2024 CVEs (page 159)
Page 159 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-46079 | Medium | 6.1 | 2024-10-01 | Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter. |
CVE-2024-42514 | High | 8.1 | 2024-10-01 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthor… |
CVE-2024-31835 | Medium | 4.8 | 2024-10-01 | Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the file name pa… |
CVE-2024-47608 | Critical | 9.8 | 2024-10-01 | Logicytics is designed to harvest and collect data for forensic analysis. Logicytics has a basic vuln affecting compromised devices from shell injections. This… |
CVE-2024-9403 | High | 7.3 | 2024-10-01 | Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2024-9402 | Critical | 9.8 | 2024-10-01 | Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-9401 | Critical | 9.8 | 2024-10-01 | Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruptio… |
CVE-2024-9400 | High | 8.8 | 2024-10-01 | A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. Th… |
CVE-2024-9399 | High | 7.5 | 2024-10-01 | A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulner… |
CVE-2024-9398 | Medium | 5.3 | 2024-10-01 | By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that… |
CVE-2024-9397 | Medium | 6.1 | 2024-10-01 | A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerabilit… |
CVE-2024-9396 | High | 8.8 | 2024-10-01 | It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption. T… |
CVE-2024-9395 | Medium | 5.3 | 2024-10-01 | A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. *This bug only affec… |
CVE-2024-9394 | High | 7.5 | 2024-10-01 | An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to a… |
CVE-2024-9393 | High | 7.5 | 2024-10-01 | An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to acc… |
CVE-2024-9392 | Critical | 9.8 | 2024-10-01 | A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3… |
CVE-2024-9391 | Medium | 6.5 | 2024-10-01 | A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of o… |
CVE-2024-47604 | High | 8.2 | 2024-10-01 | NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability in its handling of HTML element attributes, which al… |
CVE-2024-47534 | | 2024-10-01 | go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A"… | |
CVE-2024-47071 | Medium | 6.8 | 2024-10-01 | OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to… |
CVE-2024-25660 | Critical | 9.0 | 2024-10-01 | The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operatio… |
CVE-2024-25659 | High | 7.2 | 2024-10-01 | In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote at… |
CVE-2024-45967 | Medium | 4.7 | 2024-10-01 | Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget. |
CVE-2024-45408 | High | 7.5 | 2024-10-01 | eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to acc… |
CVE-2024-44610 | Medium | 5.6 | 2024-10-01 | PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters in a Software Update… |
CVE-2024-41673 | High | 7.1 | 2024-10-01 | Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This… |
CVE-2024-25661 | High | 7.7 | 2024-10-01 | In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client all… |
CVE-2024-25658 | Medium | 6.5 | 2024-10-01 | Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the database or exported… |
CVE-2024-25632 | High | 8.6 | 2024-10-01 | eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certain privileges to m… |
CVE-2024-46276 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_chunk() function at cute_png.h. |
CVE-2024-46274 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_stored() function at cute_png.h. |
CVE-2024-46267 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_block() function at cute_png.h. |
CVE-2024-46264 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_find() function at cute_png.h. |
CVE-2024-46263 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a stack overflow via the cp_dynamic() function at cute_png.h. |
CVE-2024-46261 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_make32() function at cute_png.h. |
CVE-2024-46259 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_unfilter() function at cute_png.h. |
CVE-2024-46258 | High | 7.8 | 2024-10-01 | cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_load_png_mem() function at cute_png.h. |
CVE-2024-44744 | Medium | 5.7 | 2024-10-01 | An issue in Malwarebytes Premium Security v5.0.0.883 allows attackers to execute arbitrary code via placing crafted binaries into unspecified directories. NOTE… |
CVE-2024-41276 | Critical | 9.8 | 2024-10-01 | A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. The application requires users to inp… |
CVE-2024-9405 | Medium | 5.3 | 2024-10-01 | An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attac… |
CVE-2024-30132 | Low | 3.7 | 2024-10-01 | HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspeci… |
CVE-2024-9118 | Medium | 6.4 | 2024-10-01 | The QS Dark Mode Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.9 due to… |
CVE-2024-9060 | Medium | 6.4 | 2024-10-01 | The AVIF & SVG Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.1.0 due to insufficient input sanit… |
CVE-2024-9289 | Critical | 9.8 | 2024-10-01 | The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is… |
CVE-2024-9265 | Critical | 9.8 | 2024-10-01 | The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. This is due to the plu… |
CVE-2024-9241 | Medium | 6.1 | 2024-10-01 | The PDF Image Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on th… |
CVE-2024-9228 | Medium | 6.1 | 2024-10-01 | The Loggedin – Limit Active Logins plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc… |
CVE-2024-9224 | Medium | 6.5 | 2024-10-01 | The Hello World plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 2.1.1 via the hello_world_lyric() function… |
CVE-2024-9220 | Medium | 6.1 | 2024-10-01 | The LH Copy Media File plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the… |
CVE-2024-9209 | Medium | 6.1 | 2024-10-01 | The WP Search Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on th… |
CVE-2024-9018 | High | 8.8 | 2024-10-01 | The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, an… |
CVE-2024-8799 | Medium | 6.1 | 2024-10-01 | The Custom Banners plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL… |
CVE-2024-8793 | Medium | 6.1 | 2024-10-01 | The Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin for WordPress is vulnerable to Reflected Cross-Site… |
CVE-2024-8786 | Medium | 6.1 | 2024-10-01 | The Auto Featured Image from Title plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc… |
CVE-2024-8430 | Medium | 5.3 | 2024-10-01 | The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_im… |
CVE-2024-8324 | Medium | 6.4 | 2024-10-01 | The XO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘get_slider’ function in all versions up to, and including, 3.8.6 due t… |
CVE-2024-8288 | Medium | 6.4 | 2024-10-01 | The Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ali… |
CVE-2024-9304 | Medium | 6.4 | 2024-10-01 | The LocateAndFilter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.14 due to… |
CVE-2024-9274 | Medium | 6.4 | 2024-10-01 | The Elastik Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.4 du… |
CVE-2024-9272 | Medium | 6.4 | 2024-10-01 | The R Animated Icon Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due… |
CVE-2024-9269 | Medium | 6.4 | 2024-10-01 | The Relogo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.2 due to insufficie… |
CVE-2024-9267 | Medium | 6.1 | 2024-10-01 | The Easy WordPress Subscribe – Optin Hound plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropr… |
CVE-2024-9145 | | 2024-10-01 | Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerabl… | |
CVE-2024-9119 | Medium | 6.4 | 2024-10-01 | The SVG Complete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insu… |
CVE-2024-9108 | Critical | 9.8 | 2024-10-01 | The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convert_remoteimage_to_lo… |
CVE-2024-9106 | Critical | 9.8 | 2024-10-01 | The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verifi… |
CVE-2024-8990 | Medium | 6.4 | 2024-10-01 | The Geo Mashup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's geo_mashup_visible_posts_list shortcode in all versions up to… |
CVE-2024-8989 | Medium | 6.4 | 2024-10-01 | The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scrip… |
CVE-2024-8728 | Medium | 6.1 | 2024-10-01 | The Easy Load More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL… |
CVE-2024-8727 | Medium | 6.1 | 2024-10-01 | The DK PDF plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all… |
CVE-2024-8720 | Medium | 6.4 | 2024-10-01 | The RumbleTalk Live Group Chat – HTML5 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rumbletalk-admin-button' shortcode i… |
CVE-2024-8718 | Medium | 6.1 | 2024-10-01 | The Gravity Forms Toolbar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1… |
CVE-2024-8675 | Medium | 4.3 | 2024-10-01 | The Soumettre.fr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the soumettre_disconnect_gateway… |
CVE-2024-8632 | Medium | 6.5 | 2024-10-01 | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing cap… |
CVE-2024-8548 | High | 8.1 | 2024-10-01 | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capab… |
CVE-2024-7869 | High | 7.2 | 2024-10-01 | The 123.chat - Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.1 due to insufficient inp… |
CVE-2024-7434 | High | 8.8 | 2024-10-01 | The UltraPress theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.2 via deserialization of untrusted input. Th… |
CVE-2024-7433 | High | 8.8 | 2024-10-01 | The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of untrusted input. T… |
CVE-2024-7432 | High | 8.8 | 2024-10-01 | The Unseen Blog theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input. T… |
CVE-2024-8107 | Medium | 6.4 | 2024-10-01 | The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7.18 due t… |
CVE-2024-21531 | Medium | 5.3 | 2024-10-01 | All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of th… |
CVE-2024-21489 | High | 8.2 | 2024-10-01 | Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves… |
CVE-2024-0116 | Medium | 4.9 | 2024-10-01 | NVIDIA Triton Inference Server contains a vulnerability where a user may cause an out-of-bounds read issue by releasing a shared memory region while it is in u… |
CVE-2024-47295 | High | 8.1 | 2024-10-01 | Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the d… |
CVE-2024-9360 | High | 7.3 | 2024-10-01 | A vulnerability was found in code-projects Restaurant Reservation System 1.0. It has been classified as critical. This affects an unknown part of the file /upd… |
CVE-2024-8981 | High | 7.1 | 2024-10-01 | The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/cla… |
CVE-2024-9359 | High | 7.3 | 2024-10-01 | A vulnerability was found in code-projects Restaurant Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality o… |
CVE-2024-9358 | Medium | 5.3 | 2024-10-01 | A vulnerability has been found in ThingsBoard up to 3.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2024-47560 | High | 7.8 | 2024-10-01 | RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended processes may be ex… |
CVE-2024-47396 | Medium | 6.5 | 2024-10-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moveaddons Move Addons for Elementor move-addons allows S… |
CVE-2024-9194 | Critical | 9.8 | 2024-09-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Li… |
CVE-2024-45073 | Medium | 4.8 | 2024-09-30 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaS… |
CVE-2024-7675 | High | 7.8 | 2024-09-30 | A maliciously crafted DWF file, when parsed in w3dtk.dll through Autodesk Navisworks, can force a Use-After-Free. A malicious actor can leverage this vulnerabi… |
CVE-2024-7674 | High | 7.8 | 2024-09-30 | A maliciously crafted DWFX file, when parsed in dwfcore.dll through Autodesk Navisworks, can force a Heap-based Buffer Overflow. A malicious actor can leverage… |
CVE-2024-7673 | High | 7.8 | 2024-09-30 | A maliciously crafted DWFX file, when parsed in w3dtk.dll through Autodesk Navisworks, can force a Heap-based Buffer Overflow. A malicious actor can leverage t… |
CVE-2024-7672 | High | 7.8 | 2024-09-30 | A maliciously crafted DWF file, when parsed in dwfcore.dll through Autodesk Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious ac… |
CVE-2024-7671 | High | 7.8 | 2024-09-30 | A maliciously crafted DWFX file, when parsed in dwfcore.dll through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may… |
CVE-2024-7670 | High | 7.8 | 2024-09-30 | A maliciously crafted DWFX file, when parsed in w3dtk.dll through Autodesk Navisworks, can force an Out-of-Bounds Read. A malicious actor can leverage this vul… |
CVE-2024-28808 | Low | 2.7 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authenticated attacker to access reserved infor… |
CVE-2024-28807 | Medium | 6.5 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive information in the memory of the @CT desktop management application allows… |