2024 CVEs (page 149)
Page 149 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25622 | Low | 3.1 | 2024-10-11 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the res… |
CVE-2024-9002 | High | 7.8 | 2024-10-11 | CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and availability of the w… |
CVE-2024-8531 | High | 7.2 | 2024-10-11 | CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when an upgrade bundle is… |
CVE-2024-8530 | Medium | 5.9 | 2024-10-11 | CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” ar… |
CVE-2024-6657 | Medium | 6.5 | 2024-10-11 | A denial of service may be caused to a single peripheral device in a BLE network when multiple central devices continuously connect and disconnect to the peri… |
CVE-2024-9856 | Low | 2.4 | 2024-10-11 | A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2024-9855 | Medium | 4.7 | 2024-10-11 | A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been declared as critical. Affected by this vulnerability is the function uploadFil… |
CVE-2024-9707 | Critical | 9.8 | 2024-10-11 | The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/th… |
CVE-2024-9616 | Medium | 6.1 | 2024-10-11 | The BlockMeister – Block Pattern Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria… |
CVE-2024-9611 | Medium | 6.1 | 2024-10-11 | The Increase upload file size & Maximum Execution Time limit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_a… |
CVE-2024-9610 | Medium | 6.1 | 2024-10-11 | The Language Switcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the… |
CVE-2024-9587 | Medium | 5.4 | 2024-10-11 | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_linkz' function in versions… |
CVE-2024-9586 | Medium | 6.5 | 2024-10-11 | The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_auth' and 'check_logout' f… |
CVE-2024-9543 | Medium | 6.4 | 2024-10-11 | The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skipto' shortcode in all versio… |
CVE-2024-9538 | Medium | 4.3 | 2024-10-11 | The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'render' function in in… |
CVE-2024-9507 | Medium | 4.9 | 2024-10-11 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-9436 | Medium | 6.1 | 2024-10-11 | The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting… |
CVE-2024-9346 | Medium | 6.1 | 2024-10-11 | The Embed videos and respect privacy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'v' parameter in all versions up to, and incl… |
CVE-2024-9234 | Critical | 9.8 | 2024-10-11 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a mi… |
CVE-2024-9232 | Medium | 6.1 | 2024-10-11 | The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with… |
CVE-2024-9221 | Medium | 6.1 | 2024-10-11 | The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in al… |
CVE-2024-9211 | Medium | 6.1 | 2024-10-11 | The FULL – Cliente plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate… |
CVE-2024-9164 | Critical | 9.6 | 2024-10-11 | An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 pri… |
CVE-2024-9051 | Medium | 6.4 | 2024-10-11 | The WP Ultimate Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpupg-grid-with-filters shortcode in all versions… |
CVE-2024-8970 | High | 8.2 | 2024-10-11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 p… |
CVE-2024-8913 | Medium | 4.3 | 2024-10-11 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Informati… |
CVE-2024-7514 | Medium | 6.5 | 2024-10-11 | The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comment… |
CVE-2024-6971 | Medium | 4.4 | 2024-10-11 | A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_databas… |
CVE-2024-5005 | Medium | 4.3 | 2024-10-11 | An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 11.4 before 17.2.9, all versions starting from 17.3 before 17.3.5… |
CVE-2024-48987 | Medium | 6.6 | 2024-10-11 | Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env file… |
CVE-2024-45317 | High | 7.5 | 2024-10-11 | A Server-Side Request Forgery (SSRF) vulnerability in SMA1000 appliance firmware versions 12.4.3-02676 and earlier allows a remote, unauthenticated attacker to… |
CVE-2024-45316 | High | 7.8 | 2024-10-11 | The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client)… |
CVE-2024-45315 | Medium | 5.5 | 2024-10-11 | The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client)… |
CVE-2024-21534 | Critical | 9.8 | 2024-10-11 | All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary… |
CVE-2024-9822 | Critical | 9.8 | 2024-10-11 | The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restricti… |
CVE-2024-9818 | High | 7.3 | 2024-10-10 | A vulnerability classified as critical has been found in SourceCodester Online Veterinary Appointment System 1.0. Affected is an unknown function of the file /… |
CVE-2024-9817 | Medium | 6.3 | 2024-10-10 | A vulnerability was found in code-projects Blood Bank System 1.0. It has been classified as critical. This affects an unknown part of the file /update.php. The… |
CVE-2024-47872 | Medium | 5.4 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **Cross-Site Scripting (XSS)** on any Gradio server that al… |
CVE-2024-47871 | Critical | 9.1 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communication** between the FRP (Fast Reverse Pr… |
CVE-2024-47870 | High | 8.1 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` functio… |
CVE-2024-47869 | Low | 3.7 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for t… |
CVE-2024-47868 | High | 7.5 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This is a **data validation vulnerability** affecting several Gradio components, which… |
CVE-2024-47867 | High | 7.5 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity check** on the downloaded FRP client, which… |
CVE-2024-9816 | Medium | 4.7 | 2024-10-10 | A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2024-9815 | Medium | 4.7 | 2024-10-10 | A vulnerability has been found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2024-9814 | High | 7.3 | 2024-10-10 | A vulnerability, which was classified as critical, was found in Codezips Pharmacy Management System 1.0. Affected is an unknown function of the file product/up… |
CVE-2024-9487 | Critical | 9.1 | 2024-10-10 | An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypasse… |
CVE-2024-47168 | Medium | 4.3 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag not properl… |
CVE-2024-47167 | Critical | 9.8 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Request Forgery (SSRF)** in the `/queue/joi… |
CVE-2024-47166 | Medium | 5.3 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **one-level read path traversal** in the `/custom_compone… |
CVE-2024-47165 | Medium | 5.4 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null origin**. When… |
CVE-2024-47164 | Medium | 6.5 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the **bypass of directory traversal checks** within the `… |
CVE-2024-47084 | High | 8.3 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fa… |
CVE-2024-9813 | High | 7.3 | 2024-10-10 | A vulnerability, which was classified as critical, has been found in Codezips Pharmacy Management System 1.0. This issue affects some unknown processing of the… |
CVE-2024-9812 | High | 7.3 | 2024-10-10 | A vulnerability classified as critical was found in code-projects Crud Operation System 1.0. This vulnerability affects unknown code of the file delete.php. Th… |
CVE-2024-9811 | High | 7.3 | 2024-10-10 | A vulnerability classified as critical has been found in code-projects Restaurant Reservation System 1.0. This affects an unknown part of the file filter3.php… |
CVE-2024-9180 | High | 7.2 | 2024-10-10 | A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s r… |
CVE-2024-9810 | Low | 3.5 | 2024-10-10 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionalit… |
CVE-2024-9809 | Medium | 6.3 | 2024-10-10 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is the function delete_pr… |
CVE-2024-9808 | Medium | 6.3 | 2024-10-10 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?pa… |
CVE-2024-9807 | Low | 2.4 | 2024-10-10 | A vulnerability was found in Craig Rodway Classroombookings 2.8.7 and classified as problematic. This issue affects some unknown processing of the file /sessio… |
CVE-2024-9806 | Low | 3.5 | 2024-10-10 | A vulnerability has been found in Craig Rodway Classroombookings up to 2.8.6 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-47648 | Medium | 4.7 | 2024-10-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Metagauss EventPrime eventprime-event-calendar-management.This issue affects EventPrime: f… |
CVE-2024-47354 | Medium | 4.7 | 2024-10-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership After Login Redirection simple-membership-after-login-redirec… |
CVE-2024-9805 | Low | 3.5 | 2024-10-10 | A vulnerability was found in code-projects Blood Bank System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /adm… |
CVE-2024-9804 | Medium | 4.7 | 2024-10-10 | A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/… |
CVE-2024-47966 | High | 7.8 | 2024-10-10 | Delta Electronics CNCSoft-G2 lacks proper initialization of memory prior to accessing it. An attacker can manipulate users to visit a malicious page or file to… |
CVE-2024-47965 | High | 7.8 | 2024-10-10 | Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can man… |
CVE-2024-47964 | High | 7.8 | 2024-10-10 | Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker c… |
CVE-2024-47963 | High | 7.8 | 2024-10-10 | Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can ma… |
CVE-2024-47962 | High | 7.8 | 2024-10-10 | Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker… |
CVE-2024-47636 | Critical | 9.8 | 2024-10-10 | Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch allows Object Injection.This issue affects JobSearch: from n/a through <= 2.5… |
CVE-2024-9803 | Low | 3.5 | 2024-10-10 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as problematic. This affects an unknown part of the file bl… |
CVE-2024-9799 | Low | 3.5 | 2024-10-10 | A vulnerability has been found in SourceCodester Profile Registration without Reload Refresh 1.0 and classified as problematic. Affected by this vulnerability… |
CVE-2024-9797 | High | 7.3 | 2024-10-10 | A vulnerability, which was classified as critical, was found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file register.php… |
CVE-2024-9794 | Medium | 6.3 | 2024-10-10 | A vulnerability, which was classified as critical, has been found in Codezips Online Shopping Portal 1.0. This issue affects some unknown processing of the fil… |
CVE-2024-9793 | Medium | 6.3 | 2024-10-10 | A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of… |
CVE-2024-9792 | Low | 2.4 | 2024-10-10 | A vulnerability classified as problematic has been found in D-Link DSL-2750U R5B017. This affects an unknown part of the component Port Forwarding Page. The ma… |
CVE-2024-9790 | Medium | 4.7 | 2024-10-10 | A vulnerability was found in LyLme_spage 1.9.5. It has been classified as critical. Affected is an unknown function of the file /admin/sou.php. The manipulatio… |
CVE-2024-9789 | Medium | 4.7 | 2024-10-10 | A vulnerability was found in LyLme_spage 1.9.5 and classified as critical. This issue affects some unknown processing of the file /admin/apply.php. The manipul… |
CVE-2024-9788 | Medium | 4.7 | 2024-10-10 | A vulnerability has been found in LyLme_spage 1.9.5 and classified as critical. This vulnerability affects unknown code of the file /admin/tag.php. The manipul… |
CVE-2024-9787 | Medium | 5.3 | 2024-10-10 | A vulnerability, which was classified as problematic, was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2. This affects an unknown part of… |
CVE-2024-9312 | High | 7.5 | 2024-10-10 | Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another u… |
CVE-2024-4658 | | 2024-10-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TE Informatics Nova CMS allows SQL Injection. This issue… | |
CVE-2024-9786 | High | 8.8 | 2024-10-10 | A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. Affected by this issue is the function formSetLog of the file /go… |
CVE-2024-9785 | High | 8.8 | 2024-10-10 | A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formSetDDNS of the file /goform/for… |
CVE-2024-6157 | Medium | 5.1 | 2024-10-10 | An attacker who successfully exploited these vulnerabilities could cause the robot to stop. A vulnerability exists in the PROFINET stack included in the Rob… |
CVE-2024-35202 | High | 7.5 | 2024-10-10 | Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in… |
CVE-2024-9784 | High | 8.8 | 2024-10-10 | A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formResetStatistic of the file /goform/formResetStat… |
CVE-2024-9783 | High | 8.8 | 2024-10-10 | A vulnerability was found in D-Link DIR-619L B1 2.06. It has been rated as critical. This issue affects the function formLogDnsquery of the file /goform/formLo… |
CVE-2024-9782 | High | 8.8 | 2024-10-10 | A vulnerability was found in D-Link DIR-619L B1 2.06. It has been declared as critical. This vulnerability affects the function formEasySetupWWConfig of the fi… |
CVE-2024-6530 | High | 7.3 | 2024-10-10 | A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior to 17.3.5, and star… |
CVE-2024-9201 | Critical | 9.4 | 2024-10-10 | The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘id_order’ parameter of the ‘/modules/seur/a… |
CVE-2024-48902 | Medium | 5.4 | 2024-10-10 | In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API |
CVE-2024-9623 | Medium | 4.9 | 2024-10-10 | An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 p… |
CVE-2024-9596 | Low | 3.7 | 2024-10-10 | An issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2… |
CVE-2024-8977 | High | 8.2 | 2024-10-10 | An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2… |
CVE-2024-45149 | Low | 2.7 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Sec… |
CVE-2024-45148 | High | 8.8 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a sec… |
CVE-2024-45135 | Low | 2.7 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Sec… |