attacker to obtain sensitive information and execute arbitrary code… |
CVE-2024-27766 | Medium | 5.7 | 2024-10-17 | An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. NOTE: this is disputed by the MariaDB Found… |
CVE-2024-48924 | | 2024-10-17 | ### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker th… | |
CVE-2024-49288 | Medium | 5.9 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce emai… |
CVE-2024-49283 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows Reflected XSS… |
CVE-2024-49282 | Medium | 5.9 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox responsive-lightbox allows S… |
CVE-2024-49281 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Fl… |
CVE-2024-49280 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weblizar - WordPress Themes & Plugin Lightbox slider – Re… |
CVE-2024-49279 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Floeter Hyperlink Group Block hyperlink-group-bloc… |
CVE-2024-49278 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This… |
CVE-2024-49277 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-eleme… |
CVE-2024-49276 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cliogrow Clio Grow clio-grow-form allows Reflected XSS.Th… |
CVE-2024-49264 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Events Addon for Elementor events-addon-for-e… |
CVE-2024-49263 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama My Favorites my-favorites allows Stored… |
CVE-2024-49262 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wepic Country Flags for Elementor allows Stored XS… |
CVE-2024-49261 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks.This issue affects Arkhe Bl… |
CVE-2024-49259 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for… |
CVE-2024-49255 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniele Alessandra Da Reactions da-reactions allows Store… |
CVE-2024-49248 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Reflected XSS.Th… |
CVE-2024-7755 | High | 8.2 | 2024-10-17 | The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the cr… |
CVE-2024-49319 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in B.M. Rafiul Alam Awesome Contact Form7 for Elementor awes… |
CVE-2024-49316 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zodiac Akismet htaccess writer akismet-htaccess-writer al… |
CVE-2024-49311 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Stored XSS… |
CVE-2024-49310 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-add… |
CVE-2024-49309 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omarfolghe Digitally digitally allows Reflected XSS.This… |
CVE-2024-49308 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Animator scroll-triggered-animations allows… |
CVE-2024-49307 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpseek Admin Management Xtended admin-management-xtended… |
CVE-2024-49302 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in portfoliohub WordPress Portfolio Builder – Portfolio Gall… |
CVE-2024-49301 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sinan Yorulmaz G Meta Keywords g-meta-keywords allows Sto… |
CVE-2024-49298 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice pepro-ultimate… |
CVE-2024-49296 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JC Custom Add to Cart Button Label and Link woo-custom-ca… |
CVE-2024-49295 | Medium | 5.9 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase simple-testimoni… |
CVE-2024-49292 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor exclusive-addons-… |
CVE-2024-49289 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gora Tech LLC Cooked Pro allows Stored XSS.This is… |
CVE-2024-10101 | Medium | 5.4 | 2024-10-17 | A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which rende… |
CVE-2024-10100 | High | 7.5 | 2024-10-17 | A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file parameter, which is… |
CVE-2024-10099 | Medium | 6.1 | 2024-10-17 | A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacke… |
CVE-2024-49400 | Critical | 9.8 | 2024-10-17 | Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured al… |
CVE-2024-49322 | Critical | 9.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress jemployee allows Privilege Escalation.This issue affects Job Boar… |
CVE-2024-49318 | Critical | 9.8 | 2024-10-17 | Deserialization of Untrusted Data vulnerability in Scott My Reading Library my-reading-library allows Object Injection.This issue affects My Reading Library: f… |
CVE-2024-49317 | High | 7.5 | 2024-10-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ZIPANG Point Maker point-maker allows… |
CVE-2024-49314 | Critical | 10.0 | 2024-10-17 | Unrestricted Upload of File with Dangerous Type vulnerability in jiangqie JiangQie Free Mini Program jiangqie-free-mini-program allows Upload a Web Shell to a… |
CVE-2024-49313 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in rudestan VKontakte Wall Post vkontakte-wall-post allows Stored XSS.This issue affects VKontakte Wall Post: f… |
CVE-2024-49312 | Medium | 4.9 | 2024-10-17 | Server-Side Request Forgery (SSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge.This issue affects Edwiser Bridge: from n/a through <= 3.0.7. |
CVE-2024-49305 | Critical | 9.3 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Email Verification for WooCommerce emails-verif… |
CVE-2024-49304 | Medium | 5.4 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Stored XSS.This issue affects Pinpoint Booking Syst… |
CVE-2024-49299 | High | 7.6 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Surfer Surfer surferseo allows SQL Injection.This issue a… |
CVE-2024-49297 | High | 8.5 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows SQL In… |
CVE-2024-49291 | Critical | 10.0 | 2024-10-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Gora Tech LLC Cooked Pro.This issue affects Cooked Pro: from n/a before 1.8.0. |
CVE-2024-49287 | High | 7.5 | 2024-10-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in mh6webentwicklung PDF-Rechnungsverwaltung pdf-rechnungsverwaltu… |
CVE-2024-49285 | High | 7.5 | 2024-10-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV MailChimp ssv-mailchimp allows PHP Local Fi… |
CVE-2024-49284 | Medium | 5.3 | 2024-10-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BogdanFix WP SendFox wp-sendfox allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2024-49246 | Critical | 9.3 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anand23 Ajax Rating with Custom Login ajax-rating-with-cu… |
CVE-2024-49244 | High | 8.5 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vrinsoft CSV Product Import Export for WooCommerce csv-wc… |
CVE-2024-49237 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in ahmeti Ahmeti Wp Timeline ahmeti-wp-timeline allows Stored XSS.This issue affects Ahmeti Wp Timeline: from n… |
CVE-2024-49235 | High | 7.5 | 2024-10-17 | Insertion of Sensitive Information Into Sent Data vulnerability in videowhisper Contact Forms, Live Support, CRM, Video Messages live-support-tickets allows Re… |
CVE-2024-49229 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arifnezami Better Author Bio better-author-bio allows Ref… |
CVE-2024-49223 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Change Howdy cj-change-howdy allows Cross Site Request Forgery.This issue affects CJ Change H… |
CVE-2024-49221 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in julian.weinert cSlider cslider allows Cross Site Request Forgery.This issue affects cSlider: from n/a throug… |
CVE-2024-49220 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in Nikel Cookie Scanner cookie-scanner allows Cross Site Request Forgery.This issue affects Cookie Scanner: fro… |
CVE-2024-49219 | High | 8.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in themexpo RS-Members rs-members allows Privilege Escalation.This issue affects RS-Members: from n/a through <= 1… |
CVE-2024-49217 | Critical | 9.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in madiriaashish Adding drop down roles in registration user-drop-down-roles-in-registration allows Privilege Esca… |
CVE-2024-48638 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask parameter in the SetGuestZ… |
CVE-2024-48637 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID parameter in the SetVLAN… |
CVE-2024-48636 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in the SetVLAN… |
CVE-2024-48635 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:2/VID parameter in the SetVLAN… |
CVE-2024-48634 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecu… |
CVE-2024-48633 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort… |
CVE-2024-48632 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAddress, TCPPorts, an… |
CVE-2024-48631 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSet… |
CVE-2024-48630 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFil… |
CVE-2024-48629 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameter in the SetGuestZo… |
CVE-2024-47312 | High | 8.5 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Grim Classic Editor and Classic Widgets classic-editor… |
CVE-2024-47304 | High | 8.5 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Fluent Support fluent-support allows SQL… |
CVE-2024-43997 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in easy.Jobs EasyJobs allows Reflected XSS.This issue… |
CVE-2024-49399 | | 2024-10-17 | The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak information. | |
CVE-2024-49398 | | 2024-10-17 | The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code. | |
CVE-2024-49397 | | 2024-10-17 | The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin accounts. | |
CVE-2024-49396 | | 2024-10-17 | The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information. | |
CVE-2024-48192 | High | 8.0 | 2024-10-17 | Tenda G3 v15.01.0.5(2848_755)_EN was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root |
CVE-2024-10073 | Medium | 5.0 | 2024-10-17 | A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\cluste… |
CVE-2024-10072 | Medium | 6.3 | 2024-10-17 | A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. This issue affects the function actionAddEncryptPolicyGroup of the file /c… |
CVE-2024-9414 | | 2024-10-17 | In LAquis SCADA version 4.7.1.511, a cross-site scripting vulnerability could allow an attacker to inject arbitrary code into a web page. This could allow an a… | |
CVE-2024-10071 | Medium | 6.3 | 2024-10-17 | A vulnerability classified as critical was found in ESAFENET CDG 5. This vulnerability affects the function actionUpdateEncryptPolicyEdit of the file /com/esaf… |
CVE-2024-9683 | Medium | 4.8 | 2024-10-17 | A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authenticat… |
CVE-2024-48920 | Critical | 9.1 | 2024-10-17 | PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unaut… |
CVE-2024-47459 | Medium | 5.5 | 2024-10-17 | Substance3D - Sampler versions 4.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (Do… |
CVE-2024-10070 | Medium | 6.3 | 2024-10-17 | A vulnerability classified as critical has been found in ESAFENET CDG 5. This affects the function actionPolicyPush of the file /com/esafenet/policy/action/Pol… |
CVE-2024-10069 | Medium | 6.3 | 2024-10-17 | A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. Affected by this issue is the function actionPassMainApplication of the file /com/e… |