2024 CVEs (page 226)
Page 226 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6732 | Medium | 6.3 | 2024-07-14 | A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. This vulnerability affects unknown code of… |
CVE-2024-6731 | Medium | 6.3 | 2024-07-14 | A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. This affects an unknown part of the fi… |
CVE-2024-39734 | Medium | 4.3 | 2024-07-14 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able… |
CVE-2024-39733 | Medium | 5.5 | 2024-07-14 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 29… |
CVE-2024-39732 | Medium | 4.1 | 2024-07-14 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious user. IB… |
CVE-2024-6730 | Medium | 6.3 | 2024-07-14 | A vulnerability was found in Nanjing Xingyuantu Technology SparkShop up to 1.1.6. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2024-6729 | Medium | 6.3 | 2024-07-14 | A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been declared as critical. This vulnerability affects unk… |
CVE-2024-6728 | Medium | 6.3 | 2024-07-14 | A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been classified as critical. This affects an unknown part of the file typeedi… |
CVE-2024-6465 | Medium | 4.3 | 2024-07-13 | The WP Links Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wplf_ajax_update_screenshot… |
CVE-2024-6574 | Medium | 5.3 | 2024-07-13 | The Laposta plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.12. This is due to the plugin not preventing dir… |
CVE-2024-6070 | Medium | 4.8 | 2024-07-13 | The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not sanitise and escape some of its settings, which could allow high privilege u… |
CVE-2024-5744 | Medium | 6.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead… |
CVE-2024-5715 | High | 7.1 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-5713 | Medium | 5.4 | 2024-07-13 | The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an… |
CVE-2024-5644 | Medium | 5.4 | 2024-07-13 | The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-5627 | Medium | 5.4 | 2024-07-13 | The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform… |
CVE-2024-5575 | Medium | 4.7 | 2024-07-13 | The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to… |
CVE-2024-5472 | High | 7.1 | 2024-07-13 | The WP QuickLaTeX WordPress plugin before 3.8.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-5450 | Critical | 9.1 | 2024-07-13 | The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files |
CVE-2024-5442 | Medium | 5.9 | 2024-07-13 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege u… |
CVE-2024-5287 | High | 7.1 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2024-5286 | Medium | 4.8 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-5284 | Medium | 6.8 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-5283 | Medium | 6.1 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-5282 | Medium | 6.1 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-5281 | Medium | 6.1 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-5280 | Medium | 4.7 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-5167 | High | 8.1 | 2024-07-13 | The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item from the blacklist or… |
CVE-2024-5151 | High | 7.1 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor… |
CVE-2024-5080 | High | 8.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the ser… |
CVE-2024-5079 | Medium | 6.1 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register, which allows unauthenticated users to perf… |
CVE-2024-5077 | Medium | 6.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attac… |
CVE-2024-5076 | High | 8.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted ac… |
CVE-2024-5075 | Medium | 5.9 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-5074 | Medium | 5.4 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-5034 | High | 8.8 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions… |
CVE-2024-5033 | Medium | 5.9 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers t… |
CVE-2024-5032 | Medium | 4.7 | 2024-07-13 | The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scrip… |
CVE-2024-5028 | Medium | 6.5 | 2024-07-13 | The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged i… |
CVE-2024-5002 | Medium | 4.8 | 2024-07-13 | The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-4977 | Medium | 6.8 | 2024-07-13 | The Index WP MySQL For Speed WordPress plugin before 1.4.18 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec… |
CVE-2024-4752 | Medium | 5.9 | 2024-07-13 | The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2024-4602 | Medium | 5.4 | 2024-07-13 | The Embed Peertube Playlist WordPress plugin before 1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-4272 | Medium | 6.1 | 2024-07-13 | The Support SVG WordPress plugin before 1.1.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious Jav… |
CVE-2024-4269 | Medium | 6.1 | 2024-07-13 | The SVG Block WordPress plugin before 1.1.20 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaS… |
CVE-2024-4217 | Medium | 4.7 | 2024-07-13 | The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for attackers with a Co… |
CVE-2024-3964 | Medium | 5.9 | 2024-07-13 | The Product Enquiry for WooCommerce WordPress plugin before 3.1.8 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2024-3963 | Medium | 6.5 | 2024-07-13 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.14 does not sanitise and escape some parameters, which could allow users with a role as… |
CVE-2024-3919 | Medium | 4.6 | 2024-07-13 | The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a pa… |
CVE-2024-3753 | Medium | 5.9 | 2024-07-13 | The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2024-3751 | Medium | 4.8 | 2024-07-13 | The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-3710 | Medium | 6.8 | 2024-07-13 | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them bac… |
CVE-2024-3632 | Medium | 6.8 | 2024-07-13 | The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logg… |
CVE-2024-3026 | Medium | 5.4 | 2024-07-13 | The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users with a role as low a… |
CVE-2024-2870 | Medium | 6.1 | 2024-07-13 | The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2024-31947 | Medium | 6.5 | 2024-07-12 | StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows Directory Traversal by authenticated users. Using a crafted path parameter with the Online H… |
CVE-2024-30213 | High | 8.8 | 2024-07-12 | StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows remote authenticated users to achieve Command Injection via a Ping URL, leading to remote co… |
CVE-2024-5902 | High | 7.2 | 2024-07-12 | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-40690 | Medium | 5.4 | 2024-07-12 | IBM InfoSphere Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web… |
CVE-2024-40110 | Critical | 9.8 | 2024-07-12 | Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimage parameter at /far… |
CVE-2024-40552 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java. |
CVE-2024-40551 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via u… |
CVE-2024-40550 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary… |
CVE-2024-40549 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via… |
CVE-2024-40548 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploa… |
CVE-2024-40547 | Medium | 6.5 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace. |
CVE-2024-40546 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via upload… |
CVE-2024-40545 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via up… |
CVE-2024-40544 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit. |
CVE-2024-40543 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage. |
CVE-2024-40542 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/role?offset. |
CVE-2024-40541 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dept/build. |
CVE-2024-40540 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dept. |
CVE-2024-40539 | Critical | 9.8 | 2024-07-12 | my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/user. |
CVE-2024-40522 | High | 8.8 | 2024-07-12 | There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filter… |
CVE-2024-40521 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certain restrictions on th… |
CVE-2024-40520 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_config_mark.php directly splicing and writing the user input data i… |
CVE-2024-40519 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_smtp.php directly splicing and writing the user input data into wei… |
CVE-2024-40518 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into w… |
CVE-2024-39917 | High | 7.2 | 2024-07-12 | xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The n… |
CVE-2024-38736 | Critical | 9.1 | 2024-07-12 | Unrestricted Upload of File with Dangerous Type vulnerability in Realtyna Realtyna Organic IDX plugin allows Code Injection.This issue affects Realtyna Organic… |
CVE-2024-38735 | High | 7.5 | 2024-07-12 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bastien Ho Event post event-post.This… |
CVE-2024-38734 | Critical | 9.1 | 2024-07-12 | Unrestricted Upload of File with Dangerous Type vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Code Injection.This issue… |
CVE-2024-38717 | High | 7.1 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Booking Ultra Pro allows PHP Local File Inclusion.This issue af… |
CVE-2024-38716 | Medium | 6.5 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blue Plugins Events Calendar for Google allows PHP Local File I… |
CVE-2024-37405 | Medium | 6.5 | 2024-07-12 | Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHistory. |
CVE-2024-39916 | Medium | 6.4 | 2024-07-12 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports genera… |
CVE-2024-39914 | Critical | 9.8 | 2024-07-12 | FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a comm… |
CVE-2024-39909 | Medium | 6.5 | 2024-07-12 | KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean… |
CVE-2024-39903 | High | 8.6 | 2024-07-12 | Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara… |
CVE-2024-38715 | Medium | 6.5 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExS ExS Widgets allows PHP Local File Inclusion.This issue affe… |
CVE-2024-38709 | Medium | 5.3 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Milan Petrovic GD Rating System allows PHP Local File Inclusion… |
CVE-2024-38706 | Medium | 6.5 | 2024-07-12 | Path Traversal: '.../...//' vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.5.7. |
CVE-2024-38704 | Medium | 6.5 | 2024-07-12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DynamicWebLab WordPress Team Manager allows PHP Local File Incl… |
CVE-2024-38700 | Medium | 6.5 | 2024-07-12 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in realmag777 WPCS allows Code Injection.This… |
CVE-2024-37941 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in Internal Link Juicer Internal Link Juicer: SEO Auto Linker for WordPress.This issue affects Internal Link Ju… |
CVE-2024-37940 | High | 7.4 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in Seraphinite Solutions Seraphinite Accelerator (Full, premium).This issue affects Seraphinite Accelerator (Fu… |
CVE-2024-37939 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Lite.This issue affects Patricia Lite: from n/a through 1.2.3. |
CVE-2024-37938 | Medium | 4.3 | 2024-07-12 | Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop SociallyViral.This issue affects SociallyViral: from n/a through 1.0.10. |
CVE-2024-37933 | Critical | 9.3 | 2024-07-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anhvnit Woocommerce OpenPos.This issue affects Woocommerc… |