2024 CVEs (page 144)
Page 144 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45844 | High | 7.2 | 2024-10-16 | BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Note: Software versions wh… |
CVE-2024-9893 | Critical | 9.8 | 2024-10-16 | The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.1.14. This is due to insuffici… |
CVE-2024-49270 | Medium | 6.5 | 2024-10-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Smart Blocks smart-blocks allows Stored XSS.Th… |
CVE-2024-49260 | Critical | 9.9 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery allows Code Injection.This… |
CVE-2024-49258 | Medium | 6.5 | 2024-10-16 | Path Traversal: '.../...//' vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery.This issue affects WordPress Gallery Plugin –… |
CVE-2024-49254 | Critical | 10.0 | 2024-10-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in sunjianle ajax-extend ajax-extend allows Code Injection.This issue affects ajax-exte… |
CVE-2024-49253 | High | 8.6 | 2024-10-16 | Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: fro… |
CVE-2024-49252 | Medium | 5.3 | 2024-10-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in VaultDweller Leyka leyka.This issue affects Leyka: from n/a through… |
CVE-2024-49251 | High | 7.5 | 2024-10-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acnoo Maan Addons For Elementor maan-e… |
CVE-2024-49245 | High | 7.5 | 2024-10-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue… |
CVE-2024-49242 | Critical | 10.0 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Shafiq Digital Lottery digital-lottery allows Upload a Web Shell to a Web Server.This issue af… |
CVE-2024-49227 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock… |
CVE-2024-49226 | High | 8.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in taketin TAKETIN To WP Membership taketin-to-wp-membership allows Object Injection.This issue affects TAKETIN… |
CVE-2024-49218 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injectio… |
CVE-2024-49216 | Critical | 10.0 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in jclay06 Feed Comments Number feed-comments-number allows Upload a Web Shell to a Web Server.Th… |
CVE-2024-48035 | Critical | 9.9 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in takayukii ACF Images Search And Insert acf-images-search-and-insert allows Upload a Web Shell… |
CVE-2024-48034 | Critical | 9.9 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in fliperrr Creates 3D Flipbook, PDF Flipbook create-flipbook-from-pdf allows Upload a Web Shell… |
CVE-2024-48030 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Webextends Telecash Ricaricaweb telecash-ricaricaweb allows Object Injection.This issue affects Telecash Ric… |
CVE-2024-48029 | High | 7.5 | 2024-10-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hung Trang Si SB Random Posts Widget s… |
CVE-2024-48028 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 ip-loc8 allows Object Injection.This issue affects IP Loc8: from n/a through <= 1.1. |
CVE-2024-48027 | Critical | 9.9 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in xaraartech External featured image from bing external-featured-image-from-bing allows Upload a… |
CVE-2024-48026 | Critical | 9.8 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager… |
CVE-2024-47649 | Critical | 9.1 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in THATplugin Iconize iconize.This issue affects Iconize: from n/a through <= 1.2.4. |
CVE-2024-47645 | High | 7.5 | 2024-10-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows P… |
CVE-2024-47637 | High | 8.8 | 2024-10-16 | Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from… |
CVE-2024-47351 | High | 7.5 | 2024-10-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider maxslider allows Path Traversal.T… |
CVE-2024-22034 | Medium | 5.5 | 2024-10-16 | Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for t… |
CVE-2024-22033 | Medium | 6.3 | 2024-10-16 | The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that al… |
CVE-2024-22032 | Medium | 6.5 | 2024-10-16 | A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling… |
CVE-2024-22030 | High | 8.0 | 2024-10-16 | A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would… |
CVE-2024-22029 | High | 7.8 | 2024-10-16 | Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root |
CVE-2024-49271 | Critical | 9.1 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for… |
CVE-2024-49257 | Critical | 10.0 | 2024-10-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Denis Azz Anonim Posting azz-anonim-posting allows Upload a Web Shell to a Web Server.This iss… |
CVE-2024-49247 | Critical | 9.8 | 2024-10-16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in SK BuddyPress Better Registration better-bp-registration allows Authentication Bypass… |
CVE-2024-48042 | Critical | 9.1 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Co… |
CVE-2024-10024 | Medium | 6.3 | 2024-10-16 | A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. This issue affects some unknown processing o… |
CVE-2024-10023 | Medium | 6.3 | 2024-10-16 | A vulnerability classified as critical was found in code-projects Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /php/add_… |
CVE-2024-8040 | High | 7.7 | 2024-10-16 | An authorization bypass through user-controlled key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an authenticated attacker… |
CVE-2024-6380 | High | 8.7 | 2024-10-16 | A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPER… |
CVE-2024-10022 | Medium | 6.3 | 2024-10-16 | A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the file /php/manage_sup… |
CVE-2024-10021 | Medium | 6.3 | 2024-10-16 | A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-8921 | Medium | 6.4 | 2024-10-16 | The Zita Elementor Site Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1… |
CVE-2024-9444 | Medium | 6.4 | 2024-10-16 | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ… |
CVE-2024-9858 | High | 7.8 | 2024-10-16 | There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was grea… |
CVE-2024-9540 | Medium | 4.3 | 2024-10-16 | The Sina Extension for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.7 via the rende… |
CVE-2024-9061 | High | 7.3 | 2024-10-16 | The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv… |
CVE-2024-45715 | High | 7.1 | 2024-10-16 | The SolarWinds Platform was susceptible to a Cross-Site Scripting vulnerability when performing an edit function to existing elements. |
CVE-2024-45714 | Medium | 4.8 | 2024-10-16 | Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payload. |
CVE-2024-45711 | High | 7.5 | 2024-10-16 | SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authentic… |
CVE-2024-45710 | High | 7.8 | 2024-10-16 | SolarWinds Platform is susceptible to an Uncontrolled Search Path Element Local Privilege Escalation vulnerability. This requires a low privilege account and l… |
CVE-2024-45693 | High | 8.0 | 2024-10-16 | Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the request… |
CVE-2024-45462 | Medium | 6.3 | 2024-10-16 | The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend… |
CVE-2024-45461 | Medium | 5.7 | 2024-10-16 | The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environ… |
CVE-2024-45219 | High | 8.5 | 2024-10-16 | Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and volumes for attaching them as data disks… |
CVE-2024-45217 | High | 8.1 | 2024-10-16 | Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from t… |
CVE-2024-45216 | Critical | 9.8 | 2024-10-16 | Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication i… |
CVE-2024-9582 | Medium | 6.4 | 2024-10-16 | The Accordion Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ attribute of an accordion slider in all versions up to, a… |
CVE-2024-8918 | High | 7.4 | 2024-10-16 | The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of… |
CVE-2024-8746 | High | 7.5 | 2024-10-16 | The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_fol… |
CVE-2024-8507 | High | 8.8 | 2024-10-16 | The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or in… |
CVE-2024-9937 | Medium | 6.1 | 2024-10-16 | The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including… |
CVE-2024-9888 | Medium | 5.4 | 2024-10-16 | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget redirect URL in… |
CVE-2024-9873 | Medium | 5.4 | 2024-10-16 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-10018 | Critical | 9.8 | 2024-10-16 | Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component. |
CVE-2024-9891 | Medium | 4.3 | 2024-10-16 | The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the m… |
CVE-2024-9652 | Medium | 6.1 | 2024-10-16 | The Locatoraid Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST keys in all versions up to, and including, 3.9.47… |
CVE-2024-9649 | Medium | 4.3 | 2024-10-16 | The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-9647 | Medium | 6.1 | 2024-10-16 | The Kama SpamBlock plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST values in all versions up to, and including, 1.8.2 due to in… |
CVE-2024-9634 | Critical | 9.8 | 2024-10-16 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 v… |
CVE-2024-9521 | Medium | 6.4 | 2024-10-16 | The SEO Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.9 due to insufficient input… |
CVE-2024-9305 | High | 8.1 | 2024-10-16 | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4… |
CVE-2024-9105 | Critical | 9.8 | 2024-10-16 | The UltimateAI plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.8.3. This is due to insufficient verification on… |
CVE-2024-9104 | Medium | 5.6 | 2024-10-16 | The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value… |
CVE-2024-8787 | Medium | 6.1 | 2024-10-16 | The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg witho… |
CVE-2024-8541 | Medium | 4.7 | 2024-10-16 | The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulnerable to Reflected… |
CVE-2024-49340 | Medium | 4.3 | 2024-10-16 | IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitt… |
CVE-2024-38204 | High | 7.5 | 2024-10-15 | Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network. |
CVE-2024-38190 | High | 8.6 | 2024-10-15 | Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector. |
CVE-2024-38139 | High | 8.7 | 2024-10-15 | Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. |
CVE-2024-45085 | Medium | 5.9 | 2024-10-15 | IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request. A r… |
CVE-2024-10004 | Critical | 9.1 | 2024-10-15 | Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon sho… |
CVE-2024-9966 | Medium | 5.3 | 2024-10-15 | Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security policy via a crafted H… |
CVE-2024-9965 | High | 8.8 | 2024-10-15 | Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2024-9964 | Medium | 4.3 | 2024-10-15 | Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2024-9963 | Medium | 4.3 | 2024-10-15 | Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2024-9962 | Medium | 4.3 | 2024-10-15 | Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI ges… |
CVE-2024-9961 | High | 8.8 | 2024-10-15 | Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
CVE-2024-9960 | High | 7.5 | 2024-10-15 | Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2024-9959 | High | 8.8 | 2024-10-15 | Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit he… |
CVE-2024-9958 | Medium | 4.3 | 2024-10-15 | Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing via a crafted HTML pa… |
CVE-2024-9957 | High | 8.8 | 2024-10-15 | Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potenti… |
CVE-2024-9956 | High | 7.8 | 2024-10-15 | Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation v… |
CVE-2024-9955 | High | 8.8 | 2024-10-15 | Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2024-9954 | High | 8.8 | 2024-10-15 | Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-9594 | Medium | 6.3 | 2024-10-15 | A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when u… |
CVE-2024-9486 | Critical | 9.8 | 2024-10-15 | A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtu… |
CVE-2024-48783 | High | 7.5 | 2024-10-15 | An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/postgresql.conf component. |
CVE-2024-48782 | Critical | 9.8 | 2024-10-15 | File Upload vulnerability in DYCMS Open-Source Version v2.0.9.41 allows a remote attacker to execute arbitrary code via the application only detecting the exte… |
CVE-2024-48781 | Critical | 9.8 | 2024-10-15 | An issue in Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 allows a remote attacker to execute arbitrary code via a specially constructed so fi… |
CVE-2024-48779 | Critical | 9.8 | 2024-10-15 | An issue in Wanxing Technology's Yitu project Management Software 3.2.2 allows a remote attacker to execute arbitrary code via the platformpluginpath parameter… |