2024 CVEs (page 164)
Page 164 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-44678 | High | 8.0 | 2024-09-25 | Gigastone TR1 Travel Router R101 v1.0.2 is vulnerable to Command Injection. This allows an authenticated attacker to execute arbitrary commands on the device b… |
CVE-2024-41708 | High | 7.5 | 2024-09-25 | An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String() function in the s… |
CVE-2024-41445 | Medium | 6.5 | 2024-09-25 | Library MDF (mdflib) v2.1 is vulnerable to a heap-based buffer overread via a crafted mdf4 file is parsed using the ReadData function |
CVE-2024-20510 | Medium | 4.7 | 2024-09-25 | A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthenticated, adjacent atta… |
CVE-2024-20508 | Medium | 5.8 | 2024-09-25 | A vulnerability in Cisco Unified Threat Defense (UTD) Snort Intrusion Prevention System (IPS) Engine for Cisco IOS XE Software could allow an unauthenticated… |
CVE-2024-20496 | Medium | 6.1 | 2024-09-25 | A vulnerability in the UDP packet validation code of Cisco SD-WAN vEdge Software could allow an unauthenticated, adjacent attacker to cause a denial of service… |
CVE-2024-20480 | High | 8.6 | 2024-09-25 | A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edge nodes could allow an unauthenticated… |
CVE-2024-20475 | Medium | 6.4 | 2024-09-25 | A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote att… |
CVE-2024-20467 | High | 8.6 | 2024-09-25 | A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cau… |
CVE-2024-20465 | Medium | 5.8 | 2024-09-25 | A vulnerability in the access control list (ACL) programming of Cisco IOS Software running on Cisco Industrial Ethernet 4000, 4010, and 5000 Series Switches co… |
CVE-2024-20464 | High | 8.6 | 2024-09-25 | A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial… |
CVE-2024-20455 | High | 8.6 | 2024-09-25 | A vulnerability in the process that classifies traffic that is going to the Unified Threat Defense (UTD) component of Cisco IOS XE Software in controller mode… |
CVE-2024-20437 | High | 8.1 | 2024-09-25 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a cross-site request… |
CVE-2024-20436 | High | 8.6 | 2024-09-25 | A vulnerability in the HTTP Server feature of Cisco IOS XE Software when the Telephony Service feature is enabled could allow an unauthenticated, remote attack… |
CVE-2024-20434 | Medium | 4.3 | 2024-09-25 | A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the control plane of… |
CVE-2024-20433 | High | 8.6 | 2024-09-25 | A vulnerability in the Resource Reservation Protocol (RSVP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote atta… |
CVE-2024-20414 | Medium | 6.5 | 2024-09-25 | A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site r… |
CVE-2024-20350 | High | 7.5 | 2024-09-25 | A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to impersonate a Cisco C… |
CVE-2024-7421 | Medium | 5.5 | 2024-09-25 | An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain se… |
CVE-2024-47078 | High | 8.1 | 2024-09-25 | Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQT… |
CVE-2024-46600 | Medium | 4.7 | 2024-09-25 | dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/doAdminAction.php?act=delCate&id=31 |
CVE-2024-46485 | Medium | 6.3 | 2024-09-25 | dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=addCate |
CVE-2024-44825 | High | 7.5 | 2024-09-25 | Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitrary files unto the… |
CVE-2024-46461 | High | 8.0 | 2024-09-25 | VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stre… |
CVE-2024-43990 | Medium | 5.3 | 2024-09-25 | Insertion of Sensitive Information into Log File vulnerability in StylemixThemes Masterstudy LMS Starter.This issue affects Masterstudy LMS Starter: from n/a t… |
CVE-2024-43959 | High | 7.1 | 2024-09-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Testimonials super-testimonial allows Reflect… |
CVE-2024-43237 | Medium | 5.3 | 2024-09-25 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Steve Burge WordPress Tag Cloud Plugin – Tag Groups tag-groups.This issue affects W… |
CVE-2024-30128 | High | 8.6 | 2024-09-25 | HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address. This may… |
CVE-2024-22893 | High | 7.5 | 2024-09-25 | OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain informati… |
CVE-2024-22892 | High | 7.5 | 2024-09-25 | OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords. |
CVE-2024-8316 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-7679 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink… |
CVE-2024-7576 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-7575 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elem… |
CVE-2024-6512 | Medium | 6.5 | 2024-09-25 | Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to ap… |
CVE-2024-45613 | Medium | 6.1 | 2024-09-25 | CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in t… |
CVE-2024-8546 | Medium | 6.4 | 2024-09-25 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video widget in all versions up to, and inc… |
CVE-2024-4657 | | 2024-09-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software BAP Automation allows Stored XSS. … | |
CVE-2024-6594 | High | 7.5 | 2024-09-25 | Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malforme… |
CVE-2024-6593 | Critical | 9.1 | 2024-09-25 | Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to exec… |
CVE-2024-6592 | Critical | 9.1 | 2024-09-25 | An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and… |
CVE-2024-8858 | Medium | 6.4 | 2024-09-25 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘piechart_settings’ parameter in all versions up to… |
CVE-2024-7481 | High | 8.8 | 2024-09-25 | Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamViewer Remote Clients… |
CVE-2024-7479 | High | 8.8 | 2024-09-25 | Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer Remote Clients prio… |
CVE-2024-45817 | High | 7.3 | 2024-09-25 | In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to re… |
CVE-2024-31146 | High | 7.5 | 2024-09-25 | When multiple devices share resources and one of them is to be passed through to a guest, security of the entire system and of respective guests individually c… |
CVE-2024-31145 | High | 7.5 | 2024-09-25 | Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapp… |
CVE-2024-9169 | Medium | 5.5 | 2024-09-25 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin debug settings in all versions up to, and including, 6.4.1 due… |
CVE-2024-8175 | High | 7.5 | 2024-09-25 | An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS. |
CVE-2024-47303 | Medium | 6.5 | 2024-09-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Elementor addons-for-element… |
CVE-2024-40761 | Medium | 5.3 | 2024-09-25 | Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to acce… |
CVE-2024-23454 | Medium | 6.2 | 2024-09-25 | Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local u… |
CVE-2024-8910 | Medium | 4.3 | 2024-09-25 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.5 vi… |
CVE-2024-8678 | Medium | 5.3 | 2024-09-25 | The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wc/v3/rev… |
CVE-2024-8290 | High | 8.8 | 2024-09-25 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2024-3866 | Medium | 4.7 | 2024-09-25 | The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, an… |
CVE-2024-8658 | Medium | 5.3 | 2024-09-25 | The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credi… |
CVE-2024-7892 | Medium | 4.3 | 2024-09-25 | The adstxt Plugin WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2024-7878 | Medium | 4.8 | 2024-09-25 | The WP ULike WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-6845 | Medium | 5.3 | 2024-09-25 | The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrie… |
CVE-2024-8668 | Medium | 6.4 | 2024-09-25 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Sto… |
CVE-2024-8275 | Critical | 9.8 | 2024-09-25 | The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up… |
CVE-2024-8516 | Medium | 4.3 | 2024-09-25 | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render() fun… |
CVE-2024-8515 | Medium | 6.4 | 2024-09-25 | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like 'TF E Slider Widget', 'TF Video… |
CVE-2024-8514 | Critical | 9.1 | 2024-09-25 | The Prisna GWT – Google Website Translator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.11 via deserial… |
CVE-2024-7385 | Critical | 9.1 | 2024-09-25 | The WordPress Simple HTML Sitemap plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.1 due to i… |
CVE-2024-9073 | Medium | 6.4 | 2024-09-25 | The GutenGeek Free Gutenberg Blocks for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to… |
CVE-2024-9069 | Medium | 6.4 | 2024-09-25 | The Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) plugin for WordPress is vulnerab… |
CVE-2024-9068 | Medium | 6.4 | 2024-09-25 | The OneElements – Best Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inclu… |
CVE-2024-9028 | Medium | 6.4 | 2024-09-25 | The WP GPX Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sgpx' shortcode in all versions up to, and including, 1.7.0… |
CVE-2024-9027 | Medium | 6.4 | 2024-09-25 | The WPZOOM Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including… |
CVE-2024-9024 | Medium | 6.4 | 2024-09-25 | The Material Design Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mdi-icon shortcode in all versions up to, and incl… |
CVE-2024-8741 | Medium | 6.1 | 2024-09-25 | The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropr… |
CVE-2024-8713 | Medium | 6.1 | 2024-09-25 | The Kodex Posts likes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the… |
CVE-2024-8621 | Critical | 9.9 | 2024-09-25 | The Daily Prayer Time plugin for WordPress is vulnerable to SQL Injection via the 'max_word' attribute of the 'quran_verse' shortcode in all versions up to, an… |
CVE-2024-8549 | Medium | 6.1 | 2024-09-25 | The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appro… |
CVE-2024-8485 | Critical | 9.8 | 2024-09-25 | The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the… |
CVE-2024-8484 | High | 7.5 | 2024-09-25 | The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments… |
CVE-2024-8483 | Medium | 4.3 | 2024-09-25 | The MAS Static Content plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.8 via the static_content() function… |
CVE-2024-8481 | High | 7.3 | 2024-09-25 | The The Special Text Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.2.4. This is due to the… |
CVE-2024-8476 | Medium | 4.3 | 2024-09-25 | The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or… |
CVE-2024-8434 | Medium | 4.3 | 2024-09-25 | The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several func… |
CVE-2024-8350 | Low | 2.7 | 2024-09-25 | The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm_management/v1/add_… |
CVE-2024-8349 | High | 7.2 | 2024-09-25 | The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the p… |
CVE-2024-7617 | High | 7.2 | 2024-09-25 | The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 form fields in all versions up to, and includi… |
CVE-2024-7491 | Medium | 5.3 | 2024-09-25 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl… |
CVE-2024-7426 | Medium | 5.3 | 2024-09-25 | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure in all versions up… |
CVE-2024-7386 | Medium | 4.3 | 2024-09-25 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5… |
CVE-2024-6590 | Medium | 6.3 | 2024-09-25 | The Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. plugin for… |
CVE-2024-9148 | Critical | 9.6 | 2024-09-25 | Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0. |
CVE-2024-9142 | Critical | 9.8 | 2024-09-25 | External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipul… |
CVE-2024-9141 | Medium | 5.4 | 2024-09-25 | Cross-Site Scripting (XSS) vulnerability in the Oct8ne system. This flaw could allow an attacker to embed harmful JavaScript code into the body of a chat messa… |
CVE-2024-9123 | High | 8.8 | 2024-09-25 | Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (C… |
CVE-2024-9122 | High | 8.8 | 2024-09-25 | Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromiu… |
CVE-2024-9121 | High | 8.8 | 2024-09-25 | Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds memory access via a c… |
CVE-2024-9120 | High | 8.8 | 2024-09-25 | Use after free in Dawn in Google Chrome on Windows prior to 129.0.6668.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2024-8942 | Medium | 6.3 | 2024-09-25 | Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting (XSS), due to the lack of input validation, affecting the “id_form_msg_titl… |
CVE-2024-8941 | High | 7.5 | 2024-09-25 | Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nm_edit_php_edit.php (in the “subpage” parameter), which allows unauthe… |
CVE-2024-8940 | Critical | 10.0 | 2024-09-25 | Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery… |
CVE-2024-8919 | Medium | 6.4 | 2024-09-25 | The Confetti Fall Animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'confetti-fall-animation' shortcode in all versi… |