2024 CVEs (page 143)
Page 143 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-49217 | Critical | 9.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in madiriaashish Adding drop down roles in registration user-drop-down-roles-in-registration allows Privilege Esca… |
CVE-2024-48638 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask parameter in the SetGuestZ… |
CVE-2024-48637 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID parameter in the SetVLAN… |
CVE-2024-48636 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in the SetVLAN… |
CVE-2024-48635 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:2/VID parameter in the SetVLAN… |
CVE-2024-48634 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecu… |
CVE-2024-48633 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort… |
CVE-2024-48632 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAddress, TCPPorts, an… |
CVE-2024-48631 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSet… |
CVE-2024-48630 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFil… |
CVE-2024-48629 | High | 8.0 | 2024-10-17 | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameter in the SetGuestZo… |
CVE-2024-47312 | High | 8.5 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Grim Classic Editor and Classic Widgets classic-editor… |
CVE-2024-47304 | High | 8.5 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Fluent Support fluent-support allows SQL… |
CVE-2024-43997 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in easy.Jobs EasyJobs allows Reflected XSS.This issue… |
CVE-2024-49399 | | 2024-10-17 | The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak information. | |
CVE-2024-49398 | | 2024-10-17 | The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code. | |
CVE-2024-49397 | | 2024-10-17 | The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin accounts. | |
CVE-2024-49396 | | 2024-10-17 | The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information. | |
CVE-2024-48192 | High | 8.0 | 2024-10-17 | Tenda G3 v15.01.0.5(2848_755)_EN was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root |
CVE-2024-10073 | Medium | 5.0 | 2024-10-17 | A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\cluste… |
CVE-2024-10072 | Medium | 6.3 | 2024-10-17 | A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. This issue affects the function actionAddEncryptPolicyGroup of the file /c… |
CVE-2024-9414 | | 2024-10-17 | In LAquis SCADA version 4.7.1.511, a cross-site scripting vulnerability could allow an attacker to inject arbitrary code into a web page. This could allow an a… | |
CVE-2024-10071 | Medium | 6.3 | 2024-10-17 | A vulnerability classified as critical was found in ESAFENET CDG 5. This vulnerability affects the function actionUpdateEncryptPolicyEdit of the file /com/esaf… |
CVE-2024-9683 | Medium | 4.8 | 2024-10-17 | A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authenticat… |
CVE-2024-48920 | Critical | 9.1 | 2024-10-17 | PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unaut… |
CVE-2024-47459 | Medium | 5.5 | 2024-10-17 | Substance3D - Sampler versions 4.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (Do… |
CVE-2024-10070 | Medium | 6.3 | 2024-10-17 | A vulnerability classified as critical has been found in ESAFENET CDG 5. This affects the function actionPolicyPush of the file /com/esafenet/policy/action/Pol… |
CVE-2024-10069 | Medium | 6.3 | 2024-10-17 | A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. Affected by this issue is the function actionPassMainApplication of the file /com/e… |
CVE-2024-6333 | High | 7.2 | 2024-10-17 | Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products. |
CVE-2024-49315 | High | 8.6 | 2024-10-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Pa… |
CVE-2024-49580 | Medium | 5.3 | 2024-10-17 | In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure |
CVE-2024-49579 | High | 8.1 | 2024-10-17 | In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests |
CVE-2024-48048 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through <=… |
CVE-2024-48046 | Medium | 5.9 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsy… |
CVE-2024-48037 | Medium | 5.4 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects C… |
CVE-2024-48036 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks.This issue affects SKT… |
CVE-2024-48032 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sumitsurai Featured Posts with Multiple Custom Groups (FP… |
CVE-2024-48031 | Medium | 6.5 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in sumitsurai Featured Posts with Multiple Custom Groups (FPMCG) featured-posts-with-multiple-custom-groups-fpm… |
CVE-2024-48025 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dogrow Simple Baseball Scoreboard simple-baseball-scorebo… |
CVE-2024-48023 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rconnect305 Restaurant Reservations Widget restaurantconn… |
CVE-2024-48022 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SysBasics Shortcode For Elementor Templates allows… |
CVE-2024-48021 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on co… |
CVE-2024-49320 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dennis Encyclopedia / Glossary / Wiki encyclopedia-lexico… |
CVE-2024-48047 | Medium | 4.3 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in Razon Komar Pal Linked Variation for WooCommerce linked-variation-for-woocommerce allows Cross Site Request… |
CVE-2024-48043 | High | 7.6 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-op… |
CVE-2024-48038 | Medium | 4.3 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in tuxlog wp-Monalisa wp-monalisa.This issue affects wp-Monalisa: from n/a through <= 6.4. |
CVE-2024-48024 | High | 7.5 | 2024-10-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Retrieve E… |
CVE-2024-9898 | Medium | 6.4 | 2024-10-17 | The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions up to, and includin… |
CVE-2024-45713 | Medium | 5.1 | 2024-10-17 | SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes. |
CVE-2024-10068 | High | 7.8 | 2024-10-17 | A vulnerability was found in OpenSight Software FlashFXP 5.4.0.3970. It has been classified as critical. Affected is an unknown function in the library libcryp… |
CVE-2024-9184 | High | 7.2 | 2024-10-17 | The SendPulse Free Web Push plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.6 due to incorrect use… |
CVE-2024-8920 | Medium | 6.4 | 2024-10-17 | The Fonto – Custom Web Fonts Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includin… |
CVE-2024-49392 | Medium | 4.8 | 2024-10-17 | Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Windows) before build… |
CVE-2024-49391 | High | 7.3 | 2024-10-17 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. |
CVE-2024-49390 | High | 7.3 | 2024-10-17 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. |
CVE-2024-49389 | High | 7.8 | 2024-10-17 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. |
CVE-2024-49386 | Medium | 5.7 | 2024-10-17 | Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. |
CVE-2024-10025 | Critical | 9.1 | 2024-10-17 | A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials… |
CVE-2024-9951 | Medium | 6.1 | 2024-10-17 | The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wppa-tab' parameter in all versions up to, and including… |
CVE-2024-3187 | Medium | 5.9 | 2024-10-17 | This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are caused by JST values not… |
CVE-2024-3186 | Medium | 5.3 | 2024-10-17 | CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with the ME_GOAHEAD_JAVASCRIPT… |
CVE-2024-3184 | Medium | 5.9 | 2024-10-17 | Multiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAHEAD_REPLACE_MALLOC… |
CVE-2024-9213 | Medium | 6.1 | 2024-10-17 | The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg withou… |
CVE-2024-9352 | Medium | 4.3 | 2024-10-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… |
CVE-2024-9351 | Medium | 4.3 | 2024-10-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… |
CVE-2024-5429 | High | 7.6 | 2024-10-17 | The Logo Slider WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could… |
CVE-2024-9347 | Medium | 6.1 | 2024-10-17 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all v… |
CVE-2024-9263 | Critical | 9.8 | 2024-10-17 | The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalati… |
CVE-2024-8719 | Medium | 6.1 | 2024-10-17 | The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters like 'MaxBeds' and 'MinBeds' in all version… |
CVE-2024-7417 | Medium | 4.3 | 2024-10-17 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_… |
CVE-2024-49593 | Medium | 5.3 | 2024-10-17 | In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the p… |
CVE-2024-9940 | Medium | 5.3 | 2024-10-17 | The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not pro… |
CVE-2024-9863 | Critical | 9.8 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the ins… |
CVE-2024-9862 | Critical | 9.8 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. Thi… |
CVE-2024-9861 | High | 8.1 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due… |
CVE-2024-9240 | Medium | 6.1 | 2024-10-17 | The ReDi Restaurant Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapi… |
CVE-2024-9215 | High | 8.8 | 2024-10-17 | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Insecure Direct Object Refe… |
CVE-2024-45767 | Medium | 4.3 | 2024-10-17 | Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vu… |
CVE-2024-45766 | High | 8.0 | 2024-10-17 | Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerability. A low privileg… |
CVE-2024-7994 | High | 7.8 | 2024-10-16 | A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Stack-Based Buffer Overflow. A malicious actor can leverage this vulnerability… |
CVE-2024-7993 | High | 7.8 | 2024-10-16 | A maliciously crafted PDF file, when parsed through Autodesk Revit, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnera… |
CVE-2024-48918 | | 2024-10-16 | RDS Light is a simplified version of the Reflective Dialogue System (RDS), a self-reflecting AI framework. Versions prior to 1.1.0 contain a vulnerability that… | |
CVE-2024-48758 | Medium | 6.1 | 2024-10-16 | dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the addPro parameter of the component doAdminAction.php which allows a rem… |
CVE-2024-48180 | Critical | 9.8 | 2024-10-16 | ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to… |
CVE-2024-47889 | | 2024-10-16 | Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there… | |
CVE-2024-47888 | | 2024-10-16 | Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a p… | |
CVE-2024-46213 | High | 7.2 | 2024-10-16 | REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability. |
CVE-2024-46212 | Medium | 4.9 | 2024-10-16 | An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal. |
CVE-2024-44762 | Medium | 5.3 | 2024-10-16 | A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts. |
CVE-2024-47887 | | 2024-10-16 | Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1… | |
CVE-2024-47836 | Low | 3.5 | 2024-10-16 | Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute… |
CVE-2024-47522 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, invalid ALPN in T… |
CVE-2024-47188 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-47187 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initializ… |
CVE-2024-45797 | High | 7.5 | 2024-10-16 | LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version 0.5.49, unbounded processing of HTTP request and resp… |
CVE-2024-45796 | Medium | 5.3 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, a logic error dur… |
CVE-2024-45795 | High | 7.5 | 2024-10-16 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, rules using datas… |
CVE-2024-41128 | | 2024-10-16 | Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1… | |
CVE-2024-9143 | Medium | 4.3 | 2024-10-16 | Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads … |
CVE-2024-4692 | Low | 2.4 | 2024-10-16 | Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Acc… |