2024 CVEs (page 143)
Page 143 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6333 | High | 7.2 | 2024-10-17 | Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products. |
CVE-2024-49315 | High | 8.6 | 2024-10-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Pa… |
CVE-2024-49580 | Medium | 5.3 | 2024-10-17 | In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure |
CVE-2024-49579 | High | 8.1 | 2024-10-17 | In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests |
CVE-2024-48048 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through <=… |
CVE-2024-48046 | Medium | 5.9 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsy… |
CVE-2024-48037 | Medium | 5.4 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects C… |
CVE-2024-48036 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks.This issue affects SKT… |
CVE-2024-48032 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sumitsurai Featured Posts with Multiple Custom Groups (FP… |
CVE-2024-48031 | Medium | 6.5 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in sumitsurai Featured Posts with Multiple Custom Groups (FPMCG) featured-posts-with-multiple-custom-groups-fpm… |
CVE-2024-48025 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dogrow Simple Baseball Scoreboard simple-baseball-scorebo… |
CVE-2024-48023 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rconnect305 Restaurant Reservations Widget restaurantconn… |
CVE-2024-48022 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SysBasics Shortcode For Elementor Templates allows… |
CVE-2024-48021 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on co… |
CVE-2024-49320 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dennis Encyclopedia / Glossary / Wiki encyclopedia-lexico… |
CVE-2024-48047 | Medium | 4.3 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in Razon Komar Pal Linked Variation for WooCommerce linked-variation-for-woocommerce allows Cross Site Request… |
CVE-2024-48043 | High | 7.6 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-op… |
CVE-2024-48038 | Medium | 4.3 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in tuxlog wp-Monalisa wp-monalisa.This issue affects wp-Monalisa: from n/a through <= 6.4. |
CVE-2024-48024 | High | 7.5 | 2024-10-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Retrieve E… |
CVE-2024-9898 | Medium | 6.4 | 2024-10-17 | The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions up to, and includin… |
CVE-2024-45713 | Medium | 5.1 | 2024-10-17 | SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes. |
CVE-2024-10068 | High | 7.8 | 2024-10-17 | A vulnerability was found in OpenSight Software FlashFXP 5.4.0.3970. It has been classified as critical. Affected is an unknown function in the library libcryp… |
CVE-2024-9184 | High | 7.2 | 2024-10-17 | The SendPulse Free Web Push plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.6 due to incorrect use… |
CVE-2024-8920 | Medium | 6.4 | 2024-10-17 | The Fonto – Custom Web Fonts Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includin… |
CVE-2024-49392 | Medium | 4.8 | 2024-10-17 | Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Windows) before build… |
CVE-2024-49391 | High | 7.3 | 2024-10-17 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. |
CVE-2024-49390 | High | 7.3 | 2024-10-17 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. |
CVE-2024-49389 | High | 7.8 | 2024-10-17 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. |
CVE-2024-49386 | Medium | 5.7 | 2024-10-17 | Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. |
CVE-2024-10025 | Critical | 9.1 | 2024-10-17 | A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials… |
CVE-2024-9951 | Medium | 6.1 | 2024-10-17 | The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wppa-tab' parameter in all versions up to, and including… |
CVE-2024-3187 | Medium | 5.9 | 2024-10-17 | This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are caused by JST values not… |
CVE-2024-3186 | Medium | 5.3 | 2024-10-17 | CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with the ME_GOAHEAD_JAVASCRIPT… |
CVE-2024-3184 | Medium | 5.9 | 2024-10-17 | Multiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAHEAD_REPLACE_MALLOC… |
CVE-2024-9213 | Medium | 6.1 | 2024-10-17 | The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg withou… |
CVE-2024-9352 | Medium | 4.3 | 2024-10-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… |
CVE-2024-9351 | Medium | 4.3 | 2024-10-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… |
CVE-2024-5429 | High | 7.6 | 2024-10-17 | The Logo Slider WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could… |
CVE-2024-9347 | Medium | 6.1 | 2024-10-17 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all v… |
CVE-2024-9263 | Critical | 9.8 | 2024-10-17 | The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalati… |
CVE-2024-8719 | Medium | 6.1 | 2024-10-17 | The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters like 'MaxBeds' and 'MinBeds' in all version… |
CVE-2024-7417 | Medium | 4.3 | 2024-10-17 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_… |
CVE-2024-49593 | Medium | 5.3 | 2024-10-17 | In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the p… |
CVE-2024-9940 | Medium | 5.3 | 2024-10-17 | The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not pro… |
CVE-2024-9863 | Critical | 9.8 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the ins… |
CVE-2024-9862 | Critical | 9.8 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. Thi… |
CVE-2024-9861 | High | 8.1 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due… |
CVE-2024-9240 | Medium | 6.1 | 2024-10-17 | The ReDi Restaurant Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapi… |
CVE-2024-9215 | High | 8.8 | 2024-10-17 | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Insecure Direct Object Refe… |
CVE-2024-45767 | Medium | 4.3 | 2024-10-17 | Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vu… |
CVE-2024-45766 | High | 8.0 | 2024-10-17 | Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerability. A low privileg… |
CVE-2024-7994 | High | 7.8 | 2024-10-16 | A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Stack-Based Buffer Overflow. A malicious actor can leverage this vulnerability… |
CVE-2024-7993 | High | 7.8 | 2024-10-16 | A maliciously crafted PDF file, when parsed through Autodesk Revit, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnera… |
CVE-2024-48918 | | 2024-10-16 | RDS Light is a simplified version of the Reflective Dialogue System (RDS), a self-reflecting AI framework. Versions prior to 1.1.0 contain a vulnerability that… | |
CVE-2024-48758 | Medium | 6.1 | 2024-10-16 | dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the addPro parameter of the component doAdminAction.php which allows a rem… |
CVE-2024-48180 | Critical | 9.8 | 2024-10-16 | ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to… |
CVE-2024-47889 | | 2024-10-16 | Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there… | |
CVE-2024-47888 | | 2024-10-16 | Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a p… | |
CVE-2024-46213 | High | 7.2 | 2024-10-16 | REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability. |
CVE-2024-46212 | Medium | 4.9 | 2024-10-16 | An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal. |
CVE-2024-44762 | Medium | 5.3 | 2024-10-16 | A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts. |
CVE-2024-47887 | | 2024-10-16 | Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1… | |
CVE-2024-47836 | Low | 3.5 | 2024-10-16 | Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute… |
CVE-2024-47522 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, invalid ALPN in T… |
CVE-2024-47188 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-47187 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-45797 | High | 7.5 | 2024-10-16 | LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version 0.5.49, unbounded processing of HTTP request and resp… |
CVE-2024-45796 | Medium | 5.3 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error dur… |
CVE-2024-45795 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, rules using datas… |
CVE-2024-41128 | | 2024-10-16 | Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1… | |
CVE-2024-9143 | Medium | 4.3 | 2024-10-16 | Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads … |
CVE-2024-4692 | Low | 2.4 | 2024-10-16 | Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Acc… |
CVE-2024-4690 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4211 | Low | 2.4 | 2024-10-16 | Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Acc… |
CVE-2024-4189 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4184 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-46606 | Medium | 5.4 | 2024-10-16 | A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2024-46605 | Medium | 6.1 | 2024-10-16 | A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2024-45072 | Medium | 5.5 | 2024-10-16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could e… |
CVE-2024-45071 | Medium | 5.5 | 2024-10-16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaS… |
CVE-2024-38814 | High | 8.8 | 2024-10-16 | An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-administrator privileges… |
CVE-2024-20512 | Medium | 6.1 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an unauthenticated, remote a… |
CVE-2024-20463 | Medium | 5.4 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-20462 | Medium | 5.5 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, loc… |
CVE-2024-20461 | Medium | 6.0 | 2024-10-16 | A vulnerability in the CLI of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, local attacker with high privileges to… |
CVE-2024-20460 | Medium | 6.1 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-20459 | Medium | 6.5 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Multiplatform Series Analog Telephone Adapter firmware could allow an authenticated, rem… |
CVE-2024-20458 | High | 8.2 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-20421 | High | 7.1 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-20420 | Medium | 5.4 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker w… |
CVE-2024-20280 | Medium | 6.3 | 2024-10-16 | A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is… |
CVE-2024-10033 | Medium | 6.1 | 2024-10-16 | A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perf… |
CVE-2024-49265 | Medium | 6.5 | 2024-10-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SPBooking.com Booking.com Banner Creator bookingcom-banne… |
CVE-2024-29155 | Medium | 4.3 | 2024-10-16 | On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of completing the pairing… |
CVE-2024-9348 | | 2024-10-16 | Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view. | |
CVE-2024-49268 | High | 7.1 | 2024-10-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sunburntkamel disconnected allows Reflected XSS.Th… |
CVE-2024-49267 | Medium | 6.5 | 2024-10-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Unlimited Addon For Elementor unlimited-addon-for… |
CVE-2024-49266 | Medium | 5.9 | 2024-10-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thimo Grauerholz WP-Spreadplugin wp-spreadplugin allows C… |
CVE-2024-48744 | Medium | 6.1 | 2024-10-16 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows… |
CVE-2024-47139 | Medium | 6.8 | 2024-10-16 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the Administra… |