2024 CVEs (page 209)
Page 209 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7323 | Medium | 6.5 | 2024-08-02 | Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with… |
CVE-2024-7204 | Medium | 6.1 | 2024-08-02 | Ai3 QbiBot does not properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. Once the recipient views… |
CVE-2024-6704 | Medium | 5.3 | 2024-08-02 | The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering o… |
CVE-2024-40723 | Medium | 4.3 | 2024-08-02 | The specific API in HWATAIServiSign Windows Version from CHANGING Information Technology does not properly validate the length of server-side inputs. When a us… |
CVE-2024-40722 | Medium | 4.3 | 2024-08-02 | The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-side input. When a u… |
CVE-2024-40721 | High | 8.8 | 2024-08-02 | The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofe… |
CVE-2024-40720 | High | 8.8 | 2024-08-02 | The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofe… |
CVE-2024-38879 | High | 7.5 | 2024-08-02 | A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (… |
CVE-2024-38878 | High | 7.2 | 2024-08-02 | A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (… |
CVE-2024-38877 | High | 8.2 | 2024-08-02 | A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3… |
CVE-2024-38876 | High | 7.8 | 2024-08-02 | A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3… |
CVE-2024-4643 | Medium | 6.4 | 2024-08-02 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-40719 | Medium | 6.5 | 2024-08-02 | The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker trick… |
CVE-2024-36268 | Critical | 9.8 | 2024-08-02 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which… |
CVE-2024-27182 | Medium | 4.9 | 2024-08-02 | In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by… |
CVE-2024-27181 | High | 8.8 | 2024-08-02 | In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token… |
CVE-2024-38776 | High | 7.1 | 2024-08-02 | Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson WP GoToWebinar allows Cross-Site Scripting (XSS).This issue affects WP GoToWebinar: from n/a t… |
CVE-2024-42461 | Critical | 9.1 | 2024-08-02 | In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed. |
CVE-2024-42460 | Medium | 5.3 | 2024-08-02 | In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero. |
CVE-2024-42459 | Medium | 5.3 | 2024-08-02 | In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes ca… |
CVE-2024-3238 | High | 8.8 | 2024-08-02 | The WordPress Menu Plugin — Superfly Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0… |
CVE-2024-39396 | Medium | 5.5 | 2024-08-02 | InDesign Desktop versions ID18.5.2, ID19.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2024-39392 | High | 7.8 | 2024-08-02 | InDesign Desktop versions ID18.5.2, ID19.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2024-5595 | Medium | 5.4 | 2024-08-02 | The Essential Blocks WordPress plugin before 4.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the… |
CVE-2024-3827 | Medium | 6.4 | 2024-08-02 | The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient… |
CVE-2024-7389 | High | 7.5 | 2024-08-02 | The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hub… |
CVE-2024-42458 | Critical | 9.8 | 2024-08-02 | server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369. |
CVE-2024-38482 | Medium | 6.6 | 2024-08-02 | CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component. A highly privileged mali… |
CVE-2024-7378 | Medium | 6.3 | 2024-08-02 | A vulnerability was found in SourceCodester Simple Realtime Quiz System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2024-7377 | Medium | 6.3 | 2024-08-02 | A vulnerability has been found in SourceCodester Simple Realtime Quiz System 1.0 and classified as critical. Affected by this vulnerability is an unknown funct… |
CVE-2024-7376 | Medium | 6.3 | 2024-08-02 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Realtime Quiz System 1.0. Affected is an unknown function of the file /pr… |
CVE-2024-6567 | Medium | 5.3 | 2024-08-02 | The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. This is due to the plugin utilizing fp… |
CVE-2024-7375 | Medium | 6.3 | 2024-08-02 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Realtime Quiz System 1.0. This issue affects some unknown processing… |
CVE-2024-7374 | Medium | 6.3 | 2024-08-02 | A vulnerability classified as critical was found in SourceCodester Simple Realtime Quiz System 1.0. This vulnerability affects unknown code of the file /manage… |
CVE-2024-22278 | Medium | 6.4 | 2024-08-02 | Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations. |
CVE-2024-7373 | Medium | 6.3 | 2024-08-02 | A vulnerability classified as critical has been found in SourceCodester Simple Realtime Quiz System 1.0. This affects an unknown part of the file /ajax.php?act… |
CVE-2024-7372 | Medium | 6.3 | 2024-08-02 | A vulnerability was found in SourceCodester Simple Realtime Quiz System 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2024-7371 | Medium | 6.3 | 2024-08-01 | A vulnerability was found in SourceCodester Simple Realtime Quiz System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2024-7370 | Medium | 6.3 | 2024-08-01 | A vulnerability was found in SourceCodester Simple Realtime Quiz System 1.0. It has been classified as critical. Affected is an unknown function of the file /m… |
CVE-2024-39647 | High | 7.1 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message… |
CVE-2024-39646 | High | 7.1 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kunal Custom 404 Pro custom-404-pro.This issue affects Cu… |
CVE-2024-39644 | Medium | 6.5 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor allo… |
CVE-2024-39643 | Medium | 5.8 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RegistrationMagic Forms RegistrationMagic allows S… |
CVE-2024-39631 | High | 7.1 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Galle… |
CVE-2024-39629 | Medium | 5.9 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue… |
CVE-2024-39627 | Medium | 5.9 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Imagely NextGEN Gallery allows Stored XSS.This iss… |
CVE-2024-39626 | Medium | 5.9 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rob @ 5 Star Plugins Pretty Simple Popup Builder pretty-s… |
CVE-2024-7369 | High | 7.3 | 2024-08-01 | A vulnerability was found in SourceCodester Simple Realtime Quiz System 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-7368 | Low | 3.5 | 2024-08-01 | A vulnerability has been found in SourceCodester Simple Realtime Quiz System 1.0 and classified as problematic. This vulnerability affects unknown code of the… |
CVE-2024-41965 | Medium | 4.2 | 2024-08-01 | Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do w… |
CVE-2024-41957 | Medium | 4.5 | 2024-08-01 | Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will… |
CVE-2024-41956 | High | 8.1 | 2024-08-01 | Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Se… |
CVE-2024-41949 | Low | 3.0 | 2024-08-01 | biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be genera… |
CVE-2024-41948 | Low | 3.0 | 2024-08-01 | biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be genera… |
CVE-2024-39668 | Medium | 6.5 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor allows Sto… |
CVE-2024-39667 | Medium | 6.5 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stor… |
CVE-2024-39665 | Medium | 6.5 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in YMC Filter & Grids allows Stored XSS.This issue af… |
CVE-2024-39663 | High | 7.1 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This iss… |
CVE-2024-39662 | Medium | 6.5 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor allo… |
CVE-2024-39661 | Medium | 6.5 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ExtendThemes Kubio AI Page Builder.This issue affe… |
CVE-2024-39660 | Medium | 5.9 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jordy Meow Photo Engine allows Stored XSS.This iss… |
CVE-2024-39659 | Medium | 6.5 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Stored… |
CVE-2024-39656 | High | 7.1 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Tin Canny Reporting for LearnDash allo… |
CVE-2024-39655 | Medium | 6.5 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creator… |
CVE-2024-39652 | High | 7.1 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Reflec… |
CVE-2024-39649 | Medium | 6.5 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addo… |
CVE-2024-39648 | Medium | 5.9 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue a… |
CVE-2024-39637 | Medium | 5.4 | 2024-08-01 | Server-Side Request Forgery (SSRF) vulnerability in pixelcurve Edubin edubin.This issue affects Edubin: from n/a through <= 9.2.0. |
CVE-2024-39636 | High | 8.3 | 2024-08-01 | Deserialization of Untrusted Data vulnerability in CodeSolz Better Find and Replace.This issue affects Better Find and Replace: from n/a through 1.6.1. |
CVE-2024-38761 | High | 7.5 | 2024-08-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from… |
CVE-2024-32931 | Medium | 5.7 | 2024-08-01 | Under certain circumstances the exacqVision Web Service can expose authentication token details within communications. |
CVE-2024-32865 | Medium | 6.4 | 2024-08-01 | Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices. |
CVE-2024-32862 | Medium | 6.8 | 2024-08-01 | Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains. |
CVE-2024-32758 | High | 7.5 | 2024-08-01 | Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange |
CVE-2024-7367 | Medium | 4.3 | 2024-08-01 | A vulnerability, which was classified as problematic, was found in SourceCodester Simple Realtime Quiz System 1.0. This affects an unknown part of the file /aj… |
CVE-2024-7366 | High | 7.3 | 2024-08-01 | A vulnerability was found in SourceCodester Tracking Monitoring Management System 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2024-7093 | | 2024-08-01 | Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly san… | |
CVE-2024-41259 | Critical | 9.1 | 2024-08-01 | Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information. |
CVE-2024-39634 | High | 8.8 | 2024-08-01 | Improper Privilege Management vulnerability in IdeaBox PowerPack Pro for Elementor allows Privilege Escalation.This issue affects PowerPack Pro for Elementor… |
CVE-2024-39633 | High | 8.8 | 2024-08-01 | Improper Privilege Management vulnerability in IdeaBox PowerPack for Beaver Builder allows Privilege Escalation.This issue affects PowerPack for Beaver Builder… |
CVE-2024-39630 | Medium | 5.5 | 2024-08-01 | Deserialization of Untrusted Data vulnerability in MotoPress Timetable and Event Schedule allows Object Injection.This issue affects Timetable and Event Schedu… |
CVE-2024-39624 | High | 8.5 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclus… |
CVE-2024-39621 | High | 8.0 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File… |
CVE-2024-39619 | Critical | 9.0 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File… |
CVE-2024-38791 | Medium | 4.9 | 2024-08-01 | Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: Chat… |
CVE-2024-38775 | High | 7.2 | 2024-08-01 | Improper Privilege Management vulnerability in WebAppick CTX Feed allows Privilege Escalation.This issue affects CTX Feed: from n/a through 6.5.6. |
CVE-2024-38772 | Medium | 6.5 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetWidgets for Elementor and WooCommerce allows PHP… |
CVE-2024-38770 | Critical | 9.8 | 2024-08-01 | Improper Privilege Management vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Privilege Escalation, Authentication Bypass.This issue affe… |
CVE-2024-38768 | Medium | 4.3 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Webangon The Pack Elementor addons allows PHP Local File Inclus… |
CVE-2024-38746 | High | 7.1 | 2024-08-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MakeStories Team MakeStories (for Google Web Stories) allows Pa… |
CVE-2024-32864 | Medium | 6.4 | 2024-08-01 | Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS) |
CVE-2024-32863 | Medium | 6.8 | 2024-08-01 | Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF) |
CVE-2024-7365 | Medium | 6.3 | 2024-08-01 | A vulnerability was found in SourceCodester Tracking Monitoring Management System 1.0 and classified as critical. Affected by this issue is some unknown functi… |
CVE-2024-7364 | Medium | 6.3 | 2024-08-01 | A vulnerability has been found in SourceCodester Tracking Monitoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unk… |
CVE-2024-7363 | Medium | 6.3 | 2024-08-01 | A vulnerability, which was classified as critical, was found in SourceCodester Tracking Monitoring Management System 1.0. Affected is an unknown function of th… |
CVE-2024-7362 | Medium | 6.3 | 2024-08-01 | A vulnerability, which was classified as critical, has been found in SourceCodester Tracking Monitoring Management System 1.0. This issue affects some unknown… |
CVE-2024-4353 | Medium | 4.8 | 2024-08-01 | Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input fie… |
CVE-2024-7361 | Medium | 6.3 | 2024-08-01 | A vulnerability classified as critical was found in SourceCodester Tracking Monitoring Management System 1.0. This vulnerability affects unknown code of the fi… |
CVE-2024-7360 | Medium | 4.3 | 2024-08-01 | A vulnerability classified as problematic has been found in SourceCodester Tracking Monitoring Management System 1.0. This affects an unknown part of the file… |
CVE-2024-7256 | High | 8.8 | 2024-08-01 | Insufficient data validation in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to execute arbitrary code via a crafted HTML… |