2024 CVEs (page 160)
Page 160 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8632 | Medium | 6.5 | 2024-10-01 | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing cap… |
CVE-2024-8548 | High | 8.1 | 2024-10-01 | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capab… |
CVE-2024-7869 | High | 7.2 | 2024-10-01 | The 123.chat - Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.1 due to insufficient inp… |
CVE-2024-7434 | High | 8.8 | 2024-10-01 | The UltraPress theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.2 via deserialization of untrusted input. Th… |
CVE-2024-7433 | High | 8.8 | 2024-10-01 | The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of untrusted input. T… |
CVE-2024-7432 | High | 8.8 | 2024-10-01 | The Unseen Blog theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input. T… |
CVE-2024-8107 | Medium | 6.4 | 2024-10-01 | The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7.18 due t… |
CVE-2024-21531 | Medium | 5.3 | 2024-10-01 | All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the process variable of th… |
CVE-2024-21489 | High | 8.2 | 2024-10-01 | Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves… |
CVE-2024-0116 | Medium | 4.9 | 2024-10-01 | NVIDIA Triton Inference Server contains a vulnerability where a user may cause an out-of-bounds read issue by releasing a shared memory region while it is in u… |
CVE-2024-47295 | High | 8.1 | 2024-10-01 | Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the d… |
CVE-2024-9360 | High | 7.3 | 2024-10-01 | A vulnerability was found in code-projects Restaurant Reservation System 1.0. It has been classified as critical. This affects an unknown part of the file /upd… |
CVE-2024-8981 | High | 7.1 | 2024-10-01 | The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/cla… |
CVE-2024-9359 | High | 7.3 | 2024-10-01 | A vulnerability was found in code-projects Restaurant Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality o… |
CVE-2024-9358 | Medium | 5.3 | 2024-10-01 | A vulnerability has been found in ThingsBoard up to 3.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2024-47560 | High | 7.8 | 2024-10-01 | RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended processes may be ex… |
CVE-2024-47396 | Medium | 6.5 | 2024-10-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moveaddons Move Addons for Elementor move-addons allows S… |
CVE-2024-9194 | Critical | 9.8 | 2024-09-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Li… |
CVE-2024-45073 | Medium | 4.8 | 2024-09-30 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaS… |
CVE-2024-7675 | High | 7.8 | 2024-09-30 | A maliciously crafted DWF file, when parsed in w3dtk.dll through Autodesk Navisworks, can force a Use-After-Free. A malicious actor can leverage this vulnerabi… |
CVE-2024-7674 | High | 7.8 | 2024-09-30 | A maliciously crafted DWFX file, when parsed in dwfcore.dll through Autodesk Navisworks, can force a Heap-based Buffer Overflow. A malicious actor can leverage… |
CVE-2024-7673 | High | 7.8 | 2024-09-30 | A maliciously crafted DWFX file, when parsed in w3dtk.dll through Autodesk Navisworks, can force a Heap-based Buffer Overflow. A malicious actor can leverage t… |
CVE-2024-7672 | High | 7.8 | 2024-09-30 | A maliciously crafted DWF file, when parsed in dwfcore.dll through Autodesk Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious ac… |
CVE-2024-7671 | High | 7.8 | 2024-09-30 | A maliciously crafted DWFX file, when parsed in dwfcore.dll through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may… |
CVE-2024-7670 | High | 7.8 | 2024-09-30 | A maliciously crafted DWFX file, when parsed in w3dtk.dll through Autodesk Navisworks, can force an Out-of-Bounds Read. A malicious actor can leverage this vul… |
CVE-2024-28808 | Low | 2.7 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authenticated attacker to access reserved infor… |
CVE-2024-28807 | Medium | 6.5 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive information in the memory of the @CT desktop management application allows… |
CVE-2024-28813 | High | 8.4 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management application allow an attacker to activate remote… |
CVE-2024-28812 | High | 8.8 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service (on the local management network interface) with hardcoded credentials allows attack… |
CVE-2024-28811 | Low | 3.3 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. A web application allows a remote privileged attacker to execute applications contained in a specific OS… |
CVE-2024-28810 | Medium | 6.6 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Sensitive information inside diagnostic files (exported by the @CT application) allows an attacker to ach… |
CVE-2024-46635 | Medium | 5.9 | 2024-09-30 | An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information via a crafted paylo… |
CVE-2024-46511 | High | 7.5 | 2024-09-30 | LoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitrary code via the Lo… |
CVE-2024-42017 | Critical | 10.0 | 2024-09-30 | An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenario, if the applicat… |
CVE-2024-35495 | Medium | 4.3 | 2024-09-30 | An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 Build 220930 Rel.143947 allows attackers… |
CVE-2024-28809 | High | 8.8 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers to access various ap… |
CVE-2024-9158 | High | 8.4 | 2024-09-30 | A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into… |
CVE-2024-47536 | Medium | 5.4 | 2024-09-30 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their na… |
CVE-2024-46549 | High | 7.6 | 2024-09-30 | An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating devices owned by o… |
CVE-2024-46548 | Medium | 6.3 | 2024-09-30 | TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eavesdrop on communications and access sens… |
CVE-2024-46540 | Medium | 6.3 | 2024-09-30 | A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and sel… |
CVE-2024-45993 | Medium | 6.5 | 2024-09-30 | Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb. |
CVE-2024-47532 | Medium | 6.5 | 2024-09-30 | RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) informa… |
CVE-2024-47531 | Medium | 4.6 | 2024-09-30 | Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extension and make users do… |
CVE-2024-47530 | Medium | 5.4 | 2024-09-30 | Scout is a web-based visualizer for VCF-files. Open redirect vulnerability allows performing phishing attacks on users by redirecting them to malicious page. /… |
CVE-2024-47178 | Medium | 5.3 | 2024-09-30 | basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timi… |
CVE-2024-47067 | Medium | 6.1 | 2024-09-30 | AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link… |
CVE-2024-46869 | High | 7.8 | 2024-09-30 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: Allocate memory for driver private data Fix driver not allocatin… |
CVE-2024-46510 | High | 7.6 | 2024-09-30 | ESAFENET CDG v5 was discovered to contain a SQL injection vulnerability via the id parameter in the NavigationAjax interface |
CVE-2024-46475 | Medium | 4.8 | 2024-09-30 | A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows attackers to execute arbitrary code in th… |
CVE-2024-47172 | Medium | 5.4 | 2024-09-30 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve cert… |
CVE-2024-47064 | Medium | 6.1 | 2024-09-30 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a logged-in CVAT user in… |
CVE-2024-47063 | Medium | 6.1 | 2024-09-30 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If a malicious CVAT user with permissions to eith… |
CVE-2024-46313 | High | 8.0 | 2024-09-30 | TP-Link WR941ND V6 has a stack overflow vulnerability in the ssid parameter in /userRpm/popupSiteSurveyRpm.htm. |
CVE-2024-46293 | Critical | 9.8 | 2024-09-30 | Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control. There is a lack of authorization checks for admin operations. Spe… |
CVE-2024-46280 | High | 8.8 | 2024-09-30 | PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improper Access Control. The TELNET service is enabled with weak credentials for a root-level account, wi… |
CVE-2024-45792 | Medium | 6.5 | 2024-09-30 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information a… |
CVE-2024-6051 | | 2024-09-30 | Cross Application Scripting vulnerability in Vercom S.A. Redlink SDK in specific situations allows local code injection and to manipulate the view of a vulnera… | |
CVE-2024-47641 | Medium | 6.5 | 2024-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muhammad Shakeel Confetti Fall Animation confetti-fall-an… |
CVE-2024-45920 | Medium | 5.4 | 2024-09-30 | A Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts into the application. This issue arises… |
CVE-2024-45772 | Medium | 5.1 | 2024-09-30 | Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. T… |
CVE-2024-9329 | Medium | 6.1 | 2024-09-30 | In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpo… |
CVE-2024-8459 | High | 7.2 | 2024-09-30 | Certain switch models from PLANET Technology store SNMPv3 users' passwords in plaintext within the configuration files, allowing remote attackers with administ… |
CVE-2024-8458 | High | 8.8 | 2024-09-30 | Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker… |
CVE-2024-8457 | Medium | 4.8 | 2024-09-30 | Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users wi… |
CVE-2024-8456 | Critical | 9.8 | 2024-09-30 | Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attacker… |
CVE-2024-8455 | High | 8.1 | 2024-09-30 | The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communicat… |
CVE-2024-8454 | Medium | 5.3 | 2024-09-30 | The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl… |
CVE-2024-8453 | Medium | 4.9 | 2024-09-30 | Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted. Remote attackers with administrator… |
CVE-2024-6394 | High | 7.5 | 2024-09-30 | A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the `ser… |
CVE-2024-45200 | Medium | 6.3 | 2024-09-30 | In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-based buffer overflow up… |
CVE-2024-42496 | Low | 2.4 | 2024-09-30 | Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. If this vulnerability is exploited, an attacker w… |
CVE-2024-41999 | Medium | 6.8 | 2024-09-30 | Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability. If this vulnerability is exploited, an attacker with physica… |
CVE-2024-8452 | High | 7.5 | 2024-09-30 | Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowi… |
CVE-2024-8451 | High | 7.5 | 2024-09-30 | Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorize… |
CVE-2024-8450 | High | 8.6 | 2024-09-30 | Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowing unauthorized remote attackers to use this commu… |
CVE-2024-8449 | Medium | 6.8 | 2024-09-30 | Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to con… |
CVE-2024-8448 | High | 8.8 | 2024-09-30 | Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers with regular privil… |
CVE-2024-8536 | Medium | 5.4 | 2024-09-30 | The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where t… |
CVE-2024-8379 | High | 7.2 | 2024-09-30 | The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a S… |
CVE-2024-8283 | Medium | 4.8 | 2024-09-30 | The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-8239 | Medium | 5.4 | 2024-09-30 | The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages… |
CVE-2024-3635 | Medium | 4.8 | 2024-09-30 | The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and… |
CVE-2024-9328 | Medium | 6.3 | 2024-09-29 | A vulnerability was found in SourceCodester Advocate Office Management System 1.0. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2024-9327 | Medium | 6.3 | 2024-09-29 | A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot… |
CVE-2024-9326 | High | 7.3 | 2024-09-29 | A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /shopping/admin/… |
CVE-2024-9325 | High | 7.8 | 2024-09-29 | A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\Program Files (x86)\Int… |
CVE-2024-9324 | Medium | 6.3 | 2024-09-29 | A vulnerability was found in Intelbras InControl up to 2.21.57. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-9323 | Low | 3.5 | 2024-09-29 | A vulnerability was found in SourceCodester Inventory Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown… |
CVE-2024-9322 | Medium | 6.3 | 2024-09-29 | A vulnerability was found in code-projects Supply Chain Management 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/… |
CVE-2024-9321 | Medium | 5.3 | 2024-09-29 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2024-9320 | Low | 3.5 | 2024-09-29 | A vulnerability has been found in SourceCodester Online Timesheet App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /e… |
CVE-2024-9319 | Medium | 6.3 | 2024-09-29 | A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the file /endpoint/del… |
CVE-2024-9318 | Medium | 6.3 | 2024-09-28 | A vulnerability, which was classified as critical, has been found in SourceCodester Advocate Office Management System 1.0. Affected by this issue is some unkno… |
CVE-2024-9317 | Medium | 6.3 | 2024-09-28 | A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_category of t… |
CVE-2024-9316 | Medium | 6.3 | 2024-09-28 | A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of the file /admin/blo… |
CVE-2024-9315 | Medium | 6.3 | 2024-09-28 | A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown p… |
CVE-2024-9300 | Medium | 4.3 | 2024-09-28 | A vulnerability classified as problematic was found in SourceCodester Online Railway Reservation System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2024-9299 | Low | 3.5 | 2024-09-28 | A vulnerability classified as problematic has been found in SourceCodester Online Railway Reservation System 1.0. This affects an unknown part of the file /?pa… |
CVE-2024-9298 | Medium | 4.3 | 2024-09-28 | A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown fun… |