2024 CVEs (page 172)
Page 172 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1578 | Medium | 5.3 | 2024-09-16 | The MiCard PLUS Ci and MiCard PLUS BLE reader products developed by rf IDEAS and rebranded by NT-ware have a firmware fault that may result in characters rando… |
CVE-2024-8780 | Medium | 6.5 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with regular privileges to o… |
CVE-2024-8779 | High | 8.8 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privil… |
CVE-2024-8778 | Medium | 6.5 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arb… |
CVE-2024-8777 | High | 7.5 | 2024-09-16 | OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system configurations. If LDAP… |
CVE-2024-8776 | Medium | 6.1 | 2024-09-16 | SmartRobot from INTUMIT does not properly validate a specific page parameter, allowing unautheticated remote attackers to inject JavaScript code to the paramet… |
CVE-2024-46958 | Critical | 9.1 | 2024-09-16 | In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. Thi… |
CVE-2024-8880 | Medium | 5.6 | 2024-09-16 | A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=ma… |
CVE-2024-46943 | High | 7.5 | 2024-09-15 | An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate… |
CVE-2024-46942 | Medium | 6.5 | 2024-09-15 | In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries in an OpenDaylight… |
CVE-2024-8876 | Medium | 4.3 | 2024-09-15 | A vulnerability, which was classified as problematic, has been found in xiaohe4966 TpMeCMS up to 1.3.3.1. Affected by this issue is some unknown functionality… |
CVE-2024-8875 | Medium | 5.4 | 2024-09-15 | A vulnerability classified as critical was found in vedees wcms up to 0.3.2. Affected by this vulnerability is an unknown functionality of the file /wex/finder… |
CVE-2024-46938 | High | 7.5 | 2024-09-15 | An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Re… |
CVE-2024-46918 | Medium | 4.9 | 2024-09-15 | app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in… |
CVE-2024-8869 | Medium | 5.0 | 2024-09-15 | A vulnerability classified as critical has been found in TOTOLINK A720R 4.1.5. Affected is the function exportOvpn. The manipulation leads to os command inject… |
CVE-2024-44059 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapp… |
CVE-2024-44058 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Parabola allows Stored XSS.This is… |
CVE-2024-44057 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Nirvana allows Stored XSS.This iss… |
CVE-2024-44056 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Mantra allows Stored XSS.This issu… |
CVE-2024-44054 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Fluida allows Stored XSS.This issu… |
CVE-2024-44053 | High | 7.1 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mohammad Arif Opor Ayam allows Reflected XSS.This… |
CVE-2024-45460 | Medium | 5.9 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manu225 Flipping Cards flipping-cards allows Stored XSS.T… |
CVE-2024-45459 | High | 7.1 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-pr… |
CVE-2024-45458 | High | 7.1 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Ref… |
CVE-2024-45457 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Sto… |
CVE-2024-45456 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This… |
CVE-2024-45455 | Medium | 5.9 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This… |
CVE-2024-44063 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Ha… |
CVE-2024-44062 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Sto… |
CVE-2024-44060 | High | 7.1 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jennifer Hall Filmix allows Reflected XSS.This iss… |
CVE-2024-8868 | High | 7.3 | 2024-09-15 | A vulnerability was found in code-projects Crud Operation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file sav… |
CVE-2024-8867 | Low | 3.5 | 2024-09-15 | A vulnerability was found in Perfex CRM 3.1.6. It has been declared as problematic. This vulnerability affects unknown code of the file application/controllers… |
CVE-2024-8866 | Medium | 4.3 | 2024-09-15 | A vulnerability was found in AutoCMS 5.4. It has been classified as problematic. This affects an unknown part of the file /admin/robot.php. The manipulation of… |
CVE-2024-8865 | Low | 3.5 | 2024-09-15 | A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\se… |
CVE-2024-8864 | Medium | 5.5 | 2024-09-15 | A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the… |
CVE-2024-8863 | Low | 3.5 | 2024-09-14 | A vulnerability, which was classified as problematic, was found in aimhubio aim up to 3.24. Affected is the function dangerouslySetInnerHTML of the file textbo… |
CVE-2024-8862 | High | 7.3 | 2024-09-14 | A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale… |
CVE-2024-6482 | High | 8.8 | 2024-09-14 | The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of v… |
CVE-2024-8797 | Medium | 6.1 | 2024-09-14 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_ar… |
CVE-2024-8724 | Medium | 6.1 | 2024-09-14 | The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg withou… |
CVE-2024-8669 | Critical | 9.1 | 2024-09-14 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter passed to the backuply_wp_clo… |
CVE-2024-8479 | High | 7.3 | 2024-09-14 | The The Simple Spoiler plugin for WordPress is vulnerable to arbitrary shortcode execution in versions 1.2 to 1.3. This is due to the plugin adding the filter… |
CVE-2024-8246 | High | 8.8 | 2024-09-14 | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to pr… |
CVE-2024-8039 | Critical | 9.8 | 2024-09-14 | Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks. |
CVE-2024-8775 | Medium | 5.5 | 2024-09-14 | A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occ… |
CVE-2024-8271 | High | 7.3 | 2024-09-14 | The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-6259 | High | 7.6 | 2024-09-13 | BT: HCI: adv_ext_report Improper discarding in adv_ext_report |
CVE-2024-44096 | Medium | 4.4 | 2024-09-13 | there is a possible arbitrary read due to an insecure default value. This could lead to local information disclosure with System execution privileges needed. U… |
CVE-2024-44095 | High | 7.8 | 2024-09-13 | In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possible corrupt memory due to a logic error in the code. This could lead to local escalation of privile… |
CVE-2024-44094 | High | 7.8 | 2024-09-13 | In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possible memory corruption due to improper input validation. This could lead to local escalation of priv… |
CVE-2024-44093 | High | 7.8 | 2024-09-13 | In ppmp_unprotect_buf of drm/code/drm_fw.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of priv… |
CVE-2024-44092 | High | 7.8 | 2024-09-13 | There is a possible LCS signing enforcement missing due to test/debugging code left in a production build. This could lead to local escalation of privilege wi… |
CVE-2024-29779 | High | 7.8 | 2024-09-13 | there is a possible escalation of privilege due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privile… |
CVE-2024-6137 | High | 7.6 | 2024-09-13 | BT: Classic: SDP OOB access in get_att_search_list |
CVE-2024-6135 | High | 7.6 | 2024-09-13 | BT:Classic: Multiple missing buf length checks |
CVE-2024-5931 | Medium | 6.3 | 2024-09-13 | BT: Unchecked user input in bap_broadcast_assistant |
CVE-2024-44430 | Critical | 9.8 | 2024-09-13 | SQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensitive information via… |
CVE-2024-8784 | Medium | 6.3 | 2024-09-13 | A vulnerability classified as critical was found in QDocs Smart School Management System 7.0.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-8783 | Low | 3.5 | 2024-09-13 | A vulnerability classified as problematic has been found in OpenTibiaBR MyAAC up to 0.8.16. Affected is an unknown function of the file system/pages/forum/new_… |
CVE-2024-6258 | Medium | 6.8 | 2024-09-13 | BT: Missing length checks of net_buf in rfcomm_handle_data |
CVE-2024-5754 | High | 8.2 | 2024-09-13 | BT: Encryption procedure host vulnerability |
CVE-2024-8782 | Medium | 6.3 | 2024-09-13 | A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/template/edit. The m… |
CVE-2024-8281 | High | 7.2 | 2024-09-13 | An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection throu… |
CVE-2024-8280 | High | 7.2 | 2024-09-13 | An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or ca… |
CVE-2024-8279 | High | 7.2 | 2024-09-13 | A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injecti… |
CVE-2024-8278 | High | 7.2 | 2024-09-13 | A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injecti… |
CVE-2024-8059 | Medium | 4.3 | 2024-09-13 | IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters. |
CVE-2024-7756 | Medium | 6.8 | 2024-09-13 | A potential vulnerability was reported in the ThinkPad L390 Yoga and 10w Notebook that could allow a local attacker to escalate privileges by accessing an embe… |
CVE-2024-4550 | Medium | 6.7 | 2024-09-13 | A potential buffer overflow vulnerability was reported in some Lenovo ThinkSystem and ThinkStation products that could allow a local attacker with elevated pri… |
CVE-2024-45105 | Medium | 6.7 | 2024-09-13 | An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local at… |
CVE-2024-45104 | Medium | 6.3 | 2024-09-13 | A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially cr… |
CVE-2024-45103 | Medium | 4.3 | 2024-09-13 | A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges. |
CVE-2024-45101 | Medium | 6.8 | 2024-09-13 | A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA… |
CVE-2024-3100 | Medium | 6.7 | 2024-09-13 | A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated privileges to execute a… |
CVE-2024-39926 | Medium | 5.4 | 2024-09-13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS) or, due to the default CSP, HTML injection vulnerabi… |
CVE-2024-39925 | Medium | 6.5 | 2024-09-13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the… |
CVE-2024-39924 | High | 8.8 | 2024-09-13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of t… |
CVE-2024-6867 | Medium | 6.5 | 2024-09-13 | An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify tha… |
CVE-2024-6862 | High | 8.1 | 2024-09-13 | A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows a… |
CVE-2024-6582 | Medium | 4.3 | 2024-09-13 | A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Id… |
CVE-2024-6087 | Medium | 6.5 | 2024-09-13 | An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main branch. The vulnerability allows an attacker to… |
CVE-2024-45368 | High | 8.8 | 2024-09-13 | The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed ano… |
CVE-2024-43099 | High | 8.8 | 2024-09-13 | The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such s… |
CVE-2024-31416 | Medium | 5.6 | 2024-09-13 | The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc. Some of th… |
CVE-2024-31415 | Medium | 6.3 | 2024-09-13 | The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user manageme… |
CVE-2024-31414 | Medium | 6.7 | 2024-09-13 | The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton… |
CVE-2024-6587 | High | 7.5 | 2024-09-13 | A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` paramet… |
CVE-2024-44798 | Medium | 4.8 | 2024-09-13 | phpgurukul Bus Pass Management System 1.0 is vulnerable to Cross-site scripting (XSS) in /admin/pass-bwdates-reports-details.php via fromdate and todate parame… |
CVE-2024-44685 | Medium | 5.0 | 2024-09-13 | Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including passwords, is exposed in cl… |
CVE-2024-42025 | High | 7.8 | 2024-09-13 | A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a mal… |
CVE-2024-8747 | Medium | 6.4 | 2024-09-13 | The Email Obfuscate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email-obfuscate' shortcode in all versions up… |
CVE-2024-8737 | Medium | 6.1 | 2024-09-13 | The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping o… |
CVE-2024-8734 | Medium | 6.1 | 2024-09-13 | The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on t… |
CVE-2024-8732 | Medium | 6.1 | 2024-09-13 | The Roles & Capabilities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on t… |
CVE-2024-8731 | Medium | 6.1 | 2024-09-13 | The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in a… |
CVE-2024-8730 | Medium | 6.1 | 2024-09-13 | The Exit Notifier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL… |
CVE-2024-8714 | Medium | 6.1 | 2024-09-13 | The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg wi… |
CVE-2024-8269 | High | 7.3 | 2024-09-13 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and… |
CVE-2024-8242 | Medium | 4.3 | 2024-09-13 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation… |
CVE-2024-7423 | High | 8.8 | 2024-09-13 | The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect no… |