2024 CVEs (page 180)
Page 180 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7599 | Medium | 6.4 | 2024-09-06 | The Advanced Sermons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sermon_video_embed’ parameter in all versions up to, and includ… |
CVE-2024-7493 | Critical | 9.8 | 2024-09-06 | The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing a… |
CVE-2024-6445 | High | 7.5 | 2024-09-06 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DataFlowX Technology DataDiodeX allows Path Traversal. This is… |
CVE-2024-44837 | Medium | 5.4 | 2024-09-06 | A cross-site scripting (XSS) vulnerability in the component \bean\Manager.java of Drug v1.0 allows attackers to execute arbitrary web scripts or HTML via a cra… |
CVE-2024-45405 | Medium | 6.0 | 2024-09-06 | `gix-path` is a crate of the `gitoxide` project (an implementation of `git` written in Rust) dealing paths and their conversions. Prior to version 0.10.11, `gi… |
CVE-2024-45300 | High | 7.5 | 2024-09-06 | alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the u… |
CVE-2024-45299 | Medium | 6.5 | 2024-09-06 | alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is… |
CVE-2024-45040 | Medium | 5.9 | 2024-09-06 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.11.0, commitments to private witnesses in Groth16 as imple… |
CVE-2024-45039 | Medium | 6.2 | 2024-09-06 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundness issue - in case of multiple commitm… |
CVE-2024-44739 | High | 8.8 | 2024-09-06 | Sourcecodester Simple Forum Website v1.0 has a SQL injection vulnerability in /php-sqlite-forum/?page=manage_user&id=. |
CVE-2024-1744 | High | 7.5 | 2024-09-06 | Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Ariva Computer Accord ORS allows Retrieve Embedded Sensitive Data. Th… |
CVE-2024-8427 | Medium | 4.3 | 2024-09-06 | The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2024-8317 | Medium | 6.4 | 2024-09-06 | The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ad_alignment’ attribute in all versions u… |
CVE-2024-8292 | Critical | 9.8 | 2024-09-06 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and i… |
CVE-2024-7349 | High | 7.2 | 2024-09-06 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all vers… |
CVE-2024-6792 | Low | 3.5 | 2024-09-06 | The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page. |
CVE-2024-45751 | Medium | 5.9 | 2024-09-06 | tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of c… |
CVE-2024-39585 | High | 7.9 | 2024-09-06 | Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Password vulnerability. A low privileged at… |
CVE-2024-38486 | High | 7.5 | 2024-09-06 | Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special Elements used in a Comman… |
CVE-2024-8480 | High | 8.8 | 2024-09-06 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 's… |
CVE-2024-8247 | High | 8.8 | 2024-09-06 | The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the plugin not restric… |
CVE-2024-7415 | Medium | 5.3 | 2024-09-06 | The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin allo… |
CVE-2024-40865 | Medium | 5.3 | 2024-09-06 | The issue was addressed by suspending Persona when the virtual keyboard is active. This issue is fixed in visionOS 1.3. Inputs to the virtual keyboard may be i… |
CVE-2024-44082 | Medium | 4.3 | 2024-09-06 | In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used b… |
CVE-2024-45400 | Medium | 6.1 | 2024-09-06 | ckeditor-plugin-openlink is a plugin for the CKEditor JavaScript text editor that extends the context menu with a possibility to open a link in a new tab. A vu… |
CVE-2024-42495 | Medium | 6.5 | 2024-09-05 | Credentials to access device configuration were transmitted using an unencrypted protocol. These credentials would allow read-only access to network configurat… |
CVE-2024-39278 | Medium | 4.2 | 2024-09-05 | Credentials to access device configuration information stored unencrypted in flash memory. These credentials would allow read-only access to network configurat… |
CVE-2024-8395 | Critical | 9.8 | 2024-09-05 | FlyCASS CASS and KCM systems did not correctly filter SQL queries, which made them vulnerable to attack by outside attackers with no authentication. |
CVE-2024-45159 | Critical | 9.8 | 2024-09-05 | An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certifi… |
CVE-2024-45158 | Critical | 9.8 | 2024-09-05 | An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the b… |
CVE-2024-45157 | Medium | 5.1 | 2024-09-05 | An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enablin… |
CVE-2024-7591 | Critical | 10.0 | 2024-09-05 | Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All ve… |
CVE-2024-45401 | High | 7.5 | 2024-09-05 | stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prior to version 1.21.3… |
CVE-2024-42491 | Medium | 5.7 | 2024-09-05 | Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of… |
CVE-2024-45392 | High | 7.7 | 2024-09-05 | SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat… |
CVE-2024-44728 | Medium | 6.1 | 2024-09-05 | Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact# in /clientdetails/admin/re… |
CVE-2024-44727 | Critical | 9.8 | 2024-09-05 | Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php. |
CVE-2024-24759 | Critical | 9.3 | 2024-09-05 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request… |
CVE-2024-45589 | Medium | 5.9 | 2024-09-05 | RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a d… |
CVE-2024-45176 | Medium | 6.1 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper input validation, the C-MOR web interface is vulnerable to reflected cr… |
CVE-2024-45175 | High | 8.8 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive informati… |
CVE-2024-45171 | High | 8.8 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for in… |
CVE-2024-45098 | Medium | 6.8 | 2024-09-05 | IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification. |
CVE-2024-45097 | Medium | 5.9 | 2024-09-05 | IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification. |
CVE-2024-45096 | Medium | 6.5 | 2024-09-05 | IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensitive information through a directory listing. |
CVE-2024-42885 | Critical | 9.1 | 2024-09-05 | SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id parameter of the data.jsp page. |
CVE-2024-8445 | Medium | 5.7 | 2024-09-05 | The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash w… |
CVE-2024-45178 | High | 7.1 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from… |
CVE-2024-45173 | High | 8.8 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MOR is vulnerable to… |
CVE-2024-44587 | High | 8.8 | 2024-09-05 | itsourcecode Alton Management System 1.0 is vulnerable to SQL Injection in /noncombo_save.php via the "menu" parameter. |
CVE-2024-8473 | Medium | 6.3 | 2024-09-05 | Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attack… |
CVE-2024-8472 | Medium | 6.3 | 2024-09-05 | Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attack… |
CVE-2024-8471 | Medium | 6.3 | 2024-09-05 | Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attack… |
CVE-2024-8470 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/vacancy/controller.php… |
CVE-2024-8469 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/employee/index.php, and retrie… |
CVE-2024-8468 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through search parameter in /jobportal/index.php, and retrieve all the… |
CVE-2024-8467 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/category/index.php, and retrie… |
CVE-2024-8466 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/category/controller.php… |
CVE-2024-8465 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/controller.php, and… |
CVE-2024-8464 | Critical | 9.8 | 2024-09-05 | SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.ph… |
CVE-2024-8463 | Critical | 9.9 | 2024-09-05 | File upload restriction bypass vulnerability in PHPGurukul Job Portal 1.0, the exploitation of which could allow an authenticated user to execute an RCE via we… |
CVE-2024-8462 | Low | 3.7 | 2024-09-05 | A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/user… |
CVE-2024-8461 | Medium | 5.3 | 2024-09-05 | A vulnerability, which was classified as problematic, was found in D-Link DNS-320 2.02b01. This affects an unknown part of the file /cgi-bin/discovery.cgi of t… |
CVE-2024-7884 | High | 7.5 | 2024-09-05 | When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internal… |
CVE-2024-8460 | Low | 3.7 | 2024-09-05 | A vulnerability, which was classified as problematic, has been found in D-Link DNS-320 2.02b01. Affected by this issue is some unknown functionality of the fil… |
CVE-2024-7605 | Medium | 4.3 | 2024-09-05 | The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' function in all versio… |
CVE-2024-7381 | Medium | 5.3 | 2024-09-05 | The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__short… |
CVE-2024-7380 | Medium | 4.3 | 2024-09-05 | The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__geolocate_menu and a… |
CVE-2024-5957 | Medium | 6.3 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager. |
CVE-2024-5956 | Medium | 6.5 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with gar… |
CVE-2024-6929 | Medium | 6.4 | 2024-09-05 | The Dynamic Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘dfiFeatured’ parameter in all versions up to, and includi… |
CVE-2024-6894 | Medium | 6.4 | 2024-09-05 | The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insufficient input sanitiza… |
CVE-2024-6332 | Medium | 6.5 | 2024-09-05 | The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing… |
CVE-2024-8363 | Medium | 6.4 | 2024-09-05 | The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STI Buttons shortcode in all versions up to, and includ… |
CVE-2024-5309 | Medium | 5.4 | 2024-09-05 | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capabil… |
CVE-2024-45107 | Medium | 5.5 | 2024-09-05 | Acrobat Reader versions 20.005.30636, 24.002.20964, 24.001.30123, 24.002.20991 and earlier are affected by a Use After Free vulnerability that could lead to di… |
CVE-2024-6835 | Medium | 5.3 | 2024-09-05 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.5.6 via the ajax_… |
CVE-2024-6846 | Medium | 5.3 | 2024-09-05 | The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and ch… |
CVE-2024-8178 | High | 8.8 | 2024-09-05 | The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it. Malicious software running in a gues… |
CVE-2024-45063 | High | 8.8 | 2024-09-05 | The function ctl_write_buffer incorrectly set a flag which resulted in a kernel Use-After-Free when a command finished processing. Malicious software running… |
CVE-2024-43110 | High | 8.8 | 2024-09-05 | The ctl_request_sense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM that exposes virtio_sc… |
CVE-2024-43102 | Critical | 10.0 | 2024-09-05 | Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference c… |
CVE-2024-42416 | High | 8.8 | 2024-09-05 | The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kerne… |
CVE-2024-32668 | High | 8.2 | 2024-09-05 | An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A malicious, privile… |
CVE-2024-45288 | High | 8.4 | 2024-09-05 | A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer. |
CVE-2024-45287 | High | 7.5 | 2024-09-05 | A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the par… |
CVE-2024-41928 | High | 8.4 | 2024-09-05 | Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically… |
CVE-2024-7627 | High | 8.1 | 2024-09-05 | The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writin… |
CVE-2024-45692 | High | 7.5 | 2024-09-04 | Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000. |
CVE-2024-45429 | Medium | 6.1 | 2024-09-04 | Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an… |
CVE-2024-2166 | High | 8.8 | 2024-09-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time Monitor modules) all… |
CVE-2024-20506 | Medium | 6.1 | 2024-09-04 | A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions… |
CVE-2024-20505 | Medium | 4.0 | 2024-09-04 | A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, al… |
CVE-2024-45395 | Low | 3.1 | 2024-09-04 | sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is pro… |
CVE-2024-45399 | Medium | 4.3 | 2024-09-04 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, correspondin… |
CVE-2024-45172 | Medium | 6.8 | 2024-09-04 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to missing protection mechanisms, the C-MOR web interface is vulnerabl… |
CVE-2024-45008 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at input_mt_init_slo… |
CVE-2024-45007 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: char: xillybus: Don't destroy workqueue from work item running on it Triggered by a kref… |
CVE-2024-45006 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enumerating fu… |
CVE-2024-45005 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix validity interception issue when gisa is switched off We might run into a… |