2024 CVEs (page 185)
Page 185 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41367 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.php |
CVE-2024-41366 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php |
CVE-2024-41364 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php |
CVE-2024-41361 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.php |
CVE-2024-41358 | Medium | 6.1 | 2024-08-29 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php. |
CVE-2024-41351 | Medium | 6.1 | 2024-08-29 | bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.php |
CVE-2024-41350 | Medium | 6.1 | 2024-08-29 | bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php |
CVE-2024-41348 | Medium | 6.1 | 2024-08-29 | openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.php |
CVE-2024-41347 | Medium | 6.1 | 2024-08-29 | openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.php |
CVE-2024-41346 | Medium | 5.4 | 2024-08-29 | openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.php |
CVE-2024-41345 | Medium | 5.4 | 2024-08-29 | openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php |
CVE-2024-34019 | High | 7.3 | 2024-08-29 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 4569. |
CVE-2024-34018 | Medium | 5.5 | 2024-08-29 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4569. |
CVE-2024-34017 | High | 7.3 | 2024-08-29 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 4569. |
CVE-2024-43947 | Medium | 5.4 | 2024-08-29 | Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26. |
CVE-2024-43921 | High | 7.1 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Magic Post Thumbnail allows Reflected XSS.This iss… |
CVE-2024-43920 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jegstudio Gutenverse allows Stored XSS.This issue… |
CVE-2024-44930 | Medium | 6.5 | 2024-08-29 | Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbit… |
CVE-2024-44779 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code… |
CVE-2024-44778 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code i… |
CVE-2024-44777 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in t… |
CVE-2024-44776 | Medium | 6.1 | 2024-08-29 | An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL. |
CVE-2024-44717 | Medium | 6.1 | 2024-08-29 | A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2024-44716 | Medium | 6.1 | 2024-08-29 | A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2024-43964 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Leithold DSGVO All in one for WP allows St… |
CVE-2024-43963 | High | 7.1 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WaspThemes YellowPencil Visual CSS Style Editor al… |
CVE-2024-43961 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in azurecurve azurecurve Toggle Show/Hide allows Stor… |
CVE-2024-43960 | Medium | 5.9 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Page Builder Addons Web and WooCommerce Addons for… |
CVE-2024-43958 | High | 7.1 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gianni Porto IntoTheDark allows Reflected XSS.This… |
CVE-2024-43953 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder cla… |
CVE-2024-43952 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Esotera allows Stored XSS.This iss… |
CVE-2024-43951 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Tempera allows Stored XSS.This iss… |
CVE-2024-43950 | High | 7.1 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nextbricks Brickscore allows Stored XSS.This issue… |
CVE-2024-43949 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic GHActivity allows Stored XSS.This issue… |
CVE-2024-43948 | High | 7.1 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dinesh Karki WP Armour Extended.This issue affects… |
CVE-2024-43946 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SKT Themes SKT Blocks – Gutenberg based Page Build… |
CVE-2024-43936 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper EmbedPress allows Stored XSS.This issu… |
CVE-2024-43935 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Delicious Delicious Recipes – WordPress Recipe… |
CVE-2024-43934 | Medium | 6.5 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Robert Felty Collapsing Archives allows Stored XSS… |
CVE-2024-43926 | High | 7.1 | 2024-08-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder allows Refl… |
CVE-2024-45056 | Medium | 5.9 | 2024-08-29 | zksolc is a Solidity compiler for ZKsync. All LLVM versions since 2015 fold `(xor (shl 1, x), -1)` to `(rotl ~1, x)` if run with optimizations enabled. Here `~… |
CVE-2024-45045 | Medium | 6.3 | 2024-08-29 | Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile (Android/iOS) device variants of Collabora Online it was… |
CVE-2024-44919 | Medium | 5.4 | 2024-08-29 | A cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2024-43804 | High | 8.8 | 2024-08-29 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on t… |
CVE-2024-41964 | High | 8.1 | 2024-08-29 | Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted… |
CVE-2024-35133 | Medium | 6.8 | 2024-08-29 | IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect… |
CVE-2024-8255 | Critical | 9.8 | 2024-08-29 | Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vu… |
CVE-2024-43965 | High | 8.2 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress allows SQL Injection.T… |
CVE-2024-43957 | Medium | 6.5 | 2024-08-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sk. Abul Hasan Animated Number Counters allows PHP Local File I… |
CVE-2024-43955 | Critical | 10.0 | 2024-08-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip allows File Manipulation.This issue affects Droip… |
CVE-2024-43954 | Medium | 6.3 | 2024-08-29 | Incorrect Authorization vulnerability in Themeum Droip allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Droip: from n/a throu… |
CVE-2024-43944 | Low | 3.7 | 2024-08-29 | Authentication Bypass by Spoofing vulnerability in ilyasine Maintenance & Coming Soon Redirect Animation maintenance-coming-soon-redirect-animation allows Iden… |
CVE-2024-43943 | High | 8.5 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wpsoul Greenshift Woocommerce Addon allows SQL Injection… |
CVE-2024-35118 | Medium | 4.6 | 2024-08-29 | IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device. |
CVE-2024-8304 | Medium | 4.7 | 2024-08-29 | A vulnerability has been found in jpress up to 5.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/… |
CVE-2024-8303 | Medium | 6.3 | 2024-08-29 | A vulnerability classified as critical has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. This affects an unknown part of the file… |
CVE-2024-43942 | High | 8.5 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wpsoul Greenshift Query and Meta Addon allows SQL Injecti… |
CVE-2024-43941 | Critical | 9.3 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Propovoice Propovoice Pro allows SQL Injection.This issue… |
CVE-2024-43940 | Medium | 6.5 | 2024-08-29 | Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N… |
CVE-2024-43939 | Medium | 6.5 | 2024-08-29 | Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N… |
CVE-2024-43931 | Critical | 9.8 | 2024-08-29 | Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3. |
CVE-2024-43922 | Medium | 4.8 | 2024-08-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in NitroPack Inc. NitroPack allows Code Injection.This issue affects NitroPack: from n/… |
CVE-2024-43918 | Critical | 10.0 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WBW Product Table PRO allows SQL Injection.This issue… |
CVE-2024-43917 | Critical | 9.3 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injec… |
CVE-2024-43144 | Critical | 9.3 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Cost Calculator Builder allows SQL Injecti… |
CVE-2024-43132 | Critical | 9.3 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPWeb Elite Docket (WooCommerce Collections / Wishlist /… |
CVE-2024-39658 | High | 7.6 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salon Booking System Salon booking system allows SQL Inje… |
CVE-2024-39653 | Critical | 9.3 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E4J s.R.L. VikRentCar allows SQL Injection.This issue aff… |
CVE-2024-39638 | High | 8.5 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roundup WP Registrations for the Events Calendar allows S… |
CVE-2024-39622 | Critical | 9.3 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro allows SQL Injection.T… |
CVE-2024-39620 | High | 8.5 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Inje… |
CVE-2024-38795 | Critical | 9.3 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Inje… |
CVE-2024-38793 | High | 8.5 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PriceListo Best Restaurant Menu by PriceListo allows SQL… |
CVE-2024-8302 | Medium | 6.3 | 2024-08-29 | A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been rated as critical. Affected by this issue is some unknow… |
CVE-2024-5057 | Critical | 9.3 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue af… |
CVE-2024-38693 | High | 7.6 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue a… |
CVE-2024-1056 | Medium | 6.4 | 2024-08-29 | The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allow_iframe_tag_in_post' function which uses the '… |
CVE-2024-8301 | High | 7.3 | 2024-08-29 | A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been declared as critical. Affected by this vulnerability is… |
CVE-2024-8297 | Medium | 5.3 | 2024-08-29 | A vulnerability was found in kitsada8621 Digital Library Management System 1.0. It has been classified as problematic. Affected is the function JwtRefreshAuth… |
CVE-2024-8296 | Medium | 6.3 | 2024-08-29 | A vulnerability was found in FeehiCMS up to 2.1.1 and classified as critical. This issue affects the function insert of the file /admin/index.php?r=user%2Fcrea… |
CVE-2024-3679 | Medium | 5.3 | 2024-08-29 | The Premium SEO Pack – WP SEO Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.002. This m… |
CVE-2024-2541 | Medium | 5.3 | 2024-08-29 | The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the Subscribers Import f… |
CVE-2024-1384 | Medium | 6.4 | 2024-08-29 | The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aux_recent_portfolios_grid'… |
CVE-2024-8295 | Medium | 6.3 | 2024-08-29 | A vulnerability has been found in FeehiCMS up to 2.1.1 and classified as critical. This vulnerability affects the function createBanner of the file /admin/inde… |
CVE-2024-8294 | Medium | 6.3 | 2024-08-29 | A vulnerability, which was classified as critical, was found in FeehiCMS up to 2.1.1. This affects the function update of the file /admin/index.php?r=friendly-… |
CVE-2024-7895 | Medium | 6.4 | 2024-08-29 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, a… |
CVE-2024-7856 | High | 8.1 | 2024-08-29 | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missi… |
CVE-2024-7607 | High | 8.8 | 2024-08-29 | The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due t… |
CVE-2024-7606 | Medium | 6.4 | 2024-08-29 | The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versions up to, and inclu… |
CVE-2024-7418 | Medium | 4.3 | 2024-08-29 | The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Sensitive Information Exposure in all v… |
CVE-2024-7132 | Medium | 4.8 | 2024-08-29 | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with… |
CVE-2024-6927 | Medium | 4.8 | 2024-08-29 | The Viral Signup WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-6551 | Medium | 5.3 | 2024-08-29 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1… |
CVE-2024-5987 | Medium | 5.4 | 2024-08-29 | The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_contra… |
CVE-2024-5857 | Medium | 5.3 | 2024-08-29 | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized loss of… |
CVE-2024-5624 | Medium | 6.1 | 2024-08-29 | Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL <= R 4.4-00P3 may allow a network-based attacker to execute arbitrary JavaScript… |
CVE-2024-5623 | High | 7.8 | 2024-08-29 | An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code u… |
CVE-2024-5622 | High | 7.8 | 2024-08-29 | An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker… |
CVE-2024-5417 | Medium | 5.4 | 2024-08-29 | The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/post where the block i… |
CVE-2024-4428 | Critical | 9.8 | 2024-08-29 | Missing Authentication for Critical Function, Missing Authorization vulnerability in Menulux Information Technologies Managment Portal allows Collect Data as P… |