2024 CVEs (page 233)
Page 233 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6604 | High | 7.5 | 2024-07-09 | Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume t… |
CVE-2024-6603 | High | 7.4 | 2024-07-09 | In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerabilit… |
CVE-2024-6602 | Critical | 9.8 | 2024-07-09 | A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird <… |
CVE-2024-6601 | Medium | 4.7 | 2024-07-09 | A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR <… |
CVE-2024-6600 | Medium | 6.3 | 2024-07-09 | Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private s… |
CVE-2024-39697 | High | 8.6 | 2024-07-09 | phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic… |
CVE-2024-38363 | High | 8.5 | 2024-07-09 | Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated r… |
CVE-2024-6598 | Medium | 6.5 | 2024-07-09 | A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with jo… |
CVE-2024-6527 | | 2024-07-09 | SQL Injection vulnerability in parameter "w" in file "druk.php" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and o… | |
CVE-2024-2177 | Medium | 6.8 | 2024-07-09 | A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1… |
CVE-2024-37952 | High | 8.8 | 2024-07-09 | Improper Privilege Management vulnerability in themeenergy BookYourTravel allows Privilege Escalation.This issue affects BookYourTravel: from n/a through 8.18… |
CVE-2024-37934 | Medium | 5.4 | 2024-07-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: fro… |
CVE-2024-37520 | Medium | 6.5 | 2024-07-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme ShopBuilder – Elementor Wo… |
CVE-2024-37513 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.This issue affects WPC… |
CVE-2024-22271 | High | 8.2 | 2024-07-09 | In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose… |
CVE-2024-6391 | Medium | 6.4 | 2024-07-09 | The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bw_button shortcode in all versions up to, and including, 4.10.3 due… |
CVE-2024-3596 | Critical | 9.0 | 2024-07-09 | RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access… |
CVE-2024-39888 | High | 7.5 | 2024-07-09 | A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded defa… |
CVE-2024-39876 | Medium | 4.0 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected applications do not properly handle log rotation. This… |
CVE-2024-39875 | Medium | 4.3 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows authenticated, low privilege use… |
CVE-2024-39874 | High | 7.5 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force… |
CVE-2024-39873 | High | 7.5 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force… |
CVE-2024-39872 | Critical | 9.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temp… |
CVE-2024-39871 | Medium | 6.3 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected applications do not properly separate the rights to edi… |
CVE-2024-39870 | Medium | 6.3 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected applications can be configured to allow users to ma… |
CVE-2024-39869 | Medium | 6.5 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected products allow to upload certificates. An authenticated… |
CVE-2024-39868 | High | 7.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication whe… |
CVE-2024-39867 | High | 7.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication whe… |
CVE-2024-39866 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup… |
CVE-2024-39865 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup… |
CVE-2024-39675 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4.3.10), RUGGEDCOM RMC30NC (All versions < V4.3.10), RUGGEDCOM RP110 (All versions < V4… |
CVE-2024-39571 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to… |
CVE-2024-39570 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to… |
CVE-2024-39569 | Medium | 6.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-39568 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-39567 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to com… |
CVE-2024-38867 | Medium | 5.9 | 2024-07-09 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.64), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All… |
CVE-2024-38278 | Medium | 6.6 | 2024-07-09 | A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGGEDCOM RS416NCv2 V5… |
CVE-2024-37997 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0.014), Teamcenter V… |
CVE-2024-37996 | Low | 3.3 | 2024-07-09 | A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0.014), Teamcenter V… |
CVE-2024-37501 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginsWare Advanced Classifieds & Directory Pro allows Path Tr… |
CVE-2024-37499 | Medium | 6.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vci… |
CVE-2024-37497 | High | 7.7 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetThemeCore jet-theme-core.This issue affects JetTh… |
CVE-2024-37484 | High | 8.8 | 2024-07-09 | Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n… |
CVE-2024-37464 | Medium | 4.9 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPZOOM Beaver Builder Addons by WPZOOM allows Path Traversal.Th… |
CVE-2024-33654 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an alloc… |
CVE-2024-33653 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an alloc… |
CVE-2024-32056 | High | 7.8 | 2024-07-09 | A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains an out of bounds write past the end of an allo… |
CVE-2024-30321 | Medium | 5.9 | 2024-07-09 | A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5)… |
CVE-2024-5946 | Medium | 6.4 | 2024-07-09 | The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tab’ shortcode in all versions up to, and… |
CVE-2024-5634 | | 2024-07-09 | Longse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern. Once the pattern is k… | |
CVE-2024-5633 | | 2024-07-09 | Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the same local network to… | |
CVE-2024-5632 | | 2024-07-09 | Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network with a default password. A user is neit… | |
CVE-2024-5631 | | 2024-07-09 | Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote contro… | |
CVE-2024-4862 | Medium | 6.4 | 2024-07-09 | The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and i… |
CVE-2024-37462 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows Path T… |
CVE-2024-37455 | High | 8.8 | 2024-07-09 | Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons fo… |
CVE-2024-37454 | Medium | 6.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AWSM Innovations AWSM Team allows Path Traversal.This issue aff… |
CVE-2024-37442 | Low | 3.8 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays all… |
CVE-2024-37437 | Medium | 5.5 | 2024-07-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor.This issue… |
CVE-2024-37430 | Medium | 5.3 | 2024-07-09 | Authentication Bypass by Spoofing vulnerability in patreon Patreon WordPress patreon-connect.This issue affects Patreon WordPress: from n/a through <= 1.9.0. |
CVE-2024-37424 | Critical | 9.9 | 2024-07-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspa… |
CVE-2024-37420 | Critical | 9.9 | 2024-07-09 | Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web Shell to a Web Server.This issue affect… |
CVE-2024-37419 | High | 7.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Codeless Cowidgets – Elementor Addons allows Path Traversal.Thi… |
CVE-2024-37418 | Critical | 9.9 | 2024-07-09 | Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4… |
CVE-2024-37410 | Medium | 4.9 | 2024-07-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in IdeaBox Creations PowerPack Lite for B… |
CVE-2024-39487 | High | 7.1 | 2024-07-09 | In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function bond_opti… |
CVE-2024-37268 | High | 8.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kaptinlin Striking allows Path Traversal.This issue affects Str… |
CVE-2024-37266 | Medium | 4.9 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tuto… |
CVE-2024-37253 | Low | 2.7 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code… |
CVE-2024-37224 | High | 7.5 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in smartypants SP Project & Document Manager.This issue affects SP… |
CVE-2024-37090 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Masterstudy Elementor Widgets, StylemixThe… |
CVE-2024-35777 | Low | 3.5 | 2024-07-09 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Automattic WooCommerce allows Content Spoof… |
CVE-2024-6168 | Medium | 4.3 | 2024-07-09 | The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or… |
CVE-2024-6167 | Medium | 4.3 | 2024-07-09 | The Just Custom Fields plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several AJAX functions i… |
CVE-2024-6069 | High | 8.8 | 2024-07-09 | The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress… |
CVE-2024-5993 | Medium | 5.4 | 2024-07-09 | The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_session' functio… |
CVE-2024-5992 | Medium | 6.5 | 2024-07-09 | The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_chatbot_token' a… |
CVE-2024-5937 | Medium | 6.4 | 2024-07-09 | The Simple Alert Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert shortcode in all versions up to, and including… |
CVE-2024-5856 | Medium | 4.3 | 2024-07-09 | The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cir_delete_image AJAX acti… |
CVE-2024-5810 | Medium | 5.3 | 2024-07-09 | The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including… |
CVE-2024-5704 | Medium | 4.3 | 2024-07-09 | The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missi… |
CVE-2024-5669 | Medium | 6.4 | 2024-07-09 | The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin for WordPress is vulnerable to unauthorized modification of data due to a miss… |
CVE-2024-5648 | Medium | 5.4 | 2024-07-09 | The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e… |
CVE-2024-5600 | Medium | 5.4 | 2024-07-09 | The SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability… |
CVE-2024-5479 | High | 7.2 | 2024-07-09 | The Easy Pixels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 2.13 due to insuffi… |
CVE-2024-5457 | Medium | 6.4 | 2024-07-09 | The Panda Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.4.0 due to ins… |
CVE-2024-5456 | High | 8.8 | 2024-07-09 | The Panda Video plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.0 via the 'selected_button' parameter. Thi… |
CVE-2024-4868 | Medium | 6.4 | 2024-07-09 | The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's EE Events and EE Flipbox widgets in all version… |
CVE-2024-4102 | Medium | 5.4 | 2024-07-09 | The Pricing Table plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up… |
CVE-2024-4100 | Medium | 5.3 | 2024-07-09 | The Pricing Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.1. This is due to missing or incor… |
CVE-2024-3608 | Medium | 5.3 | 2024-07-09 | The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_atta… |
CVE-2024-3604 | Critical | 9.9 | 2024-07-09 | The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode in all versions up… |
CVE-2024-3603 | Medium | 6.4 | 2024-07-09 | The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osm_map' shortcode in all versions up to, and inclu… |
CVE-2024-3563 | Medium | 6.4 | 2024-07-09 | The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, and including, 3.1.3… |
CVE-2024-3228 | Medium | 5.3 | 2024-07-09 | The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinter… |
CVE-2024-37502 | Medium | 5.4 | 2024-07-09 | Deserialization of Untrusted Data vulnerability in wpweb WooCommerce Social Login woo-social-login.This issue affects WooCommerce Social Login: from n/a throug… |
CVE-2024-37494 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaineLabs Youzify.This issue affects Youzify: from n/a th… |
CVE-2024-37486 | High | 7.6 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships… |
CVE-2024-37256 | High | 7.6 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a… |