2024 CVEs (page 172)
Page 172 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-44063 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Ha… |
CVE-2024-44062 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Sto… |
CVE-2024-44060 | High | 7.1 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jennifer Hall Filmix allows Reflected XSS.This iss… |
CVE-2024-8868 | High | 7.3 | 2024-09-15 | A vulnerability was found in code-projects Crud Operation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file sav… |
CVE-2024-8867 | Low | 3.5 | 2024-09-15 | A vulnerability was found in Perfex CRM 3.1.6. It has been declared as problematic. This vulnerability affects unknown code of the file application/controllers… |
CVE-2024-8866 | Medium | 4.3 | 2024-09-15 | A vulnerability was found in AutoCMS 5.4. It has been classified as problematic. This affects an unknown part of the file /admin/robot.php. The manipulation of… |
CVE-2024-8865 | Low | 3.5 | 2024-09-15 | A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\se… |
CVE-2024-8864 | Medium | 5.5 | 2024-09-15 | A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the… |
CVE-2024-8863 | Low | 3.5 | 2024-09-14 | A vulnerability, which was classified as problematic, was found in aimhubio aim up to 3.24. Affected is the function dangerouslySetInnerHTML of the file textbo… |
CVE-2024-8862 | High | 7.3 | 2024-09-14 | A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale… |
CVE-2024-6482 | High | 8.8 | 2024-09-14 | The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of v… |
CVE-2024-8797 | Medium | 6.1 | 2024-09-14 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_ar… |
CVE-2024-8724 | Medium | 6.1 | 2024-09-14 | The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg withou… |
CVE-2024-8669 | Critical | 9.1 | 2024-09-14 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter passed to the backuply_wp_clo… |
CVE-2024-8479 | High | 7.3 | 2024-09-14 | The The Simple Spoiler plugin for WordPress is vulnerable to arbitrary shortcode execution in versions 1.2 to 1.3. This is due to the plugin adding the filter… |
CVE-2024-8246 | High | 8.8 | 2024-09-14 | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to pr… |
CVE-2024-8039 | Critical | 9.8 | 2024-09-14 | Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account takeover risks. |
CVE-2024-8775 | Medium | 5.5 | 2024-09-14 | A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occ… |
CVE-2024-8271 | High | 7.3 | 2024-09-14 | The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-6259 | High | 7.6 | 2024-09-13 | BT: HCI: adv_ext_report Improper discarding in adv_ext_report |
CVE-2024-44096 | Medium | 4.4 | 2024-09-13 | there is a possible arbitrary read due to an insecure default value. This could lead to local information disclosure with System execution privileges needed. U… |
CVE-2024-44095 | High | 7.8 | 2024-09-13 | In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possible corrupt memory due to a logic error in the code. This could lead to local escalation of privile… |
CVE-2024-44094 | High | 7.8 | 2024-09-13 | In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possible memory corruption due to improper input validation. This could lead to local escalation of priv… |
CVE-2024-44093 | High | 7.8 | 2024-09-13 | In ppmp_unprotect_buf of drm/code/drm_fw.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of priv… |
CVE-2024-44092 | High | 7.8 | 2024-09-13 | There is a possible LCS signing enforcement missing due to test/debugging code left in a production build. This could lead to local escalation of privilege wi… |
CVE-2024-29779 | High | 7.8 | 2024-09-13 | there is a possible escalation of privilege due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privile… |
CVE-2024-6137 | High | 7.6 | 2024-09-13 | BT: Classic: SDP OOB access in get_att_search_list |
CVE-2024-6135 | High | 7.6 | 2024-09-13 | BT:Classic: Multiple missing buf length checks |
CVE-2024-5931 | Medium | 6.3 | 2024-09-13 | BT: Unchecked user input in bap_broadcast_assistant |
CVE-2024-44430 | Critical | 9.8 | 2024-09-13 | SQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensitive information via… |
CVE-2024-8784 | Medium | 6.3 | 2024-09-13 | A vulnerability classified as critical was found in QDocs Smart School Management System 7.0.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-8783 | Low | 3.5 | 2024-09-13 | A vulnerability classified as problematic has been found in OpenTibiaBR MyAAC up to 0.8.16. Affected is an unknown function of the file system/pages/forum/new_… |
CVE-2024-6258 | Medium | 6.8 | 2024-09-13 | BT: Missing length checks of net_buf in rfcomm_handle_data |
CVE-2024-5754 | High | 8.2 | 2024-09-13 | BT: Encryption procedure host vulnerability |
CVE-2024-8782 | Medium | 6.3 | 2024-09-13 | A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/template/edit. The m… |
CVE-2024-8281 | High | 7.2 | 2024-09-13 | An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection throu… |
CVE-2024-8280 | High | 7.2 | 2024-09-13 | An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or ca… |
CVE-2024-8279 | High | 7.2 | 2024-09-13 | A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injecti… |
CVE-2024-8278 | High | 7.2 | 2024-09-13 | A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injecti… |
CVE-2024-8059 | Medium | 4.3 | 2024-09-13 | IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters. |
CVE-2024-7756 | Medium | 6.8 | 2024-09-13 | A potential vulnerability was reported in the ThinkPad L390 Yoga and 10w Notebook that could allow a local attacker to escalate privileges by accessing an embe… |
CVE-2024-4550 | Medium | 6.7 | 2024-09-13 | A potential buffer overflow vulnerability was reported in some Lenovo ThinkSystem and ThinkStation products that could allow a local attacker with elevated pri… |
CVE-2024-45105 | Medium | 6.7 | 2024-09-13 | An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local at… |
CVE-2024-45104 | Medium | 6.3 | 2024-09-13 | A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially cr… |
CVE-2024-45103 | Medium | 4.3 | 2024-09-13 | A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges. |
CVE-2024-45101 | Medium | 6.8 | 2024-09-13 | A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA… |
CVE-2024-3100 | Medium | 6.7 | 2024-09-13 | A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated privileges to execute a… |
CVE-2024-39926 | Medium | 5.4 | 2024-09-13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS) or, due to the default CSP, HTML injection vulnerabi… |
CVE-2024-39925 | Medium | 6.5 | 2024-09-13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the… |
CVE-2024-39924 | High | 8.8 | 2024-09-13 | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of t… |
CVE-2024-6867 | Medium | 6.5 | 2024-09-13 | An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify tha… |
CVE-2024-6862 | High | 8.1 | 2024-09-13 | A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows a… |
CVE-2024-6582 | Medium | 4.3 | 2024-09-13 | A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Id… |
CVE-2024-6087 | Medium | 6.5 | 2024-09-13 | An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main branch. The vulnerability allows an attacker to… |
CVE-2024-45368 | High | 8.8 | 2024-09-13 | The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed ano… |
CVE-2024-43099 | High | 8.8 | 2024-09-13 | The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such s… |
CVE-2024-31416 | Medium | 5.6 | 2024-09-13 | The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc. Some of th… |
CVE-2024-31415 | Medium | 6.3 | 2024-09-13 | The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user manageme… |
CVE-2024-31414 | Medium | 6.7 | 2024-09-13 | The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton… |
CVE-2024-6587 | High | 7.5 | 2024-09-13 | A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` paramet… |
CVE-2024-44798 | Medium | 4.8 | 2024-09-13 | phpgurukul Bus Pass Management System 1.0 is vulnerable to Cross-site scripting (XSS) in /admin/pass-bwdates-reports-details.php via fromdate and todate parame… |
CVE-2024-44685 | Medium | 5.0 | 2024-09-13 | Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including passwords, is exposed in cl… |
CVE-2024-42025 | High | 7.8 | 2024-09-13 | A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a mal… |
CVE-2024-8747 | Medium | 6.4 | 2024-09-13 | The Email Obfuscate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email-obfuscate' shortcode in all versions up… |
CVE-2024-8737 | Medium | 6.1 | 2024-09-13 | The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping o… |
CVE-2024-8734 | Medium | 6.1 | 2024-09-13 | The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on t… |
CVE-2024-8732 | Medium | 6.1 | 2024-09-13 | The Roles & Capabilities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on t… |
CVE-2024-8731 | Medium | 6.1 | 2024-09-13 | The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in a… |
CVE-2024-8730 | Medium | 6.1 | 2024-09-13 | The Exit Notifier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL… |
CVE-2024-8714 | Medium | 6.1 | 2024-09-13 | The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg wi… |
CVE-2024-8269 | High | 7.3 | 2024-09-13 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and… |
CVE-2024-8242 | Medium | 4.3 | 2024-09-13 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation… |
CVE-2024-7423 | High | 8.8 | 2024-09-13 | The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect no… |
CVE-2024-6544 | Medium | 5.3 | 2024-09-13 | The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due to the plugin utiliz… |
CVE-2024-5884 | Medium | 6.4 | 2024-09-13 | The Beauty theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tpl_featured_cat_id’ parameter in all versions up to, and including, 1.1.4… |
CVE-2024-5870 | Medium | 6.4 | 2024-09-13 | The Tweaker5 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to… |
CVE-2024-5869 | Medium | 6.4 | 2024-09-13 | The Neighborly theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up… |
CVE-2024-5867 | Medium | 6.4 | 2024-09-13 | The Delicate theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter within the theme's Button shortcode in all versions up t… |
CVE-2024-5789 | Medium | 6.4 | 2024-09-13 | The Triton Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the theme's Button shortcode in all versions up… |
CVE-2024-46713 | High | 7.8 | 2024-09-13 | In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization Ole reported that event->mmap_mutex is strictly in… |
CVE-2024-46049 | Critical | 9.8 | 2024-09-13 | Tenda O6 V3.0 firmware V1.0.0.7(2054) contains a stack overflow vulnerability in the formexeCommand function. |
CVE-2024-46048 | Critical | 9.8 | 2024-09-13 | Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i |
CVE-2024-46047 | High | 7.5 | 2024-09-13 | Tenda FH451 v1.0.0.9 has a stack overflow vulnerability in the fromDhcpListClient function. |
CVE-2024-46046 | Critical | 9.8 | 2024-09-13 | Tenda FH451 v1.0.0.9 has a stack overflow vulnerability located in the RouteStatic function. |
CVE-2024-46045 | Critical | 9.8 | 2024-09-13 | Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. |
CVE-2024-46044 | Critical | 9.8 | 2024-09-13 | CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. |
CVE-2024-45113 | High | 7.5 | 2024-09-13 | ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker… |
CVE-2024-45109 | High | 7.8 | 2024-09-13 | Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2024-45108 | High | 7.8 | 2024-09-13 | Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2024-43760 | High | 7.8 | 2024-09-13 | Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the… |
CVE-2024-43756 | High | 7.8 | 2024-09-13 | Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution i… |
CVE-2024-41874 | Critical | 9.8 | 2024-09-13 | ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution… |
CVE-2024-6656 | Critical | 9.8 | 2024-09-13 | Use of Hard-coded Credentials vulnerability in TNB Mobile Solutions Cockpit Software allows Read Sensitive Strings Within an Executable. This issue affects Co… |
CVE-2024-45112 | High | 7.8 | 2024-09-13 | Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Type Confusion vulnerability that could result in… |
CVE-2024-45111 | Medium | 5.5 | 2024-09-13 | Illustrator versions 28.6, 27.9.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacke… |
CVE-2024-43759 | Medium | 5.5 | 2024-09-13 | Illustrator versions 28.6, 27.9.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS… |
CVE-2024-43758 | High | 7.8 | 2024-09-13 | Illustrator versions 28.6, 27.9.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2024-41869 | High | 7.8 | 2024-09-13 | Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Use After Free vulnerability that could result in… |
CVE-2024-41867 | Medium | 5.5 | 2024-09-13 | After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2024-41859 | High | 7.8 | 2024-09-13 | After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |