2024 CVEs (page 159)
Page 159 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8967 | Medium | 6.4 | 2024-10-02 | The PWA — easy way to Progressive Web App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc… |
CVE-2024-8800 | Medium | 6.1 | 2024-10-02 | The RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more plugin for WordPress is vulnerable… |
CVE-2024-8254 | Medium | 5.4 | 2024-10-02 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary… |
CVE-2024-9333 | | 2024-10-02 | Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access… | |
CVE-2024-9174 | Medium | 5.4 | 2024-10-02 | Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI |
CVE-2024-7315 | High | 7.5 | 2024-10-02 | The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, wh… |
CVE-2024-7855 | High | 8.8 | 2024-10-02 | The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all ve… |
CVE-2024-45186 | Critical | 9.8 | 2024-10-02 | FileSender before 2.49 allows server-side template injection (SSTI) for retrieving credentials. |
CVE-2024-33662 | High | 7.5 | 2024-10-02 | Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function. |
CVE-2024-21530 | Medium | 4.5 | 2024-10-02 | Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequential… |
CVE-2024-9407 | Medium | 4.7 | 2024-10-01 | A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this… |
CVE-2024-47609 | | 2024-10-01 | Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause… | |
CVE-2024-47528 | Medium | 4.8 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for… |
CVE-2024-47527 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Device Dependencies" feat… |
CVE-2024-47526 | Low | 3.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" featu… |
CVE-2024-47525 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allo… |
CVE-2024-47524 | High | 7.2 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can create a Device Groups, the application did not properly s… |
CVE-2024-47523 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Transports" feature… |
CVE-2024-46084 | High | 8.0 | 2024-10-01 | Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function. |
CVE-2024-46082 | Medium | 5.4 | 2024-10-01 | Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters. |
CVE-2024-46080 | High | 8.0 | 2024-10-01 | Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function. |
CVE-2024-9411 | Low | 3.5 | 2024-10-01 | A vulnerability classified as problematic has been found in OFCMS 1.1.2. This affects the function add of the file /admin/system/dict/add.json?sqlid=system.dic… |
CVE-2024-45999 | Critical | 9.8 | 2024-10-01 | A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function located in the file /application/models/Oqr… |
CVE-2024-9355 | Medium | 6.5 | 2024-10-01 | A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buf… |
CVE-2024-9341 | Medium | 5.4 | 2024-10-01 | A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the c… |
CVE-2024-46083 | Medium | 5.4 | 2024-10-01 | Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads using the messages feature, whi… |
CVE-2024-46081 | Medium | 5.4 | 2024-10-01 | Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads in the To-Do List. The assigned… |
CVE-2024-46079 | Medium | 6.1 | 2024-10-01 | Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter. |
CVE-2024-42514 | High | 8.1 | 2024-10-01 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthor… |
CVE-2024-31835 | Medium | 4.8 | 2024-10-01 | Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the file name pa… |
CVE-2024-47608 | Critical | 9.8 | 2024-10-01 | Logicytics is designed to harvest and collect data for forensic analysis. Logicytics has a basic vuln affecting compromised devices from shell injections. This… |
CVE-2024-9403 | High | 7.3 | 2024-10-01 | Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2024-9402 | Critical | 9.8 | 2024-10-01 | Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-9401 | Critical | 9.8 | 2024-10-01 | Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruptio… |
CVE-2024-9400 | High | 8.8 | 2024-10-01 | A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. Th… |
CVE-2024-9399 | High | 7.5 | 2024-10-01 | A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulner… |
CVE-2024-9398 | Medium | 5.3 | 2024-10-01 | By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that… |
CVE-2024-9397 | Medium | 6.1 | 2024-10-01 | A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerabilit… |
CVE-2024-9396 | High | 8.8 | 2024-10-01 | It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption. T… |
CVE-2024-9395 | Medium | 5.3 | 2024-10-01 | A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. *This bug only affec… |
CVE-2024-9394 | High | 7.5 | 2024-10-01 | An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to a… |
CVE-2024-9393 | High | 7.5 | 2024-10-01 | An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to acc… |
CVE-2024-9392 | Critical | 9.8 | 2024-10-01 | A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3… |
CVE-2024-9391 | Medium | 6.5 | 2024-10-01 | A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of o… |
CVE-2024-47604 | High | 8.2 | 2024-10-01 | NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability in its handling of HTML element attributes, which al… |
CVE-2024-47534 | | 2024-10-01 | go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A"… | |
CVE-2024-47071 | Medium | 6.8 | 2024-10-01 | OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to… |
CVE-2024-25660 | Critical | 9.0 | 2024-10-01 | The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operatio… |
CVE-2024-25659 | High | 7.2 | 2024-10-01 | In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote at… |
CVE-2024-45967 | Medium | 4.7 | 2024-10-01 | Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget. |
CVE-2024-45408 | High | 7.5 | 2024-10-01 | eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to acc… |
CVE-2024-44610 | Medium | 5.6 | 2024-10-01 | PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters in a Software Update… |
CVE-2024-41673 | High | 7.1 | 2024-10-01 | Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This… |
CVE-2024-25661 | High | 7.7 | 2024-10-01 | In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client all… |
CVE-2024-25658 | Medium | 6.5 | 2024-10-01 | Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the database or exported… |
CVE-2024-25632 | High | 8.6 | 2024-10-01 | eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certain privileges to m… |
CVE-2024-46276 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_chunk() function at cute_png.h. |
CVE-2024-46274 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_stored() function at cute_png.h. |
CVE-2024-46267 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_block() function at cute_png.h. |
CVE-2024-46264 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_find() function at cute_png.h. |
CVE-2024-46263 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a stack overflow via the cp_dynamic() function at cute_png.h. |
CVE-2024-46261 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_make32() function at cute_png.h. |
CVE-2024-46259 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_unfilter() function at cute_png.h. |
CVE-2024-46258 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_load_png_mem() function at cute_png.h. |
CVE-2024-44744 | Medium | 5.7 | 2024-10-01 | An issue in Malwarebytes Premium Security v5.0.0.883 allows attackers to execute arbitrary code via placing crafted binaries into unspecified directories. NOTE… |
CVE-2024-41276 | Critical | 9.8 | 2024-10-01 | A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. The application requires users to inp… |
CVE-2024-9405 | Medium | 5.3 | 2024-10-01 | An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attac… |
CVE-2024-30132 | Low | 3.7 | 2024-10-01 | HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspeci… |
CVE-2024-9118 | Medium | 6.4 | 2024-10-01 | The QS Dark Mode Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.9 due to… |
CVE-2024-9060 | Medium | 6.4 | 2024-10-01 | The AVIF & SVG Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.1.0 due to insufficient input sanit… |
CVE-2024-9289 | Critical | 9.8 | 2024-10-01 | The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is… |
CVE-2024-9265 | Critical | 9.8 | 2024-10-01 | The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. This is due to the plu… |
CVE-2024-9241 | Medium | 6.1 | 2024-10-01 | The PDF Image Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on th… |
CVE-2024-9228 | Medium | 6.1 | 2024-10-01 | The Loggedin – Limit Active Logins plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc… |
CVE-2024-9224 | Medium | 6.5 | 2024-10-01 | The Hello World plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 2.1.1 via the hello_world_lyric() function… |
CVE-2024-9220 | Medium | 6.1 | 2024-10-01 | The LH Copy Media File plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the… |
CVE-2024-9209 | Medium | 6.1 | 2024-10-01 | The WP Search Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on th… |
CVE-2024-9018 | High | 8.8 | 2024-10-01 | The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, an… |
CVE-2024-8799 | Medium | 6.1 | 2024-10-01 | The Custom Banners plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL… |
CVE-2024-8793 | Medium | 6.1 | 2024-10-01 | The Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin for WordPress is vulnerable to Reflected Cross-Site… |
CVE-2024-8786 | Medium | 6.1 | 2024-10-01 | The Auto Featured Image from Title plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc… |
CVE-2024-8430 | Medium | 5.3 | 2024-10-01 | The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_im… |
CVE-2024-8324 | Medium | 6.4 | 2024-10-01 | The XO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘get_slider’ function in all versions up to, and including, 3.8.6 due t… |
CVE-2024-8288 | Medium | 6.4 | 2024-10-01 | The Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ali… |
CVE-2024-9304 | Medium | 6.4 | 2024-10-01 | The LocateAndFilter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.14 due to… |
CVE-2024-9274 | Medium | 6.4 | 2024-10-01 | The Elastik Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.4 du… |
CVE-2024-9272 | Medium | 6.4 | 2024-10-01 | The R Animated Icon Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due… |
CVE-2024-9269 | Medium | 6.4 | 2024-10-01 | The Relogo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.2 due to insufficie… |
CVE-2024-9267 | Medium | 6.1 | 2024-10-01 | The Easy WordPress Subscribe – Optin Hound plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropr… |
CVE-2024-9145 | | 2024-10-01 | Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerabl… | |
CVE-2024-9119 | Medium | 6.4 | 2024-10-01 | The SVG Complete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insu… |
CVE-2024-9108 | Critical | 9.8 | 2024-10-01 | The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convert_remoteimage_to_lo… |
CVE-2024-9106 | Critical | 9.8 | 2024-10-01 | The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verifi… |
CVE-2024-8990 | Medium | 6.4 | 2024-10-01 | The Geo Mashup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's geo_mashup_visible_posts_list shortcode in all versions up to… |
CVE-2024-8989 | Medium | 6.4 | 2024-10-01 | The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scrip… |
CVE-2024-8728 | Medium | 6.1 | 2024-10-01 | The Easy Load More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL… |
CVE-2024-8727 | Medium | 6.1 | 2024-10-01 | The DK PDF plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all… |
CVE-2024-8720 | Medium | 6.4 | 2024-10-01 | The RumbleTalk Live Group Chat – HTML5 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rumbletalk-admin-button' shortcode i… |
CVE-2024-8718 | Medium | 6.1 | 2024-10-01 | The Gravity Forms Toolbar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1… |
CVE-2024-8675 | Medium | 4.3 | 2024-10-01 | The Soumettre.fr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the soumettre_disconnect_gateway… |