2024 CVEs (page 18)
Page 18 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10037 | Medium | 4.4 | 2025-03-25 | A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message seque… |
CVE-2024-53679 | Medium | 5.4 | 2025-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with sufficien… |
CVE-2024-53678 | High | 8.8 | 2025-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when req… |
CVE-2024-13731 | Medium | 6.4 | 2025-03-25 | The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert Box bloc… |
CVE-2024-13710 | Medium | 4.3 | 2025-03-25 | The Estatebud – Properties & Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.0. This is due… |
CVE-2024-13690 | High | 7.2 | 2025-03-25 | The WP Church Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several donation form submission parameters in all versions up to… |
CVE-2024-12623 | Medium | 6.4 | 2025-03-25 | The DICOM Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dcm' shortcode in all versions up to, and including, 0.10… |
CVE-2024-9770 | Medium | 4.7 | 2025-03-25 | The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL inj… |
CVE-2024-44903 | High | 7.5 | 2025-03-25 | SQL Injection can occur in the SirsiDynix Horizon Information Portal (IPAC20) through 3.25_9382; however, a patch is available from the vendor. This is in ipac… |
CVE-2024-13863 | High | 7.1 | 2025-03-25 | The Stylish Google Sheet Reader 4.0 WordPress plugin before 4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a R… |
CVE-2024-13618 | High | 7.2 | 2025-03-25 | The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated… |
CVE-2024-13617 | High | 8.6 | 2025-03-25 | The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attackers to download arbit… |
CVE-2024-13123 | Low | 3.5 | 2025-03-25 | The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Sto… |
CVE-2024-13122 | Low | 3.5 | 2025-03-25 | The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Sto… |
CVE-2024-13118 | Medium | 4.3 | 2025-03-25 | The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs… |
CVE-2024-12769 | Low | 3.5 | 2025-03-25 | The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-12682 | Medium | 6.1 | 2025-03-25 | The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-12109 | Medium | 4.1 | 2025-03-25 | The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a SQL statement, all… |
CVE-2024-11503 | Medium | 6.1 | 2025-03-25 | The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2024-11273 | Medium | 6.1 | 2025-03-25 | The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow… |
CVE-2024-11272 | Medium | 6.1 | 2025-03-25 | The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow… |
CVE-2024-10703 | Medium | 6.1 | 2025-03-25 | The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege u… |
CVE-2024-10679 | Medium | 6.1 | 2025-03-25 | The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2024-10638 | Medium | 4.1 | 2025-03-25 | The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, al… |
CVE-2024-10566 | Medium | 6.1 | 2025-03-25 | The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10565 | Medium | 6.1 | 2025-03-25 | The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10560 | Low | 3.5 | 2025-03-25 | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-10554 | Low | 3.5 | 2025-03-25 | The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2024-10472 | Medium | 5.9 | 2025-03-25 | The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege users such as contri… |
CVE-2024-10210 | | 2025-03-25 | An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an authenticated network-based attacker to… | |
CVE-2024-10105 | Medium | 5.9 | 2025-03-25 | The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor t… |
CVE-2024-8315 | | 2025-03-25 | An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may allow an authenticated local attacker t… | |
CVE-2024-8314 | | 2025-03-25 | An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Ses-sion vulnerability in the session handling used in B&R APROL… | |
CVE-2024-8313 | | 2025-03-25 | An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SN… | |
CVE-2024-45484 | | 2025-03-25 | An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an un… | |
CVE-2024-45483 | | 2025-03-25 | A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical attacker to… | |
CVE-2024-45482 | | 2025-03-25 | An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker fr… | |
CVE-2024-45481 | | 2025-03-25 | An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to a… | |
CVE-2024-45480 | | 2025-03-25 | An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APROL <4.4-00P5 may allow an unauthenticat… | |
CVE-2024-10209 | | 2025-03-25 | An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may allow an authenticated local attacker t… | |
CVE-2024-10208 | | 2025-03-25 | An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated net… | |
CVE-2024-10207 | | 2025-03-25 | A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to force the… | |
CVE-2024-10206 | | 2025-03-25 | A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to force th… | |
CVE-2024-9103 | Medium | 6.1 | 2025-03-24 | Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issu… |
CVE-2024-55279 | Medium | 6.0 | 2025-03-24 | Uguu through 1.8.9 allows Cross Site Scripting (XSS) via JavaScript in XML files. |
CVE-2024-8774 | | 2025-03-24 | The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database admini… | |
CVE-2024-8773 | | 2025-03-24 | SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data int… | |
CVE-2024-13124 | Low | 3.5 | 2025-03-24 | The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-10558 | Low | 3.5 | 2025-03-24 | The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-13666 | Medium | 5.3 | 2025-03-22 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all ver… |
CVE-2024-13856 | Medium | 6.4 | 2025-03-22 | The Your Friendly Drag and Drop Page Builder — Make Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and includ… |
CVE-2024-13768 | Medium | 4.3 | 2025-03-22 | The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2024-13739 | Medium | 6.1 | 2025-03-22 | The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and including, 4.9.9.7 due t… |
CVE-2024-13737 | Medium | 4.3 | 2025-03-22 | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on th… |
CVE-2024-53351 | Critical | 9.8 | 2025-03-21 | Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges. |
CVE-2024-53350 | High | 7.4 | 2025-03-21 | Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges. |
CVE-2024-53349 | High | 7.4 | 2025-03-21 | Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes co… |
CVE-2024-53348 | High | 7.4 | 2025-03-21 | LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privileges. |
CVE-2024-57490 | High | 7.7 | 2025-03-21 | Guangzhou Hongfan Technology Co., LTD. iOffice20 has any user login vulnerability. An attacker can log in to any system account including the system administra… |
CVE-2024-13903 | Medium | 4.3 | 2025-03-21 | A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. It has been declared as problematic. Affected by this vulnerability is the function JS_GetRuntime… |
CVE-2024-50053 | Medium | 6.3 | 2025-03-21 | Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in… |
CVE-2024-54564 | Medium | 6.5 | 2025-03-21 | This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, visionOS 1.3. A file received f… |
CVE-2024-54551 | High | 7.5 | 2025-03-21 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3… |
CVE-2024-44305 | High | 7.8 | 2025-03-21 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.6. An app may be able to gain root privileges. |
CVE-2024-44199 | High | 7.1 | 2025-03-21 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.6. An app may be able to cause unexpected system ter… |
CVE-2024-7598 | Low | 3.1 | 2025-03-20 | A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namesp… |
CVE-2024-57440 | High | 7.5 | 2025-03-20 | D-Link DSL-3788 revA1 1.01R1B036_EU_EN is vulnerable to Buffer Overflow via the COMM_MAKECustomMsg function of the webproc cgi |
CVE-2024-48591 | Medium | 6.1 | 2025-03-20 | Inflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting (XSS). A specially crafted SVG file can be uploaded that will render and execute JavaScript up… |
CVE-2024-48590 | Critical | 9.8 | 2025-03-20 | Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService. This allows an attacker to escalate privileges and ob… |
CVE-2024-13923 | High | 7.6 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.0 v… |
CVE-2024-13922 | Low | 2.7 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the a… |
CVE-2024-13921 | High | 7.2 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.0 via dese… |
CVE-2024-13920 | Medium | 4.9 | 2025-03-20 | The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.0 via the d… |
CVE-2024-13558 | High | 7.5 | 2025-03-20 | The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.179 due t… |
CVE-2024-9920 | High | 8.8 | 2025-03-20 | In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentially dangerous ones li… |
CVE-2024-9919 | High | 8.4 | 2025-03-20 | A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninst… |
CVE-2024-9900 | Medium | 6.1 | 2025-03-20 | mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper saniti… |
CVE-2024-9847 | High | 8.0 | 2025-03-20 | FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a vict… |
CVE-2024-9701 | Critical | 9.8 | 2025-03-20 | A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execu… |
CVE-2024-9699 | Medium | 5.4 | 2025-03-20 | A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payloa… |
CVE-2024-9617 | Medium | 6.5 | 2025-03-20 | An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator o… |
CVE-2024-9612 | Medium | 6.5 | 2025-03-20 | In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page. When the search page is set to be… |
CVE-2024-9606 | High | 7.5 | 2025-03-20 | In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code onl… |
CVE-2024-9597 | High | 7.1 | 2025-03-20 | A Path Traversal vulnerability exists in the `/wipe_database` endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the syst… |
CVE-2024-9447 | Medium | 6.5 | 2025-03-20 | An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. The `/get/organisation/` endpoint does not verify the user… |
CVE-2024-9439 | High | 8.8 | 2025-03-20 | SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which ar… |
CVE-2024-9437 | High | 7.5 | 2025-03-20 | SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service (DoS) attack. The vulnerability exists in the resource upload request, where app… |
CVE-2024-9431 | High | 8.8 | 2025-03-20 | In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, users can change the… |
CVE-2024-9418 | Medium | 6.5 | 2025-03-20 | In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. This vulnerability allows an… |
CVE-2024-9415 | High | 8.8 | 2025-03-20 | A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to… |
CVE-2024-9365 | Medium | 6.5 | 2025-03-20 | A Cross-Site Request Forgery (CSRF) vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's b… |
CVE-2024-9363 | High | 7.5 | 2025-03-20 | An unauthorized file deletion vulnerability exists in the latest version of the Polyaxon platform, which can lead to denial of service by terminating critical… |
CVE-2024-9362 | High | 7.5 | 2025-03-20 | An unauthenticated directory traversal vulnerability exists in Polyaxon, affecting the latest version. This vulnerability allows an attacker to retrieve direct… |
CVE-2024-9340 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending ma… |
CVE-2024-9311 | Medium | 6.1 | 2025-03-20 | A Cross-Site Request Forgery (CSRF) vulnerability in haotian-liu/llava v1.2.0 (LLaVA-1.6) allows an attacker to upload files with malicious content without aut… |
CVE-2024-9309 | Critical | 9.3 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava ve… |
CVE-2024-9308 | Medium | 6.1 | 2025-03-20 | An open redirect vulnerability in haotian-liu/llava version v1.2.0 (LLaVA-1.6) allows a remote unauthenticated attacker to redirect users to arbitrary websites… |
CVE-2024-9229 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive resource co… |
CVE-2024-9216 | High | 8.1 | 2025-03-20 | An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat histo… |
CVE-2024-9159 | Medium | 6.5 | 2025-03-20 | An incorrect authorization vulnerability exists in gaizhenbiao/chuanhuchatgpt version git c91dbfc. The vulnerability allows any user to restart the server at w… |