2024 CVEs (page 184)
Page 184 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45304 | Medium | 5.3 | 2024-08-31 | Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup. This vulnerability can lead to unauthorized ownership tran… |
CVE-2024-6586 | High | 7.3 | 2024-08-30 | Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that conta… |
CVE-2024-6585 | Medium | 5.4 | 2024-08-30 | Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows… |
CVE-2024-8348 | Medium | 6.3 | 2024-08-30 | A vulnerability, which was classified as critical, has been found in SourceCodester Computer Laboratory Management System 1.0. Affected by this issue is the fu… |
CVE-2024-8347 | Medium | 6.3 | 2024-08-30 | A vulnerability classified as critical was found in SourceCodester Computer Laboratory Management System 1.0. Affected by this vulnerability is the function de… |
CVE-2024-8285 | Medium | 5.9 | 2024-08-30 | A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properl… |
CVE-2024-44684 | Medium | 6.1 | 2024-08-30 | TpMeCMS 1.3.3.2 is vulnerable to Cross Site Scripting (XSS) in /h.php/page?ref=addtabs via the "Title," "Images," and "Content" fields. |
CVE-2024-44683 | Medium | 6.1 | 2024-08-30 | Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php. |
CVE-2024-44682 | Medium | 6.1 | 2024-08-30 | ShopXO 6.2 is vulnerable to Cross Site Scripting (XSS) in the backend that allows attackers to execute code by changing POST parameters. |
CVE-2024-8346 | Medium | 6.3 | 2024-08-30 | A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. Affected is the function update_settings_inf… |
CVE-2024-38868 | High | 7.6 | 2024-08-30 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: befor… |
CVE-2024-21658 | Medium | 4.3 | 2024-08-30 | discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is… |
CVE-2024-8345 | Medium | 6.3 | 2024-08-30 | A vulnerability was found in SourceCodester Music Gallery Site 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-8344 | Medium | 6.3 | 2024-08-30 | A vulnerability has been found in Campcodes Supplier Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-8235 | Medium | 6.2 | 2024-08-30 | A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0… |
CVE-2024-6204 | High | 8.3 | 2024-08-30 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module. |
CVE-2024-45047 | Medium | 5.4 | 2024-08-30 | svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escap… |
CVE-2024-44918 | Low | 3.5 | 2024-08-30 | A cross-site scripting (XSS) vulnerability in the component admin_datarelate.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2024-8343 | High | 7.3 | 2024-08-30 | A vulnerability, which was classified as critical, was found in SourceCodester Sentiment Based Movie Rating System 1.0. Affected is an unknown function of the… |
CVE-2024-8342 | Medium | 6.3 | 2024-08-30 | A vulnerability, which was classified as critical, has been found in SourceCodester Petshop Management System 1.0. This issue affects some unknown processing o… |
CVE-2024-44916 | High | 7.2 | 2024-08-30 | Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and co… |
CVE-2024-8341 | Medium | 6.3 | 2024-08-30 | A vulnerability classified as critical was found in SourceCodester Petshop Management System 1.0. This vulnerability affects unknown code of the file /controll… |
CVE-2024-8340 | High | 7.3 | 2024-08-30 | A vulnerability classified as critical has been found in SourceCodester Electric Billing Management System 1.0. This affects an unknown part of the file /Actio… |
CVE-2024-8339 | Medium | 6.3 | 2024-08-30 | A vulnerability was found in SourceCodester Electric Billing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown funct… |
CVE-2024-8338 | Medium | 6.3 | 2024-08-30 | A vulnerability was found in HFO4 shudong-share 2.4.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-8337 | Low | 3.5 | 2024-08-30 | A vulnerability, which was classified as problematic, has been found in SourceCodester Contact Manager with Export to VCF 1.0. Affected by this issue is some u… |
CVE-2024-8336 | Medium | 6.3 | 2024-08-30 | A vulnerability classified as critical was found in SourceCodester Music Gallery Site 1.0. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2024-8335 | Medium | 6.3 | 2024-08-30 | A vulnerability classified as critical has been found in OpenRapid RapidCMS up to 1.3.1. Affected is an unknown function of the file /resource/runlogon.php. Th… |
CVE-2024-8334 | Medium | 4.3 | 2024-08-30 | A vulnerability was found in master-nan Sweet-CMS up to 5f441e022b8876f07cde709c77b5be6d2f262e3f. It has been rated as problematic. This issue affects the func… |
CVE-2024-8260 | Medium | 6.1 | 2024-08-30 | A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validat… |
CVE-2024-8332 | Medium | 6.3 | 2024-08-30 | A vulnerability was found in master-nan Sweet-CMS up to 5f441e022b8876f07cde709c77b5be6d2f262e3f. It has been declared as critical. This vulnerability affects… |
CVE-2024-8331 | Medium | 6.3 | 2024-08-30 | A vulnerability was found in OpenRapid RapidCMS up to 1.3.1. It has been classified as critical. This affects an unknown part of the file /admin/user/user-move… |
CVE-2024-8274 | Medium | 6.1 | 2024-08-30 | The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to… |
CVE-2024-8252 | High | 8.8 | 2024-08-30 | The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the cle… |
CVE-2024-7858 | Medium | 6.3 | 2024-08-30 | The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-lib… |
CVE-2024-7122 | Medium | 6.4 | 2024-08-30 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.13… |
CVE-2024-8319 | Medium | 4.3 | 2024-08-30 | The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect… |
CVE-2024-44944 | Medium | 5.5 | 2024-08-30 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path… |
CVE-2024-8016 | Critical | 9.1 | 2024-08-30 | The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deserialization of untrusted… |
CVE-2024-42412 | Medium | 6.1 | 2024-08-30 | Cross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi. If a user views a malicious… |
CVE-2024-39300 | Low | 3.7 | 2024-08-30 | Missing authentication vulnerability exists in Telnet function of WAB-I1750-PS v1.5.10 and earlier. When Telnet function of the product is enabled, a remote at… |
CVE-2024-34577 | Medium | 6.1 | 2024-08-30 | Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B and WRC-X3000GST2-B due to improper processing of input values in… |
CVE-2024-3673 | Critical | 9.1 | 2024-08-30 | The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion is… |
CVE-2024-5879 | Medium | 6.4 | 2024-08-30 | The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of t… |
CVE-2024-3998 | Medium | 6.4 | 2024-08-30 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 27.5… |
CVE-2024-2694 | High | 8.8 | 2024-08-30 | The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of th… |
CVE-2024-5784 | High | 7.1 | 2024-08-30 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions… |
CVE-2024-5061 | Medium | 6.4 | 2024-08-30 | The Enfold - Responsive Multi-Purpose Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wrapper_class’ and 'class' parameters in… |
CVE-2024-5024 | Medium | 6.1 | 2024-08-30 | The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mepr_screenname' and 'mepr_key' parameter in all versions up to… |
CVE-2024-4401 | Medium | 6.4 | 2024-08-30 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ and 'eae_slider_animation' parameters in all versio… |
CVE-2024-8330 | High | 8.8 | 2024-08-30 | 6SHR system from Gether Technology does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload web shell script… |
CVE-2024-8329 | High | 8.8 | 2024-08-30 | 6SHR system from Gether Technology does not properly validate the specific page parameter, allowing remote attackers with regular privilege to inject SQL comma… |
CVE-2024-8328 | Medium | 5.4 | 2024-08-30 | Easy test Online Learning and Testing Platform from HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers… |
CVE-2024-8327 | High | 8.8 | 2024-08-30 | Easy test Online Learning and Testing Platform from HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attacker… |
CVE-2024-45492 | Critical | 9.8 | 2024-08-30 | An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_M… |
CVE-2024-45491 | Critical | 9.8 | 2024-08-30 | An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equal… |
CVE-2024-45490 | High | 7.5 | 2024-08-30 | An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. |
CVE-2024-45488 | Critical | 9.8 | 2024-08-30 | One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. This only affects virtual appli… |
CVE-2024-8234 | High | 7.5 | 2024-08-30 | ** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the functions formSysCmd(), formUpgradeCert(), and formDelcert() in the Zyxel NWA1100-N fi… |
CVE-2024-2881 | Medium | 6.7 | 2024-08-30 | Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacke… |
CVE-2024-1545 | Medium | 5.9 | 2024-08-29 | Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker c… |
CVE-2024-1543 | Medium | 4.1 | 2024-08-29 | The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution. In a cont… |
CVE-2024-6672 | High | 8.8 | 2024-08-29 | In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an authenticated low-privileged attacker to achieve privilege escalatio… |
CVE-2024-6671 | Critical | 9.8 | 2024-08-29 | In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenti… |
CVE-2024-6670 | Critical | 9.8 | 2024-08-29 | In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. |
CVE-2024-45302 | Medium | 6.1 | 2024-08-29 | RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to `RestRequest.AddHeader` (the header value) is vulnerable to CRLF injection. The… |
CVE-2024-2502 | Low | 2.0 | 2024-08-29 | An application can be configured to block boot attempts after consecutive tamper resets are detected, which may not occur as expected. This is possible becaus… |
CVE-2024-41349 | Medium | 6.1 | 2024-08-29 | unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add_by_url.php. |
CVE-2024-41372 | Critical | 9.8 | 2024-08-29 | Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php. |
CVE-2024-41371 | Medium | 6.1 | 2024-08-29 | Organizr v1.90 is vulnerable to Cross Site Scripting (XSS) via api.php. |
CVE-2024-41370 | Critical | 9.8 | 2024-08-29 | Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php. |
CVE-2024-41369 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php |
CVE-2024-41368 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.php |
CVE-2024-41367 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.php |
CVE-2024-41366 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php |
CVE-2024-41364 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php |
CVE-2024-41361 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.php |
CVE-2024-41358 | Medium | 6.1 | 2024-08-29 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php. |
CVE-2024-41351 | Medium | 6.1 | 2024-08-29 | bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.php |
CVE-2024-41350 | Medium | 6.1 | 2024-08-29 | bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php |
CVE-2024-41348 | Medium | 6.1 | 2024-08-29 | openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.php |
CVE-2024-41347 | Medium | 6.1 | 2024-08-29 | openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.php |
CVE-2024-41346 | Medium | 5.4 | 2024-08-29 | openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.php |
CVE-2024-41345 | Medium | 5.4 | 2024-08-29 | openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php |
CVE-2024-34019 | High | 7.3 | 2024-08-29 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 4569. |
CVE-2024-34018 | Medium | 5.5 | 2024-08-29 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4569. |
CVE-2024-34017 | High | 7.3 | 2024-08-29 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 4569. |
CVE-2024-43947 | Medium | 5.4 | 2024-08-29 | Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26. |
CVE-2024-43921 | High | 7.1 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Magic Post Thumbnail allows Reflected XSS.This iss… |
CVE-2024-43920 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jegstudio Gutenverse allows Stored XSS.This issue… |
CVE-2024-44930 | Medium | 6.5 | 2024-08-29 | Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbit… |
CVE-2024-44779 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code… |
CVE-2024-44778 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code i… |
CVE-2024-44777 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in t… |
CVE-2024-44776 | Medium | 6.1 | 2024-08-29 | An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL. |
CVE-2024-44717 | Medium | 6.1 | 2024-08-29 | A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2024-44716 | Medium | 6.1 | 2024-08-29 | A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2024-43964 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Leithold DSGVO All in one for WP allows St… |
CVE-2024-43963 | High | 7.1 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WaspThemes YellowPencil Visual CSS Style Editor al… |
CVE-2024-43961 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in azurecurve azurecurve Toggle Show/Hide allows Stor… |