2024 CVEs (page 219)
Page 219 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6420 | High | 8.6 | 2024-07-23 | The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthen… |
CVE-2024-6231 | Medium | 5.9 | 2024-07-23 | The Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-4260 | Medium | 6.5 | 2024-07-23 | The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could a… |
CVE-2024-6885 | High | 8.1 | 2024-07-23 | The MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path… |
CVE-2024-6828 | High | 7.2 | 2024-07-23 | The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Col… |
CVE-2024-1575 | Medium | 6.5 | 2024-07-23 | The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions could allow an authenticated user to es… |
CVE-2024-6717 | High | 7.7 | 2024-07-23 | HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation director… |
CVE-2024-24507 | Medium | 6.1 | 2024-07-22 | Cross Site Scripting vulnerability in Act-On 2023 allows a remote attacker to execute arbitrary code via the newUser parameter in the login.jsp component. |
CVE-2024-6913 | High | 8.8 | 2024-07-22 | Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlu… |
CVE-2024-6912 | Critical | 9.8 | 2024-07-22 | Use of hard-coded MSSQL credentials in PerkinElmer ProcessPlus on Windows allows an attacker to login remove on all prone installations.This issue affects Proc… |
CVE-2024-6911 | High | 7.5 | 2024-07-22 | Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affec… |
CVE-2024-6806 | Critical | 9.8 | 2024-07-22 | The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code ex… |
CVE-2024-6805 | High | 7.5 | 2024-07-22 | The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may result in informat… |
CVE-2024-6794 | Critical | 9.8 | 2024-07-22 | A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploi… |
CVE-2024-6793 | Critical | 9.8 | 2024-07-22 | A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation… |
CVE-2024-6791 | High | 7.8 | 2024-07-22 | A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation… |
CVE-2024-40502 | Critical | 9.8 | 2024-07-22 | SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute arbitrary code via the btn_login_b_Click… |
CVE-2024-6675 | High | 7.8 | 2024-07-22 | A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacke… |
CVE-2024-6638 | Medium | 5.5 | 2024-07-22 | An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation… |
CVE-2024-6122 | Medium | 5.5 | 2024-07-22 | An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via loc… |
CVE-2024-6121 | High | 7.8 | 2024-07-22 | An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI System… |
CVE-2024-39250 | Critical | 9.8 | 2024-07-22 | EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interface. |
CVE-2024-34329 | High | 8.4 | 2024-07-22 | Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execu… |
CVE-2024-41880 | Medium | 5.3 | 2024-07-22 | In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and private routes. |
CVE-2024-40075 | Medium | 4.3 | 2024-07-22 | Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability. |
CVE-2024-38944 | Critical | 9.8 | 2024-07-22 | An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 c… |
CVE-2024-37380 | Medium | 5.3 | 2024-07-22 | A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point. Affected Products: Uni… |
CVE-2024-41130 | Medium | 5.4 | 2024-07-22 | llama.cpp provides LLM inference in C/C++. Prior to b3427, llama.cpp contains a null pointer dereference in gguf_init_from_file. This vulnerability is fixed in… |
CVE-2024-40634 | High | 7.5 | 2024-07-22 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated att… |
CVE-2024-40051 | High | 7.5 | 2024-07-22 | IP Guard v4.81.0307.0 was discovered to contain an arbitrary file read vulnerability via the file name parameter. |
CVE-2024-28698 | Critical | 9.8 | 2024-07-22 | Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileForm… |
CVE-2024-39688 | Medium | 6.5 | 2024-07-22 | Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is concatenated with other folders and used to open a new… |
CVE-2024-39686 | Critical | 9.8 | 2024-07-22 | Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is used directly in a command executed with subprocess.ru… |
CVE-2024-39685 | Critical | 9.8 | 2024-07-22 | Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is used directly in a command executed with subprocess.ru… |
CVE-2024-41829 | Low | 3.5 | 2024-07-22 | In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection |
CVE-2024-41828 | Low | 2.6 | 2024-07-22 | In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time |
CVE-2024-41827 | High | 7.4 | 2024-07-22 | In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration |
CVE-2024-41826 | Low | 3.5 | 2024-07-22 | In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page |
CVE-2024-41825 | Medium | 4.6 | 2024-07-22 | In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab |
CVE-2024-41824 | Medium | 6.4 | 2024-07-22 | In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases |
CVE-2024-41132 | Medium | 5.3 | 2024-07-22 | ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive me… |
CVE-2024-41131 | High | 7.5 | 2024-07-22 | ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a… |
CVE-2024-41129 | Medium | 4.4 | 2024-07-22 | The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of… |
CVE-2024-32484 | High | 7.4 | 2024-07-22 | An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to J… |
CVE-2024-32152 | Low | 3.1 | 2024-07-22 | A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary fi… |
CVE-2024-29073 | Medium | 5.3 | 2024-07-22 | An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes… |
CVE-2024-26020 | Critical | 9.6 | 2024-07-22 | An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code… |
CVE-2024-21552 | Critical | 9.8 | 2024-07-22 | All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to expl… |
CVE-2024-41320 | High | 8.8 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the get_apcli_conn_info function. |
CVE-2024-41318 | Critical | 9.8 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode functio… |
CVE-2024-41317 | High | 8.0 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function. |
CVE-2024-41316 | Critical | 9.8 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function. |
CVE-2024-41315 | Medium | 6.8 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function. |
CVE-2024-41314 | Medium | 6.8 | 2024-07-22 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function. |
CVE-2024-39902 | Medium | 4.8 | 2024-07-22 | Tuleap is an open source suite to improve management of software developments and collaboration. Prior to Tuleap Community Edition 15.10.99.128 and Tuleap Ente… |
CVE-2024-39601 | Medium | 6.5 | 2024-07-22 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). Affected dev… |
CVE-2024-37998 | Critical | 9.8 | 2024-07-22 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). The password… |
CVE-2024-25638 | High | 8.9 | 2024-07-22 | dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs… |
CVE-2024-38788 | High | 7.6 | 2024-07-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bởi Admin 2020 UiPress lite allows SQL Injection.This iss… |
CVE-2024-38773 | Critical | 9.3 | 2024-07-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows B… |
CVE-2024-38759 | Medium | 5.4 | 2024-07-22 | Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.This issue affects Search & Replace: from n/a through 3.2.2. |
CVE-2024-38755 | High | 8.5 | 2024-07-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Designinvento DirectoryPress allows SQL Injection.This is… |
CVE-2024-38730 | Medium | 4.9 | 2024-07-22 | Server-Side Request Forgery (SSRF) vulnerability in Noor alam Magical Addons For Elementor.This issue affects Magical Addons For Elementor: from n/a through 1… |
CVE-2024-38728 | High | 7.2 | 2024-07-22 | Server-Side Request Forgery (SSRF) vulnerability in Seraphinite Solutions Seraphinite Post .DOCX Source.This issue affects Seraphinite Post .DOCX Source: from… |
CVE-2024-38723 | Medium | 6.4 | 2024-07-22 | Server-Side Request Forgery (SSRF) vulnerability in Bernhard Kux JSON Content Importer.This issue affects JSON Content Importer: from n/a through 1.5.6. |
CVE-2024-38708 | High | 8.5 | 2024-07-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with In… |
CVE-2024-38701 | Medium | 4.3 | 2024-07-22 | Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4. |
CVE-2024-38692 | High | 7.6 | 2024-07-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This… |
CVE-2024-37942 | High | 7.2 | 2024-07-22 | Server-Side Request Forgery (SSRF) vulnerability in Berqier Ltd BerqWP.This issue affects BerqWP: from n/a through 1.7.5. |
CVE-2024-6542 | Medium | 6.5 | 2024-07-22 | Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk <= 2.0.0p39, < 2.1.0p47, < 2.2.0p32 and < 2.3.0p11 allows arbitrary livestatus… |
CVE-2024-38503 | Medium | 5.4 | 2024-07-22 | When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vuln… |
CVE-2024-37244 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ninja Team Ninja Beaver Add-ons for Beaver Builder… |
CVE-2024-37239 | Medium | 5.9 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Branda bran… |
CVE-2024-37229 | Medium | 5.9 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AuburnForest Blogmentor – Blog Layouts for Element… |
CVE-2024-37223 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nicdark Restaurant Reservations allows Stored XSS… |
CVE-2024-37221 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Bester Kimili Flash Embed allows Stored XS… |
CVE-2024-37219 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PBN Hosting SL Page Builder Sandwich – Front-End P… |
CVE-2024-37217 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ProWCPlugins Empty Cart Button for WooCommerce all… |
CVE-2024-37216 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rami Yushuvaev Sketchfab Embed allows Stored XSS.T… |
CVE-2024-37215 | Medium | 5.9 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in creativeinteractivemedia Transition Slider – Respo… |
CVE-2024-37211 | High | 7.1 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ali2Woo Team Ali2Woo Lite allows Reflected XSS.Thi… |
CVE-2024-37206 | High | 7.1 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme4Press Demo Awesome allows Reflected XSS.This… |
CVE-2024-37199 | High | 7.1 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kriesi.At Enfold allows Reflected XSS.This issue a… |
CVE-2024-37122 | Medium | 5.9 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Biplob Adhikari Accordions allows Stored XSS.This… |
CVE-2024-37121 | Medium | 5.9 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in biplob018 Shortcode Addons allows Stored XSS.This… |
CVE-2024-37120 | Medium | 5.9 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Biplob Adhikari Tabs allows Stored XSS.This issue… |
CVE-2024-37117 | High | 7.1 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Automator Pro allows Reflected… |
CVE-2024-37116 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sinatrateam Sinatra allows Stored XSS.This issue a… |
CVE-2024-37114 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama My Favorites my-favorites allows DOM-Ba… |
CVE-2024-37101 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AF themes WP Post Author allows Stored XSS.This is… |
CVE-2024-37100 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mayur Somani, threeroutes media Elegant Themes Ico… |
CVE-2024-37097 | High | 7.1 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in UnitedThemes Shortcodes by United Themes allows Re… |
CVE-2024-35656 | High | 7.1 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Elementor Elementor Pro allows Reflected XSS.This… |
CVE-2024-34457 | Medium | 6.5 | 2024-07-22 | On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user fli… |
CVE-2024-33933 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force, Nikhil Chavan Elementor – Header… |
CVE-2024-23321 | High | 8.8 | 2024-07-22 | For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ… |
CVE-2024-37445 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player allows Stored XSS.This… |
CVE-2024-37436 | High | 7.1 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allo… |
CVE-2024-37434 | Medium | 5.9 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration.This issue… |
CVE-2024-37433 | High | 7.1 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.This issue affects Mailster… |