2024 CVEs (page 226)
Page 226 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5167 | High | 8.1 | 2024-07-13 | The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item from the blacklist or… |
CVE-2024-5151 | High | 7.1 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor… |
CVE-2024-5080 | High | 8.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the ser… |
CVE-2024-5079 | Medium | 6.1 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register, which allows unauthenticated users to perf… |
CVE-2024-5077 | Medium | 6.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attac… |
CVE-2024-5076 | High | 8.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted ac… |
CVE-2024-5075 | Medium | 5.9 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-5074 | Medium | 5.4 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-5034 | High | 8.8 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions… |
CVE-2024-5033 | Medium | 5.9 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers t… |
CVE-2024-5032 | Medium | 4.7 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scrip… |
CVE-2024-5028 | Medium | 6.5 | 2024-07-13 | The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged i… |
CVE-2024-5002 | Medium | 4.8 | 2024-07-13 | The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-4977 | Medium | 6.8 | 2024-07-13 | The Index WP MySQL For Speed WordPress plugin before 1.4.18 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec… |
CVE-2024-4752 | Medium | 5.9 | 2024-07-13 | The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2024-4602 | Medium | 5.4 | 2024-07-13 | The Embed Peertube Playlist WordPress plugin before 1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-4272 | Medium | 6.1 | 2024-07-13 | The Support SVG WordPress plugin before 1.1.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious Jav… |
CVE-2024-4269 | Medium | 6.1 | 2024-07-13 | The SVG Block WordPress plugin before 1.1.20 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaS… |
CVE-2024-4217 | Medium | 4.7 | 2024-07-13 | The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for attackers with a Co… |
CVE-2024-3964 | Medium | 5.9 | 2024-07-13 | The Product Enquiry for WooCommerce WordPress plugin before 3.1.8 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2024-3963 | Medium | 6.5 | 2024-07-13 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.14 does not sanitise and escape some parameters, which could allow users with a role as… |
CVE-2024-3919 | Medium | 4.6 | 2024-07-13 | The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a pa… |
CVE-2024-3753 | Medium | 5.9 | 2024-07-13 | The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2024-3751 | Medium | 4.8 | 2024-07-13 | The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-3710 | Medium | 6.8 | 2024-07-13 | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them bac… |
CVE-2024-3632 | Medium | 6.8 | 2024-07-13 | The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logg… |
CVE-2024-3026 | Medium | 5.4 | 2024-07-13 | The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users with a role as low a… |
CVE-2024-2870 | Medium | 6.1 | 2024-07-13 | The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2024-31947 | Medium | 6.5 | 2024-07-12 | StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows Directory Traversal by authenticated users. Using a crafted path parameter with the Online H… |
CVE-2024-30213 | High | 8.8 | 2024-07-12 | StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows remote authenticated users to achieve Command Injection via a Ping URL, leading to remote co… |
CVE-2024-5902 | High | 7.2 | 2024-07-12 | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-40690 | Medium | 5.4 | 2024-07-12 | IBM InfoSphere Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web… |
CVE-2024-40110 | Critical | 9.8 | 2024-07-12 | Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimage parameter at /far… |
CVE-2024-40552 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java. |
CVE-2024-40551 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via u… |
CVE-2024-40550 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary… |
CVE-2024-40549 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via… |
CVE-2024-40548 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploa… |
CVE-2024-40547 | Medium | 6.5 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace. |
CVE-2024-40546 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via upload… |
CVE-2024-40545 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via up… |
CVE-2024-40544 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit. |
CVE-2024-40543 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage. |
CVE-2024-40542 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/role?offset. |
CVE-2024-40541 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dept/build. |
CVE-2024-40540 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dept. |
CVE-2024-40539 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/user. |
CVE-2024-40522 | High | 8.8 | 2024-07-12 | There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filter… |
CVE-2024-40521 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certain restrictions on th… |
CVE-2024-40520 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_config_mark.php directly splicing and writing the user input data i… |
CVE-2024-40519 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_smtp.php directly splicing and writing the user input data into wei… |
CVE-2024-40518 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into w… |
CVE-2024-39917 | High | 7.2 | 2024-07-12 | xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The n… |
CVE-2024-38736 | Critical | 9.1 | 2024-07-12 | Unrestricted Upload of File with Dangerous Type vulnerability in Realtyna Realtyna Organic IDX plugin allows Code Injection.This issue affects Realtyna Organic… |
CVE-2024-38735 | High | 7.5 | 2024-07-12 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bastien Ho Event post event-post.This… |
CVE-2024-38734 | Critical | 9.1 | 2024-07-12 | Unrestricted Upload of File with Dangerous Type vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Code Injection.This issue… |
CVE-2024-38717 | High | 7.1 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Booking Ultra Pro allows PHP Local File Inclusion.This issue af… |
CVE-2024-38716 | Medium | 6.5 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blue Plugins Events Calendar for Google allows PHP Local File I… |
CVE-2024-37405 | Medium | 6.5 | 2024-07-12 | Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHistory. |
CVE-2024-39916 | Medium | 6.4 | 2024-07-12 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports genera… |
CVE-2024-39914 | Critical | 9.8 | 2024-07-12 | FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a comm… |
CVE-2024-39909 | Medium | 6.5 | 2024-07-12 | KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean… |
CVE-2024-39903 | High | 8.6 | 2024-07-12 | Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara… |
CVE-2024-38715 | Medium | 6.5 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExS ExS Widgets allows PHP Local File Inclusion.This issue affe… |
CVE-2024-38709 | Medium | 5.3 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Milan Petrovic GD Rating System allows PHP Local File Inclusion… |
CVE-2024-38706 | Medium | 6.5 | 2024-07-12 | Path Traversal: '.../...//' vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.5.7. |
CVE-2024-38704 | Medium | 6.5 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DynamicWebLab WordPress Team Manager allows PHP Local File Incl… |
CVE-2024-38700 | Medium | 6.5 | 2024-07-12 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in realmag777 WPCS allows Code Injection.This… |
CVE-2024-37941 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in Internal Link Juicer Internal Link Juicer: SEO Auto Linker for WordPress.This issue affects Internal Link Ju… |
CVE-2024-37940 | High | 7.4 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in Seraphinite Solutions Seraphinite Accelerator (Full, premium).This issue affects Seraphinite Accelerator (Fu… |
CVE-2024-37939 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Lite.This issue affects Patricia Lite: from n/a through 1.2.3. |
CVE-2024-37938 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop SociallyViral.This issue affects SociallyViral: from n/a through 1.0.10. |
CVE-2024-37933 | Critical | 9.3 | 2024-07-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anhvnit Woocommerce OpenPos.This issue affects Woocommerc… |
CVE-2024-37932 | High | 8.6 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in anhvnit Woocommerce OpenPos allows File Manipulation.This issue… |
CVE-2024-37928 | High | 8.6 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NooTheme Jobmonster allows File Manipulation.This issue affects… |
CVE-2024-37927 | Critical | 9.8 | 2024-07-12 | Incorrect Privilege Assignment vulnerability in NooTheme Jobmonster noo-jobmonster allows Privilege Escalation.This issue affects Jobmonster: from n/a through… |
CVE-2024-37564 | High | 8.5 | 2024-07-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PayPlus LTD PayPlus Payment Gateway.This issue affects Pa… |
CVE-2024-37560 | High | 8.0 | 2024-07-12 | Improper Privilege Management vulnerability in IqbalRony WP User Switch allows Privilege Escalation.This issue affects WP User Switch: from n/a through 1.1.0. |
CVE-2024-37544 | Medium | 4.3 | 2024-07-12 | Missing Authorization vulnerability in Saleswonder Team: Tobias Get Better Reviews for WooCommerce more-better-reviews-for-woocommerce.This issue affects Get B… |
CVE-2024-37213 | High | 7.1 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in guru-aliexpress AliNext ali2woo-lite allows Cross Site Request Forgery.This issue affects AliNext: from n/a… |
CVE-2024-37202 | Medium | 6.5 | 2024-07-12 | Missing Authorization vulnerability in BinaryCarpenter Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter custom-add-to-cart-button-… |
CVE-2024-35773 | High | 7.1 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in WPJohnny, zerOneIT Comment Reply Email allows Cross-Site Scripting (XSS).This issue affects Comment Reply Em… |
CVE-2024-6495 | Medium | 6.4 | 2024-07-12 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text widget in all versions up to… |
CVE-2024-5325 | High | 8.8 | 2024-07-12 | The Form Vibes plugin for WordPress is vulnerable to SQL Injection via the ‘fv_export_data’ parameter in all versions up to, and including, 1.4.10 due to insuf… |
CVE-2024-41006 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a memory leak in nr_heartbeat_expiry() syzbot reported a memory leak in nr_cr… |
CVE-2024-41005 | Medium | 4.7 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: netpoll: Fix race condition in netpoll_owner_active KCSAN detected a race condition in ne… |
CVE-2024-41004 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: tracing: Build event generation tests only as modules The kprobes and synth event generat… |
CVE-2024-41003 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reg_set_min_max corruption of fake_reg Juan reported that after doing some chang… |
CVE-2024-41002 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec - Fix memory leak for sec resource release The AIV is one of the SE… |
CVE-2024-41001 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: io_uring/sqpoll: work around a potential audit memory leak kmemleak complains that there'… |
CVE-2024-41000 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different overflow check Running syzkaller with the newly reintroduce… |
CVE-2024-40999 | Critical | 9.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: net: ena: Add validation for completion descriptors consistency Validate that `first` fla… |
CVE-2024-40998 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() In the follow… |
CVE-2024-40997 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: fix memory leak on CPU EPP exit The cpudata memory from kzalloc() in… |
CVE-2024-40996 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid splat in pskb_pull_reason syzkaller builds (CONFIG_DEBUG_NET=y) frequently tri… |
CVE-2024-40995 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() syzbot found hang… |
CVE-2024-40994 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: ptp: fix integer overflow in max_vclocks_store On 32bit systems, the "4 * max" multiply c… |
CVE-2024-40993 | Medium | 5.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix suspicious rcu_dereference_protected() When destroying all sets, we… |
CVE-2024-40992 | High | 7.5 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder length checking for UD request packets According to the IBA speci… |
CVE-2024-40991 | High | 7.8 | 2024-07-12 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id() The of_k3_udma_glue_pa… |