2024 CVEs (page 144)
Page 144 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4690 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4211 | Low | 2.4 | 2024-10-16 | Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Acc… |
CVE-2024-4189 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4184 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-46606 | Medium | 5.4 | 2024-10-16 | A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2024-46605 | Medium | 6.1 | 2024-10-16 | A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2024-45072 | Medium | 5.5 | 2024-10-16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could e… |
CVE-2024-45071 | Medium | 5.5 | 2024-10-16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaS… |
CVE-2024-38814 | High | 8.8 | 2024-10-16 | An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-administrator privileges… |
CVE-2024-20512 | Medium | 6.1 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an unauthenticated, remote a… |
CVE-2024-20463 | Medium | 5.4 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-20462 | Medium | 5.5 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, loc… |
CVE-2024-20461 | Medium | 6.0 | 2024-10-16 | A vulnerability in the CLI of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, local attacker with high privileges to… |
CVE-2024-20460 | Medium | 6.1 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-20459 | Medium | 6.5 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Multiplatform Series Analog Telephone Adapter firmware could allow an authenticated, rem… |
CVE-2024-20458 | High | 8.2 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-20421 | High | 7.1 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-20420 | Medium | 5.4 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker w… |
CVE-2024-20280 | Medium | 6.3 | 2024-10-16 | A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is… |
CVE-2024-10033 | Medium | 6.1 | 2024-10-16 | A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perf… |
CVE-2024-49265 | Medium | 6.5 | 2024-10-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SPBooking.com Booking.com Banner Creator bookingcom-banne… |
CVE-2024-29155 | Medium | 4.3 | 2024-10-16 | On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of completing the pairing… |
CVE-2024-9348 | | 2024-10-16 | Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view. | |
CVE-2024-49268 | High | 7.1 | 2024-10-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sunburntkamel disconnected allows Reflected XSS.Th… |
CVE-2024-49267 | Medium | 6.5 | 2024-10-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Unlimited Addon For Elementor unlimited-addon-for… |
CVE-2024-49266 | Medium | 5.9 | 2024-10-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thimo Grauerholz WP-Spreadplugin wp-spreadplugin allows C… |
CVE-2024-48744 | Medium | 6.1 | 2024-10-16 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows… |
CVE-2024-47139 | Medium | 6.8 | 2024-10-16 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the Administra… |
CVE-2024-45844 | High | 7.2 | 2024-10-16 | BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Note: Software versions wh… |
CVE-2024-9893 | Critical | 9.8 | 2024-10-16 | The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.1.14. This is due to insuffici… |
CVE-2024-49270 | Medium | 6.5 | 2024-10-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Smart Blocks smart-blocks allows Stored XSS.Th… |
CVE-2024-49260 | Critical | 9.9 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery allows Code Injection.This… |
CVE-2024-49258 | Medium | 6.5 | 2024-10-16 | Path Traversal: '.../...//' vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery.This issue affects WordPress Gallery Plugin –… |
CVE-2024-49254 | Critical | 10.0 | 2024-10-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in sunjianle ajax-extend ajax-extend allows Code Injection.This issue affects ajax-exte… |
CVE-2024-49253 | High | 8.6 | 2024-10-16 | Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: fro… |
CVE-2024-49252 | Medium | 5.3 | 2024-10-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in VaultDweller Leyka leyka.This issue affects Leyka: from n/a through… |
CVE-2024-49251 | High | 7.5 | 2024-10-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acnoo Maan Addons For Elementor maan-e… |
CVE-2024-49245 | High | 7.5 | 2024-10-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue… |
CVE-2024-49242 | Critical | 10.0 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Shafiq Digital Lottery digital-lottery allows Upload a Web Shell to a Web Server.This issue af… |
CVE-2024-49227 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock… |
CVE-2024-49226 | High | 8.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in taketin TAKETIN To WP Membership taketin-to-wp-membership allows Object Injection.This issue affects TAKETIN… |
CVE-2024-49218 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injectio… |
CVE-2024-49216 | Critical | 10.0 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in jclay06 Feed Comments Number feed-comments-number allows Upload a Web Shell to a Web Server.Th… |
CVE-2024-48035 | Critical | 9.9 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in takayukii ACF Images Search And Insert acf-images-search-and-insert allows Upload a Web Shell… |
CVE-2024-48034 | Critical | 9.9 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in fliperrr Creates 3D Flipbook, PDF Flipbook create-flipbook-from-pdf allows Upload a Web Shell… |
CVE-2024-48030 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Webextends Telecash Ricaricaweb telecash-ricaricaweb allows Object Injection.This issue affects Telecash Ric… |
CVE-2024-48029 | High | 7.5 | 2024-10-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hung Trang Si SB Random Posts Widget s… |
CVE-2024-48028 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 ip-loc8 allows Object Injection.This issue affects IP Loc8: from n/a through <= 1.1. |
CVE-2024-48027 | Critical | 9.9 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in xaraartech External featured image from bing external-featured-image-from-bing allows Upload a… |
CVE-2024-48026 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager… |
CVE-2024-47649 | Critical | 9.1 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in THATplugin Iconize iconize.This issue affects Iconize: from n/a through <= 1.2.4. |
CVE-2024-47645 | High | 7.5 | 2024-10-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows P… |
CVE-2024-47637 | High | 8.8 | 2024-10-16 | Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from… |
CVE-2024-47351 | High | 7.5 | 2024-10-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider maxslider allows Path Traversal.T… |
CVE-2024-22034 | Medium | 5.5 | 2024-10-16 | Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for t… |
CVE-2024-22033 | Medium | 6.3 | 2024-10-16 | The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that al… |
CVE-2024-22032 | Medium | 6.5 | 2024-10-16 | A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling… |
CVE-2024-22030 | High | 8.0 | 2024-10-16 | A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would… |
CVE-2024-22029 | High | 7.8 | 2024-10-16 | Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root |
CVE-2024-49271 | Critical | 9.1 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for… |
CVE-2024-49257 | Critical | 10.0 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Denis Azz Anonim Posting azz-anonim-posting allows Upload a Web Shell to a Web Server.This iss… |
CVE-2024-49247 | Critical | 9.8 | 2024-10-16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in SK BuddyPress Better Registration better-bp-registration allows Authentication Bypass… |
CVE-2024-48042 | Critical | 9.1 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Co… |
CVE-2024-10024 | Medium | 6.3 | 2024-10-16 | A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. This issue affects some unknown processing o… |
CVE-2024-10023 | Medium | 6.3 | 2024-10-16 | A vulnerability classified as critical was found in code-projects Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /php/add_… |
CVE-2024-8040 | High | 7.7 | 2024-10-16 | An authorization bypass through user-controlled key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an authenticated attacker… |
CVE-2024-6380 | High | 8.7 | 2024-10-16 | A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPER… |
CVE-2024-10022 | Medium | 6.3 | 2024-10-16 | A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the file /php/manage_sup… |
CVE-2024-10021 | Medium | 6.3 | 2024-10-16 | A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-8921 | Medium | 6.4 | 2024-10-16 | The Zita Elementor Site Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1… |
CVE-2024-9444 | Medium | 6.4 | 2024-10-16 | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ… |
CVE-2024-9858 | High | 7.8 | 2024-10-16 | There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was grea… |
CVE-2024-9540 | Medium | 4.3 | 2024-10-16 | The Sina Extension for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.7 via the rende… |
CVE-2024-9061 | High | 7.3 | 2024-10-16 | The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv… |
CVE-2024-45715 | High | 7.1 | 2024-10-16 | The SolarWinds Platform was susceptible to a Cross-Site Scripting vulnerability when performing an edit function to existing elements. |
CVE-2024-45714 | Medium | 4.8 | 2024-10-16 | Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payload. |
CVE-2024-45711 | High | 7.5 | 2024-10-16 | SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authentic… |
CVE-2024-45710 | High | 7.8 | 2024-10-16 | SolarWinds Platform is susceptible to an Uncontrolled Search Path Element Local Privilege Escalation vulnerability. This requires a low privilege account and l… |
CVE-2024-45693 | High | 8.0 | 2024-10-16 | Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the request… |
CVE-2024-45462 | Medium | 6.3 | 2024-10-16 | The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend… |
CVE-2024-45461 | Medium | 5.7 | 2024-10-16 | The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environ… |
CVE-2024-45219 | High | 8.5 | 2024-10-16 | Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and volumes for attaching them as data disks… |
CVE-2024-45217 | High | 8.1 | 2024-10-16 | Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from t… |
CVE-2024-45216 | Critical | 9.8 | 2024-10-16 | Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication i… |
CVE-2024-9582 | Medium | 6.4 | 2024-10-16 | The Accordion Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ attribute of an accordion slider in all versions up to, a… |
CVE-2024-8918 | High | 7.4 | 2024-10-16 | The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of… |
CVE-2024-8746 | High | 7.5 | 2024-10-16 | The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_fol… |
CVE-2024-8507 | High | 8.8 | 2024-10-16 | The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or in… |
CVE-2024-9937 | Medium | 6.1 | 2024-10-16 | The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including… |
CVE-2024-9888 | Medium | 5.4 | 2024-10-16 | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget redirect URL in… |
CVE-2024-9873 | Medium | 5.4 | 2024-10-16 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-10018 | Critical | 9.8 | 2024-10-16 | Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component. |
CVE-2024-9891 | Medium | 4.3 | 2024-10-16 | The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the m… |
CVE-2024-9652 | Medium | 6.1 | 2024-10-16 | The Locatoraid Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST keys in all versions up to, and including, 3.9.47… |
CVE-2024-9649 | Medium | 4.3 | 2024-10-16 | The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-9647 | Medium | 6.1 | 2024-10-16 | The Kama SpamBlock plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST values in all versions up to, and including, 1.8.2 due to in… |
CVE-2024-9634 | Critical | 9.8 | 2024-10-16 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 v… |
CVE-2024-9521 | Medium | 6.4 | 2024-10-16 | The SEO Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.9 due to insufficient input… |
CVE-2024-9305 | High | 8.1 | 2024-10-16 | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4… |
CVE-2024-9105 | Critical | 9.8 | 2024-10-16 | The UltimateAI plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.8.3. This is due to insufficient verification on… |