2024 CVEs (page 216)
Page 216 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7168 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-7167 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-7166 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been classified as critical. Affected is an unknown function of the file /re… |
CVE-2024-7165 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in SourceCodester School Fees Payment System 1.0 and classified as critical. This issue affects some unknown processing of the file /… |
CVE-2024-7164 | High | 7.3 | 2024-07-28 | A vulnerability has been found in SourceCodester School Fees Payment System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2024-7163 | Low | 3.5 | 2024-07-28 | A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php… |
CVE-2024-7162 | Low | 3.5 | 2024-07-28 | A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0. Affected by this issue is some unknown functionality of the file js/p… |
CVE-2024-7161 | Medium | 4.3 | 2024-07-28 | A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /member.php?action=c… |
CVE-2024-7160 | Medium | 6.3 | 2024-07-28 | A vulnerability classified as critical has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWanCfg of the file /cgi-bin/cstecgi… |
CVE-2024-7159 | Medium | 5.5 | 2024-07-28 | A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been rated as critical. This issue affects some unknown processing of the file /web… |
CVE-2024-7158 | Medium | 6.3 | 2024-07-28 | A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of… |
CVE-2024-7157 | High | 8.8 | 2024-07-28 | A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been classified as critical. This affects the function getSaveConfig of the file /c… |
CVE-2024-7156 | Medium | 5.3 | 2024-07-28 | A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2024-7155 | Low | 2.5 | 2024-07-28 | A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2024-7154 | Medium | 4.3 | 2024-07-28 | A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is an unknown function of the file /wizard.h… |
CVE-2024-42055 | Medium | 5.4 | 2024-07-28 | Cervantes through 0.5-alpha allows stored XSS. |
CVE-2024-42054 | Medium | 5.4 | 2024-07-28 | Cervantes through 0.5-alpha accepts insecure file uploads. |
CVE-2024-42053 | High | 7.8 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.6.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-42052 | High | 7.8 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-42051 | High | 7.8 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-42050 | High | 7.0 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-42049 | Critical | 9.1 | 2024-07-28 | TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection. |
CVE-2024-7153 | Medium | 5.3 | 2024-07-27 | A vulnerability classified as problematic has been found in Netgear WN604 up to 20240719. Affected is an unknown function of the file siteSurvey.php. The manip… |
CVE-2024-7152 | High | 8.8 | 2024-07-27 | A vulnerability was found in Tenda O3 1.0.0.10(2478). It has been rated as critical. This issue affects the function fromSafeSetMacFilter of the file /goform/s… |
CVE-2024-7151 | High | 8.8 | 2024-07-27 | A vulnerability was found in Tenda O3 1.0.0.10(2478). It has been declared as critical. This vulnerability affects the function fromMacFilterSet of the file /g… |
CVE-2024-6703 | Medium | 4.9 | 2024-07-27 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-6897 | Medium | 6.4 | 2024-07-27 | The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.53 d… |
CVE-2024-6627 | Medium | 6.4 | 2024-07-27 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's PDF View widget in all versions up to, and in… |
CVE-2024-6521 | Medium | 4.4 | 2024-07-27 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-6520 | Medium | 4.4 | 2024-07-27 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-6518 | Medium | 4.4 | 2024-07-27 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-5614 | Medium | 5.3 | 2024-07-27 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'paf… |
CVE-2024-6569 | Medium | 5.3 | 2024-07-27 | The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plu… |
CVE-2024-6458 | Medium | 6.4 | 2024-07-27 | The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_pre… |
CVE-2024-5969 | Medium | 5.8 | 2024-07-27 | The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 2.0.5. This i… |
CVE-2024-42029 | Medium | 6.3 | 2024-07-27 | xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single quotes are not used… |
CVE-2024-6661 | Medium | 4.4 | 2024-07-27 | The ParityPress – Parity Pricing with Discount Rules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Discount Text' in all versions up… |
CVE-2024-6634 | Medium | 6.4 | 2024-07-27 | The Master Currency WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currencyconverterform shortcode in all versions up to… |
CVE-2024-6591 | Medium | 5.8 | 2024-07-27 | The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 's… |
CVE-2024-6573 | Medium | 5.3 | 2024-07-27 | The Intelligence plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.0. This is due the plugin not preventing… |
CVE-2024-6566 | Medium | 5.3 | 2024-07-27 | The Aramex Shipping WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.21. This is due the plugin… |
CVE-2024-6549 | Medium | 5.3 | 2024-07-27 | The Admin Post Navigation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1. This is due to the plugin utili… |
CVE-2024-6548 | Medium | 5.3 | 2024-07-27 | The Add Admin JavaScript plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to the plugin utiliz… |
CVE-2024-6547 | Medium | 5.3 | 2024-07-27 | The Add Admin CSS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin utilizing… |
CVE-2024-6546 | Medium | 5.3 | 2024-07-27 | The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is due to the plugin… |
CVE-2024-6545 | Medium | 5.3 | 2024-07-27 | The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due to the plugin util… |
CVE-2024-6431 | High | 8.8 | 2024-07-27 | The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the… |
CVE-2024-6152 | High | 8.8 | 2024-07-27 | The Flipbox Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5 via deserialization of untrusted input… |
CVE-2024-4410 | Medium | 5.4 | 2024-07-27 | The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to miss… |
CVE-2024-1804 | Medium | 4.3 | 2024-07-27 | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutor_import_fr… |
CVE-2024-1798 | Medium | 5.3 | 2024-07-27 | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tutor_lp_export_xml f… |
CVE-2024-40433 | High | 8.8 | 2024-07-26 | Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component. |
CVE-2024-37034 | Medium | 5.9 | 2024-07-26 | An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) ser… |
CVE-2024-41815 | High | 7.4 | 2024-07-26 | Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules ma… |
CVE-2024-41628 | High | 7.5 | 2024-07-26 | Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote… |
CVE-2024-41120 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on… |
CVE-2024-41119 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41118 | High | 7.5 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on… |
CVE-2024-41117 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41116 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41115 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `palette` variable… |
CVE-2024-41114 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `palette` variable… |
CVE-2024-4786 | Low | 2.8 | 2024-07-26 | An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted application to keep the device on. |
CVE-2024-41113 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` varia… |
CVE-2024-41112 | Critical | 9.8 | 2024-07-26 | streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable i… |
CVE-2024-40117 | Critical | 9.8 | 2024-07-26 | Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the we… |
CVE-2024-40116 | High | 8.1 | 2024-07-26 | An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files… |
CVE-2024-38512 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via… |
CVE-2024-38511 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privi… |
CVE-2024-38510 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privile… |
CVE-2024-38509 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a… |
CVE-2024-38508 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC us… |
CVE-2024-42007 | Medium | 5.8 | 2024-07-26 | SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory Traversal to read arbitrary files. |
CVE-2024-39304 | High | 8.8 | 2024-07-26 | ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an imp… |
CVE-2024-38872 | High | 8.3 | 2024-07-26 | Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module. |
CVE-2024-38871 | High | 8.3 | 2024-07-26 | Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module. |
CVE-2024-41813 | High | 7.5 | 2024-07-26 | txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and prior to version 1… |
CVE-2024-41812 | High | 7.5 | 2024-07-26 | txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Server-Side Request Fo… |
CVE-2024-41375 | Medium | 6.1 | 2024-07-26 | ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php |
CVE-2024-41374 | Medium | 6.1 | 2024-07-26 | ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php |
CVE-2024-41373 | Medium | 6.3 | 2024-07-26 | ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php. |
CVE-2024-41354 | High | 7.1 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php |
CVE-2024-41353 | High | 7.1 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php |
CVE-2024-27358 | Low | 3.3 | 2024-07-26 | An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security through 23.x for macOS. Local users can blo… |
CVE-2024-27357 | Medium | 5.8 | 2024-07-26 | An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and WithSecure MDR thr… |
CVE-2024-26520 | Critical | 9.8 | 2024-07-26 | An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authenticat… |
CVE-2024-24257 | High | 7.5 | 2024-07-26 | An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information via a crafted script… |
CVE-2024-7050 | | 2024-07-26 | Improper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular scenarios.This issue a… | |
CVE-2024-41357 | High | 7.1 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php. |
CVE-2024-41356 | Medium | 4.7 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php. |
CVE-2024-41355 | Medium | 6.5 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php. |
CVE-2024-41805 | Medium | 6.1 | 2024-07-26 | Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected cross-site scripting… |
CVE-2024-41670 | High | 7.5 | 2024-07-26 | In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer… |
CVE-2024-7128 | Medium | 5.3 | 2024-07-26 | A flaw was found in the OpenShift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the… |
CVE-2024-6922 | | 2024-07-26 | Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the… | |
CVE-2024-40689 | Medium | 6.0 | 2024-07-26 | IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the att… |
CVE-2024-41692 | | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An… | |
CVE-2024-7062 | High | 8.8 | 2024-07-26 | Nimble Commander suffers from a privilege escalation vulnerability due to the server (info.filesmanager.Files.PrivilegedIOHelperV2) performing improper/insuffi… |
CVE-2024-41691 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem associated w… |
CVE-2024-41690 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext within the router's fi… |