2024 CVEs (page 201)
Page 201 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41976 | High | 7.2 | 2024-08-13 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-41941 | Medium | 4.3 | 2024-08-13 | A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could all… |
CVE-2024-41940 | Critical | 9.1 | 2024-08-13 | A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly validate user input to a privileged command… |
CVE-2024-41939 | High | 8.8 | 2024-08-13 | A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could all… |
CVE-2024-41938 | Medium | 5.5 | 2024-08-13 | A vulnerability has been identified in SINEC NMS (All versions < V3.0). The importCertificate function of the SINEC NMS Control web application contains a path… |
CVE-2024-41908 | High | 7.8 | 2024-08-13 | A vulnerability has been identified in NX (All versions < V2406.3000). The affected applications contains an out of bounds read vulnerability while parsing spe… |
CVE-2024-41907 | Medium | 4.2 | 2024-08-13 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application is missing general HTTP secu… |
CVE-2024-41906 | Medium | 4.8 | 2024-08-13 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application does not properly handle cac… |
CVE-2024-41905 | Medium | 6.8 | 2024-08-13 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not have access control f… |
CVE-2024-41904 | High | 7.5 | 2024-08-13 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not properly enforce rest… |
CVE-2024-41903 | Medium | 6.6 | 2024-08-13 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application mounts the container's root… |
CVE-2024-41683 | Medium | 5.3 | 2024-08-13 | A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce a strong user password pol… |
CVE-2024-41682 | Medium | 5.3 | 2024-08-13 | A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce restriction of excessive… |
CVE-2024-41681 | Medium | 6.7 | 2024-08-13 | A vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configured to support weak ci… |
CVE-2024-39922 | Medium | 4.6 | 2024-08-13 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6… |
CVE-2024-36398 | High | 7.8 | 2024-08-13 | A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application executes a subset of its services as `NT AUTHORITY\SYSTEM`. Th… |
CVE-2024-7715 | Medium | 6.3 | 2024-08-13 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-… |
CVE-2024-7247 | Medium | 6.4 | 2024-08-13 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-6823 | High | 8.8 | 2024-08-13 | The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-uplo… |
CVE-2024-6724 | Medium | 4.8 | 2024-08-13 | The Generate Images WordPress plugin before 5.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-7092 | Medium | 6.4 | 2024-08-13 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-42373 | Medium | 4.3 | 2024-08-13 | SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privilege… |
CVE-2024-41734 | Medium | 4.3 | 2024-08-13 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction… |
CVE-2024-39591 | Medium | 4.3 | 2024-08-13 | SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact o… |
CVE-2024-42377 | Medium | 4.3 | 2024-08-13 | SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to insert value entries i… |
CVE-2024-42376 | Medium | 6.5 | 2024-08-13 | SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. On successful exp… |
CVE-2024-42375 | Medium | 4.3 | 2024-08-13 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by th… |
CVE-2024-42374 | High | 8.2 | 2024-08-13 | BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information… |
CVE-2024-41737 | Medium | 5.0 | 2024-08-13 | SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On… |
CVE-2024-41736 | Medium | 4.3 | 2024-08-13 | Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on th… |
CVE-2024-41735 | Medium | 5.4 | 2024-08-13 | SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing low impact on confid… |
CVE-2024-41733 | Medium | 5.3 | 2024-08-13 | In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a giv… |
CVE-2024-41732 | Medium | 4.7 | 2024-08-13 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web app… |
CVE-2024-41731 | Low | 3.1 | 2024-08-13 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the ap… |
CVE-2024-41730 | Critical | 9.8 | 2024-08-13 | In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token… |
CVE-2024-33005 | Medium | 6.3 | 2024-08-13 | Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP… |
CVE-2024-33003 | High | 7.4 | 2024-08-13 | Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon… |
CVE-2024-28166 | Low | 3.7 | 2024-08-13 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by th… |
CVE-2024-7388 | Medium | 4.0 | 2024-08-13 | The WP Bannerize Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via banner alt data in all versions up to, and including, 1.9.0 due to i… |
CVE-2024-7094 | Critical | 9.8 | 2024-08-13 | The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all ver… |
CVE-2024-7709 | Medium | 4.3 | 2024-08-13 | A vulnerability, which was classified as problematic, has been found in OcoMon 4.0RC1/4.0/5.0RC1. This issue affects some unknown processing of the file /inclu… |
CVE-2024-7707 | High | 8.8 | 2024-08-13 | A vulnerability was found in Tenda FH1206 02.03.01.35 and classified as critical. Affected by this issue is the function formSafeEmailFilter of the file /gofor… |
CVE-2024-7706 | Medium | 4.7 | 2024-08-12 | A vulnerability was found in Fujian mwcms 1.0.0. It has been rated as critical. Affected by this issue is the function uploadimage of the file /uploadfile.html… |
CVE-2024-7705 | Medium | 4.7 | 2024-08-12 | A vulnerability was found in Fujian mwcms 1.0.0. It has been declared as critical. Affected by this vulnerability is the function uploadeditor of the file /upl… |
CVE-2024-43150 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This… |
CVE-2024-43149 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary allows… |
CVE-2024-43148 | Medium | 5.9 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins StreamCast allows Stored XSS.This issue a… |
CVE-2024-43147 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Merkulove Selection Lite allows Stored XSS.This is… |
CVE-2024-43139 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.T… |
CVE-2024-43137 | Medium | 5.9 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WappPress Team WappPress allows Stored XSS.This is… |
CVE-2024-43133 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themify Themify Shortcodes allows Stored XSS.This… |
CVE-2024-43130 | Medium | 5.9 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.T… |
CVE-2024-43127 | High | 7.1 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPFactory Products, Order & Customers Export for W… |
CVE-2024-43126 | High | 7.1 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sender Sender – Newsletter, SMS and Email Marketin… |
CVE-2024-43125 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder – WordPress Tabl… |
CVE-2024-43124 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Iqonic Design Graphina allows Stored XSS.This issu… |
CVE-2024-43123 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Techeshta Card Elements for Elementor allows Store… |
CVE-2024-37930 | Medium | 5.3 | 2024-08-12 | Insertion of Sensitive Information into Log File vulnerability in ThemeSphere SmartMag smartmag-responsive-retina-wordpress-magazine.This issue affects SmartMa… |
CVE-2024-37924 | Medium | 5.3 | 2024-08-12 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wp2speed WP2Speed Faster allows Accessing Functionality Not Properly Constrained by… |
CVE-2024-35775 | Medium | 5.9 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Authentication vulnerability in Soliloquy Team Slider by… |
CVE-2024-7590 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg al… |
CVE-2024-43226 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jeroen Sormani WP Dashboard Notes allows Stored XS… |
CVE-2024-43225 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeLooks Enter Addons allows Stored XSS.This iss… |
CVE-2024-43224 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yuri Baranov YaMaps for WordPress allows Stored XS… |
CVE-2024-43220 | High | 7.1 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows… |
CVE-2024-43218 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mediavine Mediavine Control Panel mediavine-control-panel… |
CVE-2024-43217 | High | 7.1 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes allows Reflected… |
CVE-2024-43216 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Filr filr-protection.This issue affects Filr: fr… |
CVE-2024-43213 | High | 7.1 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MultiVendorX WC Marketplace allows Reflected XSS.T… |
CVE-2024-43210 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor allo… |
CVE-2024-43164 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Blockspare allows Stored XSS.This issue affects Bl… |
CVE-2024-43163 | High | 7.1 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Parcel Panel ParcelPanel allows Reflected XSS.This… |
CVE-2024-43161 | Medium | 5.9 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Averta Depicter Slider allows Stored XSS.This issu… |
CVE-2024-43156 | High | 7.1 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Reflected XSS… |
CVE-2024-43155 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins ComboBlocks allows Stored XSS.This iss… |
CVE-2024-43152 | Medium | 5.9 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in iberezansky 3D FlipBook – PDF Flipbook Viewer, Fli… |
CVE-2024-43151 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Beaver Builde… |
CVE-2024-7704 | Medium | 5.3 | 2024-08-12 | A vulnerability was found in Weaver e-cology 8. It has been classified as problematic. Affected is an unknown function of the file /cloudstore/ecode/setup/ecol… |
CVE-2024-43360 | Critical | 9.8 | 2024-08-12 | ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vuln… |
CVE-2024-43359 | Unrated | | 2024-08-12 | ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the montagereview via… |
CVE-2024-43358 | Medium | 6.1 | 2024-08-12 | ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the filter view via th… |
CVE-2024-43233 | High | 7.1 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BannerSky BSK Forms Blacklist allows Reflected XSS… |
CVE-2024-43231 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue aff… |
CVE-2024-43227 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper BetterDocs allows Stored XSS.This issu… |
CVE-2024-42748 | High | 8.8 | 2024-08-12 | In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg. Authenticated Attack… |
CVE-2024-42747 | High | 8.8 | 2024-08-12 | In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. Authenticated Attacker… |
CVE-2024-42745 | High | 8.8 | 2024-08-12 | In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers… |
CVE-2024-42744 | High | 8.8 | 2024-08-12 | In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser. Authenticated Att… |
CVE-2024-42743 | High | 8.8 | 2024-08-12 | In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg . Authenticated Attack… |
CVE-2024-42742 | High | 8.8 | 2024-08-12 | In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRules. Authenticated At… |
CVE-2024-42741 | High | 8.8 | 2024-08-12 | In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg. Authenticated Att… |
CVE-2024-6768 | | 2024-08-12 | A Denial of Service in CLFS.sys in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authe… | |
CVE-2024-42547 | Critical | 9.8 | 2024-08-12 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the http_host parameter in the loginauth function. |
CVE-2024-42546 | Critical | 9.8 | 2024-08-12 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the password parameter in the loginauth function. |
CVE-2024-41710 | High | 7.2 | 2024-08-12 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could a… |
CVE-2024-40893 | Medium | 6.8 | 2024-08-12 | Multiple authenticated operating system (OS) command injection vulnerabilities exist in Firewalla Box Software versions before 1.979. A physically close atta… |
CVE-2024-40892 | High | 7.1 | 2024-08-12 | A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the licens… |
CVE-2024-42545 | Critical | 9.8 | 2024-08-12 | TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the ssid parameter in setWizardCfg function. |
CVE-2024-42543 | Critical | 9.8 | 2024-08-12 | TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the http_host parameter in the loginauth function. |
CVE-2024-7700 | Medium | 6.5 | 2024-08-12 | A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page… |