2024 CVEs (page 234)
Page 234 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6168 | Medium | 4.3 | 2024-07-09 | The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or… |
CVE-2024-6167 | Medium | 4.3 | 2024-07-09 | The Just Custom Fields plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several AJAX functions i… |
CVE-2024-6069 | High | 8.8 | 2024-07-09 | The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress… |
CVE-2024-5993 | Medium | 5.4 | 2024-07-09 | The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_session' functio… |
CVE-2024-5992 | Medium | 6.5 | 2024-07-09 | The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_chatbot_token' a… |
CVE-2024-5937 | Medium | 6.4 | 2024-07-09 | The Simple Alert Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert shortcode in all versions up to, and including… |
CVE-2024-5856 | Medium | 4.3 | 2024-07-09 | The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cir_delete_image AJAX acti… |
CVE-2024-5810 | Medium | 5.3 | 2024-07-09 | The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including… |
CVE-2024-5704 | Medium | 4.3 | 2024-07-09 | The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missi… |
CVE-2024-5669 | Medium | 6.4 | 2024-07-09 | The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin for WordPress is vulnerable to unauthorized modification of data due to a miss… |
CVE-2024-5648 | Medium | 5.4 | 2024-07-09 | The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e… |
CVE-2024-5600 | Medium | 5.4 | 2024-07-09 | The SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability… |
CVE-2024-5479 | High | 7.2 | 2024-07-09 | The Easy Pixels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 2.13 due to insuffi… |
CVE-2024-5457 | Medium | 6.4 | 2024-07-09 | The Panda Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.4.0 due to ins… |
CVE-2024-5456 | High | 8.8 | 2024-07-09 | The Panda Video plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.0 via the 'selected_button' parameter. Thi… |
CVE-2024-4868 | Medium | 6.4 | 2024-07-09 | The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's EE Events and EE Flipbox widgets in all version… |
CVE-2024-4102 | Medium | 5.4 | 2024-07-09 | The Pricing Table plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up… |
CVE-2024-4100 | Medium | 5.3 | 2024-07-09 | The Pricing Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.1. This is due to missing or incor… |
CVE-2024-3608 | Medium | 5.3 | 2024-07-09 | The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_atta… |
CVE-2024-3604 | Critical | 9.9 | 2024-07-09 | The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode in all versions up… |
CVE-2024-3603 | Medium | 6.4 | 2024-07-09 | The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osm_map' shortcode in all versions up to, and inclu… |
CVE-2024-3563 | Medium | 6.4 | 2024-07-09 | The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, and including, 3.1.3… |
CVE-2024-3228 | Medium | 5.3 | 2024-07-09 | The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinter… |
CVE-2024-37502 | Medium | 5.4 | 2024-07-09 | Deserialization of Untrusted Data vulnerability in wpweb WooCommerce Social Login woo-social-login.This issue affects WooCommerce Social Login: from n/a throug… |
CVE-2024-37494 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaineLabs Youzify.This issue affects Youzify: from n/a th… |
CVE-2024-37486 | High | 7.6 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships… |
CVE-2024-37256 | High | 7.6 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a… |
CVE-2024-37225 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Marketing Automation.This issue affects Zoho Marketi… |
CVE-2024-37112 | Critical | 10.0 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Software WishList Member X.This issue affects… |
CVE-2024-6321 | High | 8.8 | 2024-07-09 | The ScrollTo Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.1.1. This is… |
CVE-2024-6320 | High | 8.8 | 2024-07-09 | The ScrollTo Top plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.2.2. This is due… |
CVE-2024-6317 | High | 8.8 | 2024-07-09 | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and includin… |
CVE-2024-6316 | High | 8.8 | 2024-07-09 | The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and includin… |
CVE-2024-6314 | Critical | 9.8 | 2024-07-09 | The IQ Testimonials plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process_image_upload' functio… |
CVE-2024-6313 | Critical | 9.8 | 2024-07-09 | The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowed file types in the 'upload' function i… |
CVE-2024-6310 | High | 8.8 | 2024-07-09 | The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7… |
CVE-2024-6309 | High | 8.8 | 2024-07-09 | The Attachment File Icons (AF Icons) plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including… |
CVE-2024-6180 | High | 7.2 | 2024-07-09 | The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eventon_import_settings' ajax act… |
CVE-2024-6161 | High | 8.8 | 2024-07-09 | The Default Thumbnail Plus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'get_cache_image' function i… |
CVE-2024-6123 | High | 7.2 | 2024-07-09 | The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function in all versions up t… |
CVE-2024-5881 | Medium | 6.4 | 2024-07-09 | The Webico Slider Flatsome Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wbc_image shortcode in all versions up to… |
CVE-2024-37923 | Medium | 5.4 | 2024-07-09 | Cross-Site Request Forgery (CSRF) vulnerability in cliengo Cliengo – Chatbot cliengo allows Cross Site Request Forgery.This issue affects Cliengo – Chatbot: fr… |
CVE-2024-37555 | Critical | 9.1 | 2024-07-09 | Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7.This issue affe… |
CVE-2024-28751 | Critical | 9.1 | 2024-07-09 | An high privileged remote attacker can enable telnet access that accepts hardcoded credentials. |
CVE-2024-28750 | High | 7.2 | 2024-07-09 | A remote attacker with high privileges may use a deleting file function to inject OS commands. |
CVE-2024-28749 | High | 7.2 | 2024-07-09 | A remote attacker with high privileges may use a writing file function to inject OS commands. |
CVE-2024-28748 | High | 7.2 | 2024-07-09 | A remote attacker with high privileges may use a reading file function to inject OS commands. |
CVE-2024-28747 | Critical | 9.8 | 2024-07-09 | An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges. |
CVE-2024-22062 | Medium | 6.3 | 2024-07-09 | There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by m… |
CVE-2024-6334 | Medium | 6.1 | 2024-07-09 | The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as e… |
CVE-2024-5802 | Medium | 4.8 | 2024-07-09 | The URL Shortener by Myhop WordPress plugin through 1.0.17 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-5488 | Critical | 9.8 | 2024-07-09 | The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can… |
CVE-2024-5441 | High | 8.8 | 2024-07-09 | The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function… |
CVE-2024-3410 | Medium | 4.3 | 2024-07-09 | The DN Footer Contacts WordPress plugin before 1.6.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-6171 | Medium | 5.3 | 2024-07-09 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and inc… |
CVE-2024-6170 | Medium | 6.4 | 2024-07-09 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘email’ parame… |
CVE-2024-6169 | Medium | 6.4 | 2024-07-09 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ par… |
CVE-2024-6166 | High | 8.8 | 2024-07-09 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ pa… |
CVE-2024-4667 | Medium | 6.4 | 2024-07-09 | The Blog, Posts and Category Filter for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post and Category Filter widget in… |
CVE-2024-39600 | Medium | 5.0 | 2024-07-09 | Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an attacker to get hold of… |
CVE-2024-39599 | Medium | 4.7 | 2024-07-09 | Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API… |
CVE-2024-39596 | Medium | 4.3 | 2024-07-09 | Due to missing authorization checks, SAP Enable Now allows an author to escalate privileges to access information which should otherwise be restricted. On succ… |
CVE-2024-39595 | Medium | 5.4 | 2024-07-09 | SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scrip… |
CVE-2024-39594 | Medium | 6.1 | 2024-07-09 | SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Sc… |
CVE-2024-37180 | Medium | 4.1 | 2024-07-09 | Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no furthe… |
CVE-2024-37175 | Medium | 4.3 | 2024-07-09 | SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker… |
CVE-2024-37172 | Medium | 5.4 | 2024-07-09 | SAP S/4HANA Finance (Advanced Payment Management) does not perform necessary authorization check for an authenticated user, resulting in escalation of privileg… |
CVE-2024-37171 | Medium | 5.0 | 2024-07-09 | SAP Transportation Management (Collaboration Portal) allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web appl… |
CVE-2024-34692 | Low | 3.3 | 2024-07-09 | Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files include executables… |
CVE-2024-34689 | Medium | 5.0 | 2024-07-09 | WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting… |
CVE-2024-6365 | Critical | 9.8 | 2024-07-09 | The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'saveCustomTitle' func… |
CVE-2024-39598 | Medium | 5.0 | 2024-07-09 | SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP req… |
CVE-2024-39597 | High | 7.2 | 2024-07-09 | In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registrati… |
CVE-2024-39593 | Medium | 6.9 | 2024-07-09 | SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successful exploitation can… |
CVE-2024-39592 | High | 7.7 | 2024-07-09 | Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker t… |
CVE-2024-37174 | Medium | 6.1 | 2024-07-09 | Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On succe… |
CVE-2024-37173 | Medium | 6.1 | 2024-07-09 | Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a v… |
CVE-2024-34685 | Medium | 6.1 | 2024-07-09 | Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application… |
CVE-2024-5974 | High | 7.2 | 2024-07-09 | A buffer overflow in WatchGuard Fireware OS could may allow an authenticated remote attacker with privileged management access to execute arbitrary code with s… |
CVE-2024-4944 | High | 7.8 | 2024-07-09 | A local privilege escalation vlnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with eleva… |
CVE-2024-5855 | Medium | 4.3 | 2024-07-09 | The Media Hygiene: Remove or Delete Unused Images and More! plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check o… |
CVE-2024-5793 | High | 8.8 | 2024-07-09 | The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via the ‘currency_code’ parameter in all versions up to, and including, 3… |
CVE-2024-34786 | Medium | 4.8 | 2024-07-09 | UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation UniFi Access Points configured as standalone (not using UniFi Network Application) that c… |
CVE-2024-22020 | Medium | 6.5 | 2024-07-09 | A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary co… |
CVE-2024-5569 | Medium | 6.2 | 2024-07-09 | A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processi… |
CVE-2024-5549 | High | 8.1 | 2024-07-09 | A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings contain… |
CVE-2024-3653 | Medium | 5.3 | 2024-07-08 | A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the… |
CVE-2024-28882 | Medium | 4.3 | 2024-07-08 | OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing s… |
CVE-2024-5971 | High | 7.5 | 2024-07-08 | A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client woul… |
CVE-2024-38372 | Low | 2.0 | 2024-07-08 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` mi… |
CVE-2024-6580 | Medium | 6.5 | 2024-07-08 | The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or… |
CVE-2024-6227 | High | 7.5 | 2024-07-08 | A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This… |
CVE-2024-6409 | High | 7.0 | 2024-07-08 | A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set ti… |
CVE-2024-4882 | | 2024-07-08 | The user may be redirected to an arbitrary site in Sitefinity 15.1.8321.0 and previous versions. | |
CVE-2024-39896 | High | 7.5 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can… |
CVE-2024-1305 | Critical | 9.8 | 2024-07-08 | tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory… |
CVE-2024-39895 | Medium | 6.5 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of… |
CVE-2024-39701 | Medium | 6.3 | 2024-07-08 | Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evalua… |
CVE-2024-39312 | Medium | 5.3 | 2024-07-08 | Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parame… |
CVE-2024-34702 | Medium | 5.3 | 2024-07-08 | Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parame… |