2024 CVEs (page 193)
Page 193 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43688 | High | 7.3 | 2024-08-20 | cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was int… |
CVE-2024-6864 | Medium | 6.4 | 2024-08-20 | The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘template’ attribute of the lmt-post-modified-info shortcod… |
CVE-2024-7782 | High | 8.7 | 2024-08-20 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-7780 | High | 7.2 | 2024-08-20 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-7777 | Critical | 9.0 | 2024-08-20 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-7775 | Medium | 5.5 | 2024-08-20 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-7702 | High | 7.2 | 2024-08-20 | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable… |
CVE-2024-6575 | Medium | 6.4 | 2024-08-20 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-5763 | Medium | 6.4 | 2024-08-20 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-38810 | Medium | 6.5 | 2024-08-20 | Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective. |
CVE-2024-7949 | Medium | 6.3 | 2024-08-20 | A vulnerability, which was classified as critical, was found in SourceCodester Online Graduate Tracer System up to 1.0. Affected is an unknown function of the… |
CVE-2024-7948 | Low | 3.5 | 2024-08-20 | A vulnerability classified as problematic was found in SourceCodester Accounts Manager App 1.0. This vulnerability affects unknown code of the file update-acco… |
CVE-2024-7947 | High | 7.3 | 2024-08-20 | A vulnerability classified as critical has been found in SourceCodester Point of Sales and Inventory Management System 1.0. This affects an unknown part of the… |
CVE-2024-7946 | High | 7.3 | 2024-08-20 | A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functi… |
CVE-2024-7945 | Low | 3.5 | 2024-08-20 | A vulnerability was found in itsourcecode Laravel Property Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unk… |
CVE-2024-7944 | Medium | 6.3 | 2024-08-20 | A vulnerability was found in itsourcecode Laravel Property Management System 1.0. It has been classified as critical. Affected is the function UpdateDocumentsR… |
CVE-2024-7850 | Medium | 6.1 | 2024-08-20 | The BP Profile Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.5. This is due to missing or i… |
CVE-2024-7827 | High | 8.8 | 2024-08-20 | The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to boolean-based SQL Injection via the ‘model_number’ parameter in all versions up to, a… |
CVE-2024-5941 | Medium | 5.4 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capabilit… |
CVE-2024-5940 | Medium | 6.5 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-5939 | Medium | 5.3 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2024-5932 | Critical | 10.0 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 v… |
CVE-2024-7943 | Medium | 6.3 | 2024-08-20 | A vulnerability was found in itsourcecode Laravel Property Management System 1.0 and classified as critical. This issue affects the function upload of the file… |
CVE-2024-7942 | Low | 3.5 | 2024-08-20 | A vulnerability has been found in SourceCodester Leads Manager Tool 1.0 and classified as problematic. This vulnerability affects unknown code of the file upda… |
CVE-2024-7937 | Medium | 6.3 | 2024-08-20 | A vulnerability classified as critical was found in itsourcecode Project Expense Monitoring System 1.0. This vulnerability affects unknown code of the file pri… |
CVE-2024-7936 | Medium | 6.3 | 2024-08-20 | A vulnerability classified as critical has been found in itsourcecode Project Expense Monitoring System 1.0. This affects an unknown part of the file transferr… |
CVE-2024-7305 | High | 7.8 | 2024-08-20 | A maliciously crafted DWF file, when parsed in AdDwfPdk.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may lev… |
CVE-2024-7935 | Medium | 6.3 | 2024-08-19 | A vulnerability was found in itsourcecode Project Expense Monitoring System 1.0. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2024-7934 | Medium | 6.3 | 2024-08-19 | A vulnerability was found in itsourcecode Project Expense Monitoring System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2024-7933 | High | 7.3 | 2024-08-19 | A vulnerability was found in itsourcecode Project Expense Monitoring System 1.0. It has been classified as critical. Affected is an unknown function of the fil… |
CVE-2024-7931 | Medium | 6.3 | 2024-08-19 | A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. This issue affects some unknown processing of the fil… |
CVE-2024-7930 | Medium | 6.3 | 2024-08-19 | A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. This vulnerability affects unknown code of t… |
CVE-2024-7929 | Medium | 5.3 | 2024-08-19 | A vulnerability, which was classified as problematic, was found in SourceCodester Simple Forum Website 1.0. This affects an unknown part of the file /registrat… |
CVE-2024-7928 | Medium | 4.3 | 2024-08-19 | A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of… |
CVE-2024-4785 | High | 7.6 | 2024-08-19 | BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero |
CVE-2024-35539 | Medium | 6.5 | 2024-08-19 | Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several co… |
CVE-2024-35538 | Medium | 5.3 | 2024-08-19 | Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP… |
CVE-2024-7927 | High | 7.3 | 2024-08-19 | A vulnerability classified as critical was found in ZZCMS 2023. Affected by this vulnerability is an unknown functionality of the file /admin/class.php?dowhat=… |
CVE-2024-7926 | High | 7.3 | 2024-08-19 | A vulnerability classified as critical has been found in ZZCMS 2023. Affected is an unknown function of the file /admin/about_edit.php?action=modify. The manip… |
CVE-2024-43354 | Critical | 9.8 | 2024-08-19 | Deserialization of Untrusted Data vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2. |
CVE-2024-43345 | High | 7.5 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginOps Landing Page Builder allows PHP Local File Inclusion… |
CVE-2024-43328 | High | 8.3 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper EmbedPress allows PHP Local File Inclusion.This iss… |
CVE-2024-43326 | Medium | 5.4 | 2024-08-19 | Missing Authorization vulnerability in Jamie Bergen Plugin Notes Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Plugin… |
CVE-2024-43317 | Medium | 4.3 | 2024-08-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Metagauss User Registration Team RegistrationMagic… |
CVE-2024-43311 | Critical | 9.8 | 2024-08-19 | Improper Privilege Management vulnerability in Geek Code Lab Login As Users allows Privilege Escalation.This issue affects Login As Users: from n/a through 1.4… |
CVE-2024-42815 | Critical | 9.8 | 2024-08-19 | In the TP-Link RE365 V1_180213, there is a buffer overflow vulnerability due to the lack of length verification for the USER_AGENT field in /usr/bin/httpd. Att… |
CVE-2024-42813 | Critical | 9.8 | 2024-08-19 | In TRENDnet TEW-752DRU FW1.03B01, there is a buffer overflow vulnerability due to the lack of length verification for the service field in gena.cgi. Attackers… |
CVE-2024-42812 | Critical | 9.8 | 2024-08-19 | In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi. Attackers who successf… |
CVE-2024-7592 | High | 7.5 | 2024-08-19 | There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backsla… |
CVE-2024-23729 | Medium | 6.1 | 2024-08-19 | The ColorOS Internet Browser com.heytap.browser application 45.10.3.4.1 for Android allows a remote attacker to execute arbitrary JavaScript code via the com.a… |
CVE-2024-7925 | Medium | 4.3 | 2024-08-19 | A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php… |
CVE-2024-7924 | Medium | 5.3 | 2024-08-19 | A vulnerability was found in ZZCMS 2023. It has been declared as critical. This vulnerability affects unknown code of the file /I/list.php. The manipulation of… |
CVE-2024-43281 | Medium | 5.3 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VOID CODERS Void Elementor Post Grid Addon for Elementor Page b… |
CVE-2024-43280 | Medium | 4.7 | 2024-08-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/… |
CVE-2024-43272 | Medium | 5.3 | 2024-08-19 | Missing Authentication for Critical Function vulnerability in icegram Icegram allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2024-43271 | High | 8.5 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themelocation Woo Products Widgets For Elementor allows PHP Loc… |
CVE-2024-43261 | Critical | 9.6 | 2024-08-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hamed Naderfar Compute Links allows PH… |
CVE-2024-43256 | High | 7.1 | 2024-08-19 | Missing Authorization vulnerability in nouthemes Leopard - WordPress offload media allows Accessing Functionality Not Properly Constrained by ACLs.This issue a… |
CVE-2024-43252 | Critical | 9.0 | 2024-08-19 | Deserialization of Untrusted Data vulnerability in Crew HRM Crew HRM hr-management.This issue affects Crew HRM: from n/a through <= 1.1.1. |
CVE-2024-43250 | High | 7.1 | 2024-08-19 | Incorrect Authorization vulnerability in Bit Apps Bit Form Pro bitformpro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bi… |
CVE-2024-43249 | Critical | 9.9 | 2024-08-19 | Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.This issue affects Bit Form Pro: from n/a throu… |
CVE-2024-43248 | High | 8.6 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro allows File Manipulation.This issue affec… |
CVE-2024-43247 | High | 8.8 | 2024-08-19 | Missing Authorization vulnerability in creativeon WHMpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WHMpress: from n/… |
CVE-2024-43245 | Critical | 9.8 | 2024-08-19 | Improper Privilege Management vulnerability in eyecix JobSearch allows Privilege Escalation.This issue affects JobSearch: from n/a through 2.3.4. |
CVE-2024-43242 | Critical | 9.0 | 2024-08-19 | Deserialization of Untrusted Data vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a… |
CVE-2024-43401 | Critical | 9.0 | 2024-08-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user without script/programming right can trick a us… |
CVE-2024-43400 | Critical | 9.0 | 2024-08-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programmin… |
CVE-2024-43240 | Critical | 9.4 | 2024-08-19 | Improper Authentication vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <=… |
CVE-2024-43236 | Medium | 4.7 | 2024-08-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Easy PayPal Buy Now Button.This issue affects Easy PayPal Buy Now Button: f… |
CVE-2024-43232 | High | 8.5 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP OnlineSupport, Essential Plugin Timeline and History slider… |
CVE-2024-43221 | High | 8.5 | 2024-08-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetGridBuilder allows PHP Local File Inclusion.This… |
CVE-2024-42658 | Critical | 9.8 | 2024-08-19 | An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's parameter |
CVE-2024-42657 | High | 7.5 | 2024-08-19 | An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login… |
CVE-2024-37099 | Critical | 10.0 | 2024-08-19 | Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1. |
CVE-2024-32928 | Medium | 5.9 | 2024-08-19 | The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle atta… |
CVE-2024-32927 | High | 7.8 | 2024-08-19 | In sendDeviceState_1_6 of RadioExt.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no ad… |
CVE-2024-6348 | High | 7.5 | 2024-08-19 | Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict… |
CVE-2024-42633 | High | 8.8 | 2024-08-19 | A Command Injection vulnerability exists in the do_upgrade_post function of the httpd binary in Linksys E1500 v1.0.06.001. As a result, an authenticated attack… |
CVE-2024-7922 | Medium | 6.3 | 2024-08-19 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326… |
CVE-2024-43399 | High | 8.0 | 2024-08-19 | Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Befor… |
CVE-2024-43380 | Medium | 5.3 | 2024-08-19 | fugit contains time tools for flor and the floraison group. The fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 * * 3", accepted any len… |
CVE-2024-43379 | Low | 3.4 | 2024-08-19 | TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific dete… |
CVE-2024-25582 | Medium | 5.4 | 2024-08-19 | Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or e… |
CVE-2024-6843 | Medium | 6.1 | 2024-08-19 | The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to perform Stored Cros… |
CVE-2024-6451 | High | 7.2 | 2024-08-19 | AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file exten… |
CVE-2024-6330 | Critical | 9.8 | 2024-08-19 | The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads… |
CVE-2024-44083 | High | 7.5 | 2024-08-19 | ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the payload from where… |
CVE-2024-7921 | Medium | 4.3 | 2024-08-19 | A vulnerability has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805 and classified as problematic. Affected by this… |
CVE-2024-44076 | Critical | 9.8 | 2024-08-19 | In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access. |
CVE-2024-44073 | High | 7.5 | 2024-08-19 | The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth. |
CVE-2024-44070 | High | 7.5 | 2024-08-19 | An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the… |
CVE-2024-44069 | High | 7.5 | 2024-08-19 | Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. NOTE: the supplier reportedly do… |
CVE-2024-44067 | High | 8.4 | 2024-08-19 | The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged attackers to write… |
CVE-2024-7920 | Medium | 4.3 | 2024-08-19 | A vulnerability, which was classified as problematic, was found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. Affected is a… |
CVE-2024-7919 | Medium | 5.3 | 2024-08-19 | A vulnerability, which was classified as critical, has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. This issue… |
CVE-2024-7917 | Medium | 4.7 | 2024-08-18 | A vulnerability, which was classified as critical, has been found in DouPHP 1.7 Release 20220822. Affected by this issue is some unknown functionality of the f… |
CVE-2024-7916 | Low | 3.5 | 2024-08-18 | A vulnerability classified as problematic was found in nafisulbari/itsourcecode Insurance Management System 1.0. Affected by this vulnerability is an unknown f… |
CVE-2024-7914 | Low | 3.5 | 2024-08-18 | A vulnerability classified as problematic has been found in SourceCodester Yoga Class Registration System 1.0. Affected is an unknown function of the file /php… |
CVE-2024-7913 | High | 7.3 | 2024-08-18 | A vulnerability was found in itsourcecode Billing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /addclient1… |
CVE-2024-7912 | Medium | 5.3 | 2024-08-18 | A vulnerability was found in CodeAstro Online Railway Reservation System 1.0. It has been declared as problematic. This vulnerability affects unknown code of t… |