2024 CVEs (page 148)
Page 148 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7489 | Medium | 4.4 | 2024-10-12 | The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form color parameters… |
CVE-2024-9860 | Medium | 5.4 | 2024-10-12 | The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'import_action… |
CVE-2024-9821 | High | 8.8 | 2024-10-12 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stm_wpcf… |
CVE-2024-9592 | Medium | 6.1 | 2024-10-12 | The Easy PayPal Gift Certificate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missi… |
CVE-2024-45754 | High | 7.2 | 2024-10-11 | An issue was discovered in the centreon-bi-server component in Centreon BI Server 24.04.x before 24.04.3, 23.10.x before 23.10.8, 23.04.x before 23.04.11, and… |
CVE-2024-35522 | High | 8.4 | 2024-10-11 | Netgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injection in operating_mode.cgi via the ap_mode… |
CVE-2024-35517 | High | 8.4 | 2024-10-11 | Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter. |
CVE-2024-48938 | High | 7.5 | 2024-10-11 | Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email. Parsing the content of emails where HTML code is copied from Microso… |
CVE-2024-48937 | Medium | 6.1 | 2024-10-11 | Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of the SLA field in Activity Dialogues is e… |
CVE-2024-48788 | High | 7.5 | 2024-10-11 | An issue in YESCAM (com.yescom.YesCam.zwave) 1.0.2 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48772 | Critical | 9.1 | 2024-10-11 | An issue in C-CHIP (com.cchip.cchipamaota) v.1.2.8 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-46468 | High | 7.5 | 2024-10-11 | A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to obtain sensitive information, resul… |
CVE-2024-45184 | Medium | 6.2 | 2024-10-11 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with chipset Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330… |
CVE-2024-48787 | Critical | 9.1 | 2024-10-11 | An issue in Revic Optics Revic Ops (us.revic.revicops) 1.12.5 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48786 | Critical | 9.1 | 2024-10-11 | An issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48784 | Critical | 9.8 | 2024-10-11 | An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive information via the firmware update proce… |
CVE-2024-48778 | Critical | 9.1 | 2024-10-11 | An issue in GIANT MANUFACTURING CO., LTD RideLink (tw.giant.ridelink) 2.0.7 allows a remote attacker to obtain sensitive information via the firmware update pr… |
CVE-2024-48777 | High | 7.5 | 2024-10-11 | LEDVANCE com.ledvance.smartplus.eu 2.1.10 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48776 | High | 7.5 | 2024-10-11 | An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-48775 | High | 7.5 | 2024-10-11 | An issue in Plug n Play Camera com.ezset.delaney 1.2.0 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48774 | High | 7.5 | 2024-10-11 | An issue in Fermax Asia Pacific Pte Ltd com.fermax.vida 2.4.6 allows a remote attacker to obtain sensitve information via the firmware update process. |
CVE-2024-48773 | High | 7.5 | 2024-10-11 | An issue in WoFit v.7.2.3 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-48771 | High | 7.5 | 2024-10-11 | An issue in almando GmbH Almando Play APP (com.almando.play) 1.8.2 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-48770 | High | 8.2 | 2024-10-11 | An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48769 | Critical | 9.1 | 2024-10-11 | An issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain sensitve information via the firmware update process. |
CVE-2024-48768 | High | 7.5 | 2024-10-11 | An issue in almaodo GmbH appinventor.ai_google.almando_control 2.3.1 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-47884 | | 2024-10-11 | foxmarks is a CLI read-only interface for Firefox's bookmarks and history. A temporary file was created under the /tmp directory with read permissions for all… | |
CVE-2024-38365 | High | 7.4 | 2024-10-11 | btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement… |
CVE-2024-8912 | High | 7.5 | 2024-10-11 | An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Look… |
CVE-2024-48041 | Medium | 6.5 | 2024-10-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary enhanced-toolt… |
CVE-2024-48040 | High | 8.5 | 2024-10-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows SQL Injection.This issu… |
CVE-2024-48033 | Critical | 9.8 | 2024-10-11 | Deserialization of Untrusted Data vulnerability in baptiste.gourdin Talkback talkback-secure-linkback-protocol allows Object Injection.This issue affects Talkb… |
CVE-2024-48020 | High | 8.5 | 2024-10-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-cap… |
CVE-2024-47353 | Medium | 4.7 | 2024-10-11 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite.This issue affects Eleme… |
CVE-2024-47331 | Critical | 9.3 | 2024-10-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step all… |
CVE-2024-9539 | Medium | 4.3 | 2024-10-11 | An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata i… |
CVE-2024-46532 | Critical | 9.8 | 2024-10-11 | SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class.php component. |
CVE-2024-44807 | Medium | 5.3 | 2024-10-11 | A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. BurgerEditor and BurgerEditor Limited Edition before 2.25.1 allows remote attackers to obt… |
CVE-2024-44157 | Medium | 5.5 | 2024-10-11 | A stack buffer overflow was addressed through improved input validation. This issue is fixed in Apple TV 1.5.0.152 for Windows, iTunes 12.13.3 for Windows. Par… |
CVE-2024-9859 | High | 8.8 | 2024-10-11 | Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium s… |
CVE-2024-47877 | High | 7.5 | 2024-10-11 | Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside… |
CVE-2024-46215 | Medium | 6.5 | 2024-10-11 | A vulnerability was discovered in KM08-708H-v1.1, There is a buffer overflow in the sub_445BDC() function within the /usr/sbin/goahead program; The strcpy func… |
CVE-2024-44734 | High | 7.5 | 2024-10-11 | Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction request to the serv… |
CVE-2024-44731 | Medium | 4.7 | 2024-10-11 | Mirotalk before commit 9de226 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary code v… |
CVE-2024-44415 | Medium | 6.5 | 2024-10-11 | A vulnerability was discovered in DI_8200-16.07.26A1, There is a buffer overflow in the dbsrv_asp function; The strcpy function is executed without checking th… |
CVE-2024-44414 | High | 8.8 | 2024-10-11 | A vulnerability was discovered in FBM_292W-21.03.10V, which has been classified as critical. This issue affects the sub_4901E0 function in the msp_info.htm fil… |
CVE-2024-44413 | High | 8.8 | 2024-10-11 | A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_… |
CVE-2024-42018 | High | 7.7 | 2024-10-11 | An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved from management nod… |
CVE-2024-9046 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-8376 | High | 7.5 | 2024-10-11 | In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of… |
CVE-2024-6985 | Medium | 4.4 | 2024-10-11 | A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any f… |
CVE-2024-5474 | Medium | 5.5 | 2024-10-11 | A potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2.0.0.2 that could a… |
CVE-2024-4132 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-4131 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-4130 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-4089 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-48827 | High | 8.8 | 2024-10-11 | An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password function. |
CVE-2024-48813 | High | 8.8 | 2024-10-11 | SQL injection vulnerability in employee-management-system-php-and-mysql-free-download.html taskmatic 1.0 allows a remote attacker to execute arbitrary code via… |
CVE-2024-47509 | Medium | 6.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an… |
CVE-2024-47508 | Medium | 6.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an… |
CVE-2024-47507 | Medium | 5.8 | 2024-10-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2024-47506 | Medium | 5.9 | 2024-10-11 | A Deadlock vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to… |
CVE-2024-47505 | Medium | 6.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an… |
CVE-2024-47504 | High | 7.5 | 2024-10-11 | An Improper Validation of Specified Type of Input vulnerability in the packet forwarding engine (pfe) Juniper Networks Junos OS on SRX5000 Series allows an una… |
CVE-2024-47503 | Medium | 6.5 | 2024-10-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX4600 and SRX5000… |
CVE-2024-47502 | High | 7.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network bas… |
CVE-2024-47501 | Medium | 5.5 | 2024-10-11 | A NULL Pointer Dereference vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX304, MX with MPC10/11/LC9600, and EX9200 wit… |
CVE-2024-47499 | High | 7.5 | 2024-10-11 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2024-47498 | Medium | 6.5 | 2024-10-11 | An Unimplemented or Unsupported Feature in UI vulnerability in the CLI of Juniper Networks Junos OS Evolved on QFX5000 Series allows an unauthenticated, adjace… |
CVE-2024-47497 | High | 7.5 | 2024-10-11 | An Uncontrolled Resource Consumption vulnerability in the http daemon (httpd) of Juniper Networks Junos OS on SRX Series, QFX Series, MX Series and EX Series a… |
CVE-2024-47496 | Medium | 5.5 | 2024-10-11 | A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS allows a local, low-privileged attacker to cause a… |
CVE-2024-47495 | Medium | 6.7 | 2024-10-11 | An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device… |
CVE-2024-47494 | Medium | 5.9 | 2024-10-11 | A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the AgentD process of Juniper Networks Junos OS allows an attacker who is already causing… |
CVE-2024-47493 | Medium | 6.5 | 2024-10-11 | A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of the Juniper Networks Junos OS on the MX Series plat… |
CVE-2024-47491 | Medium | 5.9 | 2024-10-11 | An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a ne… |
CVE-2024-47490 | High | 8.2 | 2024-10-11 | An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved… |
CVE-2024-47489 | Medium | 5.8 | 2024-10-11 | An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of the Juniper Networks Junos OS Evolved on ACX Series devic… |
CVE-2024-46088 | Critical | 9.8 | 2024-10-11 | An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer Resource Management System v2002 to v2… |
CVE-2024-44730 | Critical | 9.1 | 2024-10-11 | Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an a… |
CVE-2024-44729 | High | 7.5 | 2024-10-11 | Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presenter privileges to a… |
CVE-2024-42640 | Critical | 9.8 | 2024-10-11 | angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an atta… |
CVE-2024-39563 | High | 7.3 | 2024-10-11 | A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to exec… |
CVE-2024-39547 | High | 7.5 | 2024-10-11 | An Improper Handling of Exceptional Conditions vulnerability in the rpd-server of Juniper Networks Junos OS and Junos OS Evolved within cRPD allows an unauthen… |
CVE-2024-39544 | Medium | 5.0 | 2024-10-11 | An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks Junos OS Evolved allows a low privileged local attacker… |
CVE-2024-39534 | Medium | 5.4 | 2024-10-11 | An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent att… |
CVE-2024-39527 | Medium | 5.5 | 2024-10-11 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devi… |
CVE-2024-39526 | Medium | 6.5 | 2024-10-11 | An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Series with MPC10/MPC11/LC9600 line cards… |
CVE-2024-33582 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33581 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33580 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33579 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33578 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-8755 | High | 8.4 | 2024-10-11 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects: Product Affe… |
CVE-2024-47875 | Critical | 10.0 | 2024-10-11 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability i… |
CVE-2024-47830 | Critical | 9.3 | 2024-10-11 | Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may… |
CVE-2024-47074 | Critical | 9.8 | 2024-10-11 | DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customize the JDBC connect… |
CVE-2024-45403 | Low | 3.7 | 2024-10-11 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client… |
CVE-2024-45402 | High | 8.6 | 2024-10-11 | Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, pic… |
CVE-2024-45397 | Medium | 5.9 | 2024-10-11 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets… |
CVE-2024-45396 | High | 7.5 | 2024-10-11 | Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker can exploit these… |