2024 CVEs (page 216)
Page 216 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6362 | Medium | 4.6 | 2024-07-29 | The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/po… |
CVE-2024-5883 | Medium | 4.7 | 2024-07-29 | The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle… |
CVE-2024-5882 | High | 7.5 | 2024-07-29 | The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access… |
CVE-2024-5285 | Medium | 5.5 | 2024-07-29 | The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logge… |
CVE-2024-4483 | Medium | 5.4 | 2024-07-29 | The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an… |
CVE-2024-41637 | High | 8.3 | 2024-07-29 | RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privilege… |
CVE-2024-37381 | High | 8.0 | 2024-07-29 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary… |
CVE-2024-7184 | High | 8.8 | 2024-07-29 | A vulnerability has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. Affected by this vulnerability is the function setUrlFilte… |
CVE-2024-7183 | High | 8.8 | 2024-07-29 | A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected is the function setUploadSetting of the file /… |
CVE-2024-7202 | Critical | 9.8 | 2024-07-29 | The query functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to i… |
CVE-2024-7182 | High | 8.8 | 2024-07-29 | A vulnerability, which was classified as critical, has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This issue affects the function setUpgradeFW of th… |
CVE-2024-7181 | Medium | 6.3 | 2024-07-29 | A vulnerability classified as critical was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This vulnerability affects the function setTelnetCfg of the file /c… |
CVE-2024-7201 | Critical | 9.8 | 2024-07-29 | The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to i… |
CVE-2024-7180 | High | 8.8 | 2024-07-29 | A vulnerability classified as critical has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This affects the function setPortForwardRules of the file /cgi… |
CVE-2024-7179 | High | 8.8 | 2024-07-29 | A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been rated as critical. Affected by this issue is the function setParentalRules of… |
CVE-2024-7178 | High | 8.8 | 2024-07-29 | A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been declared as critical. Affected by this vulnerability is the function setMacQos… |
CVE-2024-5670 | Critical | 9.8 | 2024-07-29 | The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attacke… |
CVE-2024-32671 | Critical | 9.8 | 2024-07-29 | Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0. |
CVE-2024-7177 | High | 8.8 | 2024-07-29 | A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been classified as critical. Affected is the function setLanguageCfg of the file /c… |
CVE-2024-7176 | High | 8.8 | 2024-07-29 | A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. This issue affects the function setIpQosRules of the file /cgi-… |
CVE-2024-7175 | Medium | 6.3 | 2024-07-29 | A vulnerability has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. This vulnerability affects the function setDiagnosisCfg of… |
CVE-2024-7174 | High | 8.8 | 2024-07-29 | A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This affects the function setdeviceName of the file /cg… |
CVE-2024-7173 | High | 8.8 | 2024-07-29 | A vulnerability, which was classified as critical, has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function loginauth o… |
CVE-2024-7172 | High | 8.8 | 2024-07-28 | A vulnerability classified as critical was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected by this vulnerability is the function getSaveConfig of the… |
CVE-2024-7171 | Medium | 6.3 | 2024-07-28 | A vulnerability classified as critical has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected is the function NTPSyncWithHost of the file /cgi-bin/… |
CVE-2024-7170 | Low | 3.5 | 2024-07-28 | A vulnerability was found in TOTOLINK A3000RU 5.9c.5185. It has been rated as problematic. This issue affects some unknown processing of the file /web_cste/cgi… |
CVE-2024-7169 | Medium | 4.3 | 2024-07-28 | A vulnerability classified as problematic has been found in SourceCodester School Fees Payment System 1.0. This affects an unknown part of the file /ajax.php… |
CVE-2024-7168 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-7167 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-7166 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been classified as critical. Affected is an unknown function of the file /re… |
CVE-2024-7165 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in SourceCodester School Fees Payment System 1.0 and classified as critical. This issue affects some unknown processing of the file /… |
CVE-2024-7164 | High | 7.3 | 2024-07-28 | A vulnerability has been found in SourceCodester School Fees Payment System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2024-7163 | Low | 3.5 | 2024-07-28 | A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php… |
CVE-2024-7162 | Low | 3.5 | 2024-07-28 | A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0. Affected by this issue is some unknown functionality of the file js/p… |
CVE-2024-7161 | Medium | 4.3 | 2024-07-28 | A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /member.php?action=c… |
CVE-2024-7160 | Medium | 6.3 | 2024-07-28 | A vulnerability classified as critical has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWanCfg of the file /cgi-bin/cstecgi… |
CVE-2024-7159 | Medium | 5.5 | 2024-07-28 | A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been rated as critical. This issue affects some unknown processing of the file /web… |
CVE-2024-7158 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of… |
CVE-2024-7157 | High | 8.8 | 2024-07-28 | A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been classified as critical. This affects the function getSaveConfig of the file /c… |
CVE-2024-7156 | Medium | 5.3 | 2024-07-28 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2024-7155 | Low | 2.5 | 2024-07-28 | A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2024-7154 | Medium | 4.3 | 2024-07-28 | A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is an unknown function of the file /wizard.h… |
CVE-2024-42055 | Medium | 5.4 | 2024-07-28 | Cervantes through 0.5-alpha allows stored XSS. |
CVE-2024-42054 | Medium | 5.4 | 2024-07-28 | Cervantes through 0.5-alpha accepts insecure file uploads. |
CVE-2024-42053 | High | 7.8 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.6.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-42052 | High | 7.8 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-42051 | High | 7.8 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-42050 | High | 7.0 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-42049 | Critical | 9.1 | 2024-07-28 | TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection. |
CVE-2024-7153 | Medium | 5.3 | 2024-07-27 | A vulnerability classified as problematic has been found in Netgear WN604 up to 20240719. Affected is an unknown function of the file siteSurvey.php. The manip… |
CVE-2024-7152 | High | 8.8 | 2024-07-27 | A vulnerability was found in Tenda O3 1.0.0.10(2478). It has been rated as critical. This issue affects the function fromSafeSetMacFilter of the file /goform/s… |
CVE-2024-7151 | High | 8.8 | 2024-07-27 | A vulnerability was found in Tenda O3 1.0.0.10(2478). It has been declared as critical. This vulnerability affects the function fromMacFilterSet of the file /g… |
CVE-2024-6703 | Medium | 4.9 | 2024-07-27 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-6897 | Medium | 6.4 | 2024-07-27 | The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.53 d… |
CVE-2024-6627 | Medium | 6.4 | 2024-07-27 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's PDF View widget in all versions up to, and in… |
CVE-2024-6521 | Medium | 4.4 | 2024-07-27 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-6520 | Medium | 4.4 | 2024-07-27 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-6518 | Medium | 4.4 | 2024-07-27 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-5614 | Medium | 5.3 | 2024-07-27 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'paf… |
CVE-2024-6569 | Medium | 5.3 | 2024-07-27 | The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plu… |
CVE-2024-6458 | Medium | 6.4 | 2024-07-27 | The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_pre… |
CVE-2024-5969 | Medium | 5.8 | 2024-07-27 | The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 2.0.5. This i… |
CVE-2024-42029 | Medium | 6.3 | 2024-07-27 | xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single quotes are not used… |
CVE-2024-6661 | Medium | 4.4 | 2024-07-27 | The ParityPress – Parity Pricing with Discount Rules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Discount Text' in all versions up… |
CVE-2024-6634 | Medium | 6.4 | 2024-07-27 | The Master Currency WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currencyconverterform shortcode in all versions up to… |
CVE-2024-6591 | Medium | 5.8 | 2024-07-27 | The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 's… |
CVE-2024-6573 | Medium | 5.3 | 2024-07-27 | The Intelligence plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.0. This is due the plugin not preventing… |
CVE-2024-6566 | Medium | 5.3 | 2024-07-27 | The Aramex Shipping WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.21. This is due the plugin… |
CVE-2024-6549 | Medium | 5.3 | 2024-07-27 | The Admin Post Navigation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1. This is due to the plugin utili… |
CVE-2024-6548 | Medium | 5.3 | 2024-07-27 | The Add Admin JavaScript plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to the plugin utiliz… |
CVE-2024-6547 | Medium | 5.3 | 2024-07-27 | The Add Admin CSS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin utilizing… |
CVE-2024-6546 | Medium | 5.3 | 2024-07-27 | The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is due to the plugin… |
CVE-2024-6545 | Medium | 5.3 | 2024-07-27 | The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due to the plugin util… |
CVE-2024-6431 | High | 8.8 | 2024-07-27 | The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the… |
CVE-2024-6152 | High | 8.8 | 2024-07-27 | The Flipbox Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5 via deserialization of untrusted input… |
CVE-2024-4410 | Medium | 5.4 | 2024-07-27 | The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to miss… |
CVE-2024-1804 | Medium | 4.3 | 2024-07-27 | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutor_import_fr… |
CVE-2024-1798 | Medium | 5.3 | 2024-07-27 | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tutor_lp_export_xml f… |
CVE-2024-40433 | High | 8.8 | 2024-07-26 | Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component. |
CVE-2024-37034 | Medium | 5.9 | 2024-07-26 | An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) ser… |
CVE-2024-41815 | High | 7.4 | 2024-07-26 | Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules ma… |
CVE-2024-41628 | High | 7.5 | 2024-07-26 | Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote… |
CVE-2024-41120 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on… |
CVE-2024-41119 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41118 | High | 7.5 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on… |
CVE-2024-41117 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41116 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41115 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `palette` variable… |
CVE-2024-41114 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `palette` variable… |
CVE-2024-4786 | Low | 2.8 | 2024-07-26 | An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted application to keep the device on. |
CVE-2024-41113 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41112 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable i… |
CVE-2024-40117 | Critical | 9.8 | 2024-07-26 | Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the we… |
CVE-2024-40116 | High | 8.1 | 2024-07-26 | An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files… |
CVE-2024-38512 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via… |
CVE-2024-38511 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privi… |
CVE-2024-38510 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privile… |
CVE-2024-38509 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a… |
CVE-2024-38508 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC us… |
CVE-2024-42007 | Medium | 5.8 | 2024-07-26 | SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory Traversal to read arbitrary files. |