2024 CVEs (page 187)
Page 187 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7940 | High | 8.3 | 2024-08-27 | The product exposes a service that is intended for local only to all network interfaces without any authentication. |
CVE-2024-4872 | Critical | 9.9 | 2024-08-27 | A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code t… |
CVE-2024-3982 | High | 8.2 | 2024-08-27 | An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a s… |
CVE-2024-3980 | Critical | 9.9 | 2024-08-27 | The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If e… |
CVE-2024-8207 | Medium | 6.4 | 2024-08-27 | In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a uninte… |
CVE-2024-7791 | Medium | 6.4 | 2024-08-27 | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arrow’ parameter within the Post… |
CVE-2024-6789 | Medium | 6.5 | 2024-08-27 | A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allows authenticated us… |
CVE-2024-8046 | Medium | 6.4 | 2024-08-27 | The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in a… |
CVE-2024-7608 | Medium | 5.9 | 2024-08-27 | An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal. |
CVE-2024-41176 | High | 7.3 | 2024-08-27 | The MPD package included in TwinCAT/BSD allows an authenticated, low-privileged local attacker to induce a Denial-of-Service (DoS) condition on the daemon and… |
CVE-2024-41175 | Medium | 5.5 | 2024-08-27 | The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker. |
CVE-2024-41174 | High | 7.3 | 2024-08-27 | The IPC-Diagnostics package in TwinCAT/BSD is susceptible to improper input neutralization by a low-privileged local attacker. |
CVE-2024-41173 | High | 7.8 | 2024-08-27 | The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker. |
CVE-2024-7304 | Medium | 6.4 | 2024-08-27 | The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and… |
CVE-2024-6804 | Medium | 6.4 | 2024-08-27 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.7 due to… |
CVE-2024-7125 | High | 7.8 | 2024-08-27 | Authentication Bypass vulnerability in Hitachi Ops Center Common Services.This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.2-0… |
CVE-2024-6688 | Medium | 4.3 | 2024-08-27 | The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save_css_from_admin AJA… |
CVE-2024-45321 | High | 8.1 | 2024-08-27 | The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers. |
CVE-2024-45036 | Medium | 4.3 | 2024-08-26 | Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the `TOPHAT_APP_TOKEN` token stored in `~/.tophatrc` throu… |
CVE-2024-43798 | High | 8.6 | 2024-08-26 | Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to… |
CVE-2024-43916 | Medium | 4.3 | 2024-08-26 | Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a throug… |
CVE-2024-43915 | Medium | 5.5 | 2024-08-26 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager allows Reflecte… |
CVE-2024-43356 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide.This issue affects oik: from n/a through 4.12.0. |
CVE-2024-43340 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Nasirahmed Advanced Form Integration.This issue affects Advanced Form Integration: from n/a through 1.89.4. |
CVE-2024-43339 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress allows Cross-Site Scripting (XSS).This issue affects WebinarPress: from n/a through 1.33.20. |
CVE-2024-43337 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0. |
CVE-2024-43336 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager WP User Manager wp-user-manager.This issue affects WP User Manager: from n/a through <= 2.9… |
CVE-2024-43325 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Naiche Dark Mode for WP Dashboard.This issue affects Dark Mode for WP Dashboard: from n/a through 1.2.3. |
CVE-2024-43316 | Medium | 5.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooComme… |
CVE-2024-43301 | High | 7.1 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Fonts Plugin Fonts allows Stored XSS.This issue affects Fonts: from n/a through 3.7.7. |
CVE-2024-43299 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Softaculous SpeedyCache speedycache.This issue affects SpeedyCache: from n/a through <= 1.1.8. |
CVE-2024-43295 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. WP Data Access.This issue affects WP Data Access: from n/a through 5.5.7. |
CVE-2024-43287 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMT… |
CVE-2024-43269 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in WPBackItUp Backup and Restore WordPress.This issue affects Backup and Restore WordPress: from n/a through 1… |
CVE-2024-43265 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.3.1. |
CVE-2024-43264 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine… |
CVE-2024-43259 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in WebFactory Order Export for WooCommerce order-export-and-more-for-woocommerce.This issue aff… |
CVE-2024-43258 | Medium | 5.3 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Store Locator Plus.This issue affects Store Locator Plus: from n/a through 2311.17… |
CVE-2024-43257 | Medium | 6.5 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects Leopard - WordPress… |
CVE-2024-43255 | High | 7.1 | 2024-08-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable.This issue af… |
CVE-2024-43251 | Medium | 6.5 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.This issue affects Bit Form Pro: from n/a through 2.6.4. |
CVE-2024-43230 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <=… |
CVE-2024-43214 | Medium | 5.3 | 2024-08-26 | Missing Authorization vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2. |
CVE-2024-43117 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Humming… |
CVE-2024-43116 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10. |
CVE-2024-39657 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – N… |
CVE-2024-39645 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2. |
CVE-2024-39641 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2. |
CVE-2024-39628 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a throug… |
CVE-2024-8105 | Medium | 6.4 | 2024-08-26 | A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK privat… |
CVE-2024-44797 | Medium | 6.1 | 2024-08-26 | A cross-site scripting (XSS) vulnerability in the component /managers/enable_requests.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web s… |
CVE-2024-44796 | Medium | 6.1 | 2024-08-26 | A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scr… |
CVE-2024-44795 | Medium | 6.1 | 2024-08-26 | A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or… |
CVE-2024-44794 | Medium | 6.1 | 2024-08-26 | A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitra… |
CVE-2024-44793 | Medium | 6.1 | 2024-08-26 | A cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to execute arbitrary we… |
CVE-2024-42906 | Medium | 6.1 | 2024-08-26 | TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. When uploading a file, the XSS payload can be entered into… |
CVE-2024-28077 | High | 7.5 | 2024-08-26 | A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequ… |
CVE-2024-43806 | Medium | 6.5 | 2024-08-26 | Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using `rustix::fs::Dir` using the `linux_raw` backend, it's possible for the iterator to "get stu… |
CVE-2024-43802 | Medium | 4.5 | 2024-08-26 | Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not… |
CVE-2024-45265 | Critical | 9.8 | 2024-08-26 | A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psi… |
CVE-2024-42913 | Critical | 9.8 | 2024-08-26 | RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1. |
CVE-2024-8174 | Medium | 4.3 | 2024-08-26 | A vulnerability has been found in code-projects Blood Bank System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2024-7401 | High | 7.5 | 2024-08-26 | Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. S… |
CVE-2024-42792 | Low | 3.5 | 2024-08-26 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page. |
CVE-2024-42790 | Medium | 5.4 | 2024-08-26 | A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/index.php?page=test" in Kashipara Music Management System v1.0. This vulnerability al… |
CVE-2024-41444 | Critical | 9.8 | 2024-08-26 | SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so. |
CVE-2024-8173 | High | 7.3 | 2024-08-26 | A vulnerability, which was classified as critical, was found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file /login.php of… |
CVE-2024-8172 | Low | 3.5 | 2024-08-26 | A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Attendance System 1.0. This issue affects some unknown processin… |
CVE-2024-8171 | Medium | 6.3 | 2024-08-26 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file staffcate… |
CVE-2024-8170 | Low | 3.5 | 2024-08-26 | A vulnerability classified as problematic has been found in SourceCodester Zipped Folder Manager App 1.0. This affects an unknown part of the file /endpoint/ad… |
CVE-2024-44557 | Critical | 9.8 | 2024-08-26 | Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo. |
CVE-2024-44555 | Critical | 9.8 | 2024-08-26 | Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo. |
CVE-2024-44553 | Critical | 9.8 | 2024-08-26 | Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv. |
CVE-2024-44552 | Critical | 9.8 | 2024-08-26 | Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv. |
CVE-2024-44551 | Critical | 9.8 | 2024-08-26 | Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv. |
CVE-2024-44550 | Critical | 9.8 | 2024-08-26 | Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv. |
CVE-2024-44549 | Critical | 9.8 | 2024-08-26 | Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv. |
CVE-2024-43967 | Medium | 5.9 | 2024-08-26 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Stark Digital WP Testimonial Widget allows Stored… |
CVE-2024-43319 | Medium | 4.3 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a t… |
CVE-2024-43289 | High | 7.5 | 2024-08-26 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4. |
CVE-2024-43283 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affec… |
CVE-2024-42818 | Medium | 6.1 | 2024-08-26 | A cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2024-42816 | Medium | 6.1 | 2024-08-26 | A cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2024-42791 | High | 8.8 | 2024-08-26 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_genre. |
CVE-2024-42788 | Medium | 6.1 | 2024-08-26 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This vulnerabilit… |
CVE-2024-41285 | Critical | 9.8 | 2024-08-26 | A stack overflow in FAST FW300R v1.3.13 Build 141023 Rel.61347n allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via a crafted fil… |
CVE-2024-34087 | Critical | 9.8 | 2024-08-26 | An SEH-based buffer overflow in the BPQ32 HTTP Server in BPQ32 6.0.24.1 allows remote attackers with access to the Web Terminal to achieve remote code executio… |
CVE-2024-8169 | High | 7.3 | 2024-08-26 | A vulnerability was found in code-projects Online Quiz Site 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2024-8168 | High | 7.3 | 2024-08-26 | A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-8167 | High | 7.3 | 2024-08-26 | A vulnerability was found in code-projects Job Portal 1.0. It has been classified as critical. Affected is an unknown function of the file /forget.php. The man… |
CVE-2024-8166 | Medium | 4.7 | 2024-08-26 | A vulnerability has been found in Ruijie EG2000K 11.1(6)B2 and classified as critical. This vulnerability affects unknown code of the file /tool/index.php?c=do… |
CVE-2024-7988 | Critical | 9.8 | 2024-08-26 | A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with Syst… |
CVE-2024-7987 | High | 7.8 | 2024-08-26 | A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with Syst… |
CVE-2024-43966 | High | 7.6 | 2024-08-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stark Digital WP Testimonial Widget.This issue affects WP… |
CVE-2024-42789 | Medium | 6.3 | 2024-08-26 | A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/controller.php?page=test" in Kashipara Music Management System v1.0. This vulnerabili… |
CVE-2024-42787 | Medium | 6.1 | 2024-08-26 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This vulnerabi… |
CVE-2024-39097 | Medium | 6.1 | 2024-08-26 | There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the `url` parameter in login path. |
CVE-2024-38859 | Medium | 6.1 | 2024-08-26 | XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malicious users to execut… |
CVE-2024-8165 | Medium | 4.3 | 2024-08-26 | A vulnerability was identified in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This vulnerability affects the function exportZip of the file /ad… |
CVE-2024-8164 | Medium | 6.3 | 2024-08-26 | A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This affects the function rename of the file /Admin/Http/Controll… |