2024 CVEs (page 244)
Page 244 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5862 | High | 7.5 | 2024-06-24 | Improper Restriction of Excessive Authentication Attempts vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Interface Manipulation. This i… |
CVE-2024-4839 | Low | 3.3 | 2024-06-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The… |
CVE-2024-3264 | Medium | 5.3 | 2024-06-24 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Signature Spoofing by Improper Validatio… |
CVE-2024-37233 | Medium | 4.3 | 2024-06-24 | Improper Authentication vulnerability in Play.Ht allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Play.Ht: from n/a through 3… |
CVE-2024-37231 | High | 8.6 | 2024-06-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Salon booking system allows File Manipulat… |
CVE-2024-37228 | Critical | 10.0 | 2024-06-24 | Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <… |
CVE-2024-37111 | High | 7.5 | 2024-06-24 | Missing Authorization vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7. |
CVE-2024-37109 | Critical | 9.9 | 2024-06-24 | Improper Control of Generation of Code ('Code Injection') vulnerability in Membership Software WishList Member X allows Code Injection.This issue affects WishL… |
CVE-2024-37107 | High | 8.8 | 2024-06-24 | Improper Privilege Management vulnerability in Membership Software WishList Member X allows Privilege Escalation.This issue affects WishList Member X: from n/a… |
CVE-2024-37092 | High | 8.5 | 2024-06-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local Fi… |
CVE-2024-37091 | Critical | 9.9 | 2024-06-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixTheme… |
CVE-2024-37089 | Critical | 9.0 | 2024-06-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local Fi… |
CVE-2024-36038 | Medium | 6.3 | 2024-06-24 | Zoho ManageEngine ITOM products versions from 128234 to 128248 are affected by the stored cross-site scripting vulnerability in the proxy server option. |
CVE-2024-6160 | | 2024-06-24 | SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages… | |
CVE-2024-29868 | Critical | 9.1 | 2024-06-24 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism… |
CVE-2024-5683 | Critical | 9.8 | 2024-06-24 | Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code In… |
CVE-2024-4754 | Medium | 5.4 | 2024-06-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement… |
CVE-2024-36497 | Critical | 9.1 | 2024-06-24 | The decrypted configuration file contains the password in cleartext which is used to configure WINSelect. It can be used to remove the existing restrictions… |
CVE-2024-36496 | High | 7.5 | 2024-06-24 | The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The applic… |
CVE-2024-36495 | High | 7.7 | 2024-06-24 | The application Faronics WINSelect (Standard + Enterprise) saves its configuration in an encrypted file on the file system which "Everyone" has read and write… |
CVE-2024-27136 | Medium | 6.1 | 2024-06-24 | XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information abo… |
CVE-2024-24554 | High | 8.2 | 2024-06-24 | Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allow… |
CVE-2024-24553 | High | 7.5 | 2024-06-24 | Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inh… |
CVE-2024-24552 | High | 8.8 | 2024-06-24 | A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into a… |
CVE-2024-24551 | High | 8.8 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability ar… |
CVE-2024-24550 | High | 8.1 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which… |
CVE-2024-4900 | Medium | 6.1 | 2024-06-24 | The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open r… |
CVE-2024-4899 | Medium | 5.0 | 2024-06-24 | The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to… |
CVE-2024-6280 | Medium | 6.3 | 2024-06-24 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /adm… |
CVE-2024-6279 | Medium | 6.3 | 2024-06-24 | A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this issue is some unknown functionali… |
CVE-2024-6278 | Medium | 4.7 | 2024-06-24 | A vulnerability has been found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2024-6277 | Medium | 4.7 | 2024-06-24 | A vulnerability, which was classified as critical, was found in lahirudanushka School Management System 1.0.0/1.0.1. Affected is an unknown function of the fil… |
CVE-2024-4499 | Medium | 6.3 | 2024-06-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows a… |
CVE-2024-6276 | Medium | 4.7 | 2024-06-24 | A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. This issue affects some unknown proce… |
CVE-2024-6275 | Medium | 4.7 | 2024-06-24 | A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1. This vulnerability affects unknown code of the file pa… |
CVE-2024-6274 | Medium | 4.7 | 2024-06-24 | A vulnerability classified as critical has been found in lahirudanushka School Management System 1.0.0/1.0.1. This affects an unknown part of the file /attenda… |
CVE-2024-3121 | Low | 3.3 | 2024-06-24 | A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from t… |
CVE-2024-39337 | Medium | 6.5 | 2024-06-24 | Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass. |
CVE-2024-39334 | Medium | 6.5 | 2024-06-23 | MENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data. When a victim opens the details of this trans… |
CVE-2024-6273 | Medium | 4.3 | 2024-06-23 | A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as problematic. Affected by this vulnerability is the function save… |
CVE-2024-39331 | Critical | 9.8 | 2024-06-23 | In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-str… |
CVE-2024-4841 | Low | 3.3 | 2024-06-23 | A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input san… |
CVE-2024-6269 | Medium | 4.7 | 2024-06-23 | A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects the function get_ip.addr_details of the file /view/v… |
CVE-2024-6268 | High | 7.3 | 2024-06-23 | A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. Affected by this issue is some unknow… |
CVE-2024-6267 | Low | 2.4 | 2024-06-23 | A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown func… |
CVE-2024-6266 | Medium | 6.3 | 2024-06-23 | A vulnerability classified as critical has been found in Pear Admin Boot up to 2.0.2. Affected is an unknown function of the file /system/dictData/loadDictItem… |
CVE-2024-38319 | High | 7.5 | 2024-06-22 | IBM Security SOAR 51.0.2.0 could allow an authenticated user to execute malicious code loaded from a specially crafted script. IBM X-Force ID: 294830. |
CVE-2024-5443 | Critical | 9.8 | 2024-06-22 | CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().build_extension()` function. The vulnerabi… |
CVE-2024-6253 | High | 7.3 | 2024-06-22 | A vulnerability was found in itsourcecode Online Food Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of t… |
CVE-2024-6252 | Low | 2.4 | 2024-06-22 | A vulnerability has been found in Zorlan SkyCaiji up to 2.8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2024-6251 | Low | 2.4 | 2024-06-22 | A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_p… |
CVE-2024-38379 | Medium | 4.8 | 2024-06-22 | Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limit… |
CVE-2024-5596 | Medium | 6.3 | 2024-06-22 | The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly impleme… |
CVE-2024-4940 | Medium | 6.1 | 2024-06-22 | An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitra… |
CVE-2024-3593 | High | 7.2 | 2024-06-22 | The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect… |
CVE-2024-4874 | Medium | 4.3 | 2024-06-22 | The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter… |
CVE-2024-21519 | Medium | 6.6 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restoration functionality… |
CVE-2024-21518 | High | 7.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization… |
CVE-2024-21517 | Medium | 4.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the redirect parameter of customer account/login r… |
CVE-2024-21516 | Medium | 4.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0. A reflected XSS issue was identified in the directory parameter of admi… |
CVE-2024-21515 | Medium | 4.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route… |
CVE-2024-21514 | High | 7.4 | 2024-06-22 | This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is… |
CVE-2024-5966 | Medium | 6.4 | 2024-06-22 | The Grey Opaque theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Download-Button shortcode in all ve… |
CVE-2024-5965 | Medium | 6.4 | 2024-06-22 | The Mosaic theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to… |
CVE-2024-5791 | High | 7.2 | 2024-06-22 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp_id' parameter in… |
CVE-2024-5346 | Medium | 6.4 | 2024-06-22 | The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Video, UX Slider, UX Sidebar, and UX Payme… |
CVE-2024-4313 | Medium | 6.4 | 2024-06-22 | The Table Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including… |
CVE-2024-2484 | Medium | 6.4 | 2024-06-22 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Services and Post Type Grid widgets in all versions up to… |
CVE-2024-6120 | Medium | 6.5 | 2024-06-22 | The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability check on the multi… |
CVE-2024-37654 | Medium | 6.1 | 2024-06-21 | An issue in BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, A… |
CVE-2024-36532 | Critical | 10.0 | 2024-06-21 | Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-34989 | Critical | 9.8 | 2024-06-21 | In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFProductListModuleFro… |
CVE-2024-34452 | Medium | 6.1 | 2024-06-21 | CMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document. |
CVE-2024-6241 | Medium | 6.3 | 2024-06-21 | A vulnerability was found in Pear Admin Boot up to 2.0.2 and classified as critical. This issue affects the function getDictItems of the file /system/dictData/… |
CVE-2024-37675 | Medium | 5.4 | 2024-06-21 | Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the parameter "sect… |
CVE-2024-37673 | Medium | 5.4 | 2024-06-21 | Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the filename parame… |
CVE-2024-37672 | Medium | 5.4 | 2024-06-21 | Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the idactivity para… |
CVE-2024-37671 | Medium | 5.4 | 2024-06-21 | Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the page parameter. |
CVE-2024-35537 | High | 7.5 | 2024-06-21 | TVS Motor Company Limited TVS Connect Android v4.6.0 and IOS v5.0.0 was discovered to insecurely handle the RSA key pair, allowing attackers to possibly access… |
CVE-2024-35781 | Medium | 6.5 | 2024-06-21 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in YAHMAN Word Balloon allows PHP Local File Inclusion.This issue… |
CVE-2024-35778 | Medium | 6.5 | 2024-06-21 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in John West Slideshow SE PHP Local File Inclusion.This issue affe… |
CVE-2024-35767 | Critical | 9.1 | 2024-06-21 | Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze allows Code Injection.This issue affects Squeeze: from n/a through 1… |
CVE-2024-6240 | High | 7.7 | 2024-06-21 | Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in… |
CVE-2024-6239 | High | 7.5 | 2024-06-21 | A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files… |
CVE-2024-37230 | Medium | 4.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Book Landing Page.This issue affects Book Landing Page: from n/a through 1.2.3. |
CVE-2024-37227 | Medium | 4.3 | 2024-06-21 | Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.7. |
CVE-2024-37212 | High | 8.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in Ali2Woo Ali2Woo Lite.This issue affects Ali2Woo Lite: from n/a through 3.3.5. |
CVE-2024-37198 | Medium | 4.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in blazethemes Digital Newspaper.This issue affects Digital Newspaper: from n/a through 1.1.5. |
CVE-2024-37118 | Medium | 5.4 | 2024-06-21 | Cross Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Automator Pro.This issue affects Uncanny Automator Pro: from n/a through 5.3. |
CVE-2024-5059 | Medium | 5.3 | 2024-06-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Event Management Tickets Booking.This issue affects Event Management Tick… |
CVE-2024-35776 | Medium | 5.3 | 2024-06-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exeebit phpinfo() WP.This issue affects phpinfo() WP: from n/a through 5.0. |
CVE-2024-35772 | Medium | 4.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Hueman.This issue affects Hueman: from n/a through 3.7.24. |
CVE-2024-35771 | Medium | 4.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Customizr.This issue affects Customizr: from n/a through 4.4.21. |
CVE-2024-35770 | Medium | 4.3 | 2024-06-21 | Cross-Site Request Forgery (CSRF) vulnerability in Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin.This issue affects Vimeography: Vimeo Video Gall… |
CVE-2024-35768 | Medium | 5.9 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiveComposer Page Builder: Live Composer live-composer-pa… |
CVE-2024-35766 | High | 7.1 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ollybach WPPizza allows Reflected XSS.This issue a… |
CVE-2024-35764 | Medium | 6.5 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects C… |
CVE-2024-35763 | Medium | 6.5 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Excellent allows Stored XSS.This iss… |
CVE-2024-35762 | Medium | 6.5 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Cryout Creations Serious Slider allows Stored XSS… |
CVE-2024-35761 | Medium | 6.5 | 2024-06-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita Online Booking & Scheduling Calendar for Wor… |