2024 CVEs (page 246)
Page 246 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-3961 | Medium | 5.3 | 2024-06-21 | The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due t… |
CVE-2024-6218 | High | 7.3 | 2024-06-21 | A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. Affected by this issue is some unknown functio… |
CVE-2024-6217 | Medium | 6.3 | 2024-06-21 | A vulnerability classified as critical was found in SourceCodester Food Ordering Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2024-6216 | Medium | 6.3 | 2024-06-21 | A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file add-us… |
CVE-2024-6215 | Medium | 6.3 | 2024-06-21 | A vulnerability was found in SourceCodester Food Ordering Management System up to 1.0. It has been rated as critical. This issue affects some unknown processin… |
CVE-2024-5503 | High | 8.8 | 2024-06-21 | The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes it possible for aut… |
CVE-2024-5344 | Medium | 6.1 | 2024-06-21 | The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attribute within the pl… |
CVE-2024-3610 | Medium | 5.3 | 2024-06-21 | The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctg_easy_child_t… |
CVE-2024-1955 | Medium | 4.3 | 2024-06-21 | The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warning_noti… |
CVE-2024-1639 | Medium | 6.5 | 2024-06-21 | The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey()… |
CVE-2024-6214 | Medium | 6.3 | 2024-06-21 | A vulnerability was found in SourceCodester Food Ordering Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2024-6213 | High | 7.3 | 2024-06-21 | A vulnerability was found in SourceCodester Food Ordering Management System up to 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2024-6212 | Low | 3.5 | 2024-06-21 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as problematic. Affected by this issue is the function get_stud… |
CVE-2024-38361 | Low | 3.7 | 2024-06-20 | Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion un… |
CVE-2024-38359 | Medium | 6.5 | 2024-06-20 | The Lightning Network Daemon (lnd) - is a complete implementation of a Lightning Network node. A parsing vulnerability in lnd's onion processing logic and lead… |
CVE-2024-37899 | Critical | 9.0 | 2024-06-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's prof… |
CVE-2024-35246 | High | 7.5 | 2024-06-20 | An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly. |
CVE-2024-32943 | High | 7.5 | 2024-06-20 | An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly. |
CVE-2024-5746 | High | 7.6 | 2024-06-20 | A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitr… |
CVE-2024-37183 | Medium | 5.7 | 2024-06-20 | Plain text credentials and session ID can be captured with a network sniffer. |
CVE-2024-36071 | Medium | 6.3 | 2024-06-20 | Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process. Th… |
CVE-2024-31586 | Medium | 6.1 | 2024-06-20 | A Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0. This vulnerability allows a remote attacker to execute… |
CVE-2024-30848 | Medium | 6.1 | 2024-06-20 | Cross-site scripting (XSS) vulnerability in SilverSky E-mail service version 5.0.3126 allows remote attackers to inject arbitrary web script or HTML via the ve… |
CVE-2024-29390 | High | 7.3 | 2024-06-20 | Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page… |
CVE-2024-6154 | Medium | 6.7 | 2024-06-20 | Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privilege… |
CVE-2024-6153 | High | 7.8 | 2024-06-20 | Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels softw… |
CVE-2024-6147 | High | 7.8 | 2024-06-20 | Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected inst… |
CVE-2024-38093 | Medium | 4.3 | 2024-06-20 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-38082 | Medium | 4.7 | 2024-06-20 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-37818 | High | 8.6 | 2024-06-20 | Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to… |
CVE-2024-37897 | Medium | 5.4 | 2024-06-20 | SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient s… |
CVE-2024-37699 | Critical | 9.8 | 2024-06-20 | An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption. |
CVE-2024-37674 | Medium | 5.5 | 2024-06-20 | Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity. |
CVE-2024-37352 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06 that allows attackers with system administr… |
CVE-2024-37351 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permis… |
CVE-2024-37350 | Medium | 6.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Attackers can interfere with a syst… |
CVE-2024-37349 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permis… |
CVE-2024-37626 | High | 8.8 | 2024-06-20 | A command injection issue in TOTOLINK A6000R V1.0.1-B20201211.2000 firmware allows a remote attacker to execute arbitrary code via the iface parameter in the v… |
CVE-2024-37348 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permis… |
CVE-2024-37347 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the pool configuration component of the management UI of Absolute Secure Access prior to 13.06. Attackers with… |
CVE-2024-37346 | Medium | 4.9 | 2024-06-20 | There is an insufficient input validation vulnerability in the Warehouse component of Absolute Secure Access prior to 13.06. Attackers with system administrato… |
CVE-2024-37345 | Medium | 5.3 | 2024-06-20 | There is a cross-site scripting vulnerability in the Secure Access administrative UI of Absolute Secure Access prior to version 13.06. Attackers can pass a lim… |
CVE-2024-37344 | Medium | 4.5 | 2024-06-20 | There is a cross-site scripting vulnerability in the Policy management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator… |
CVE-2024-37343 | Medium | 4.8 | 2024-06-20 | There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.06. Attackers with vali… |
CVE-2024-33335 | Medium | 6.3 | 2024-06-20 | SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file. |
CVE-2024-28397 | Medium | 5.3 | 2024-06-20 | An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. |
CVE-2024-6196 | High | 7.3 | 2024-06-20 | A vulnerability was found in itsourcecode Banking Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-6195 | Medium | 6.3 | 2024-06-20 | A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-6194 | Medium | 6.3 | 2024-06-20 | A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file editm… |
CVE-2024-6193 | High | 7.3 | 2024-06-20 | A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. This issue affects some unknown processing of… |
CVE-2024-37676 | High | 8.4 | 2024-06-20 | An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function. |
CVE-2024-6192 | High | 7.3 | 2024-06-20 | A vulnerability classified as critical was found in itsourcecode Loan Management System 1.0. This vulnerability affects unknown code of the file login.php of t… |
CVE-2024-6191 | High | 7.3 | 2024-06-20 | A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. This affects an unknown part of the file login.php of the… |
CVE-2024-6190 | High | 7.3 | 2024-06-20 | A vulnerability was found in itsourcecode Farm Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of th… |
CVE-2024-6162 | High | 7.5 | 2024-06-20 | A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises beca… |
CVE-2024-37222 | High | 7.1 | 2024-06-20 | Cross Site Scripting (XSS) vulnerability in Averta Master Slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.10.0. |
CVE-2024-6189 | High | 8.8 | 2024-06-20 | A vulnerability was found in Tenda A301 15.13.08.12. It has been classified as critical. Affected is the function fromSetWirelessRepeat of the file /goform/Wif… |
CVE-2024-6188 | Medium | 5.3 | 2024-06-20 | A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export… |
CVE-2024-5156 | Medium | 6.4 | 2024-06-20 | The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.18.7 due to… |
CVE-2024-37532 | High | 8.8 | 2024-06-20 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID… |
CVE-2024-6187 | Medium | 6.3 | 2024-06-20 | A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/vpn/autovpn/sub_commi… |
CVE-2024-6186 | Medium | 6.3 | 2024-06-20 | A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0. This affects an unknown part of the file /view/userAuthentication/SSO/commit… |
CVE-2024-6185 | Medium | 6.3 | 2024-06-20 | A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC 1.0. Affected by this issue is the function get_ip_addr_details of the file… |
CVE-2024-6184 | Medium | 6.3 | 2024-06-20 | A vulnerability classified as critical was found in Ruijie RG-UAC 1.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfi… |
CVE-2024-6183 | Medium | 4.3 | 2024-06-20 | A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. Th… |
CVE-2024-6182 | Low | 3.5 | 2024-06-20 | A vulnerability was found in LabVantage LIMS 2017. It has been rated as problematic. This issue affects some unknown processing of the file /labvantage/rc?comm… |
CVE-2024-6181 | Low | 3.5 | 2024-06-20 | A vulnerability was found in LabVantage LIMS 2017. It has been declared as problematic. This vulnerability affects unknown code of the file /labvantage/rc?comm… |
CVE-2024-5036 | Medium | 6.4 | 2024-06-20 | The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress i… |
CVE-2024-28147 | High | 7.4 | 2024-06-20 | An authenticated user can upload arbitrary files in the upload function for collection preview images. An attacker may upload an HTML file that includes mali… |
CVE-2024-34693 | Medium | 6.8 | 2024-06-20 | Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If b… |
CVE-2024-29013 | Medium | 6.5 | 2024-06-20 | Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via memcpy function. |
CVE-2024-29012 | High | 7.5 | 2024-06-20 | Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoS) via sscanf functi… |
CVE-2024-38620 | High | 8.8 | 2024-06-20 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Remove HCI_AMP support Since BT_HS has been remove HCI_AMP controllers no… |
CVE-2024-4098 | Critical | 9.8 | 2024-06-20 | The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_fetch_sharecounts fu… |
CVE-2024-38619 | Medium | 5.5 | 2024-06-20 | In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of str… |
CVE-2024-6113 | High | 7.3 | 2024-06-20 | A vulnerability was found in itsourcecode Monbela Tourist Inn Online Reservation System 1.0. It has been rated as critical. This issue affects some unknown pro… |
CVE-2024-5522 | Medium | 6.5 | 2024-06-20 | The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing… |
CVE-2024-5475 | Medium | 5.4 | 2024-06-20 | The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/po… |
CVE-2024-4565 | Medium | 6.5 | 2024-06-20 | The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values… |
CVE-2024-5686 | Medium | 6.4 | 2024-06-20 | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugi… |
CVE-2024-5605 | High | 8.8 | 2024-06-20 | The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all… |
CVE-2024-4390 | Medium | 6.5 | 2024-06-20 | The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Arbitrary Nonce Generation in all versions up to, and including, 3.0.2. This m… |
CVE-2024-5213 | Medium | 6.5 | 2024-06-20 | In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after l… |
CVE-2024-6179 | Medium | 6.1 | 2024-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This i… |
CVE-2024-6178 | Medium | 6.1 | 2024-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This i… |
CVE-2024-6177 | Medium | 6.1 | 2024-06-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS… |
CVE-2024-5432 | Critical | 9.8 | 2024-06-20 | The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to insufficient verifica… |
CVE-2024-4742 | Medium | 6.5 | 2024-06-20 | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the… |
CVE-2024-4626 | Medium | 6.4 | 2024-06-20 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to… |
CVE-2024-3627 | Medium | 5.4 | 2024-06-20 | The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missin… |
CVE-2024-3605 | Critical | 10.0 | 2024-06-20 | The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in… |
CVE-2024-3602 | Medium | 4.3 | 2024-06-20 | The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to unauthorized plugin… |
CVE-2024-3597 | High | 7.1 | 2024-06-20 | The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.2.2. This is due to insuffici… |
CVE-2024-3562 | High | 8.8 | 2024-06-20 | The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop custom field. This is… |
CVE-2024-3561 | High | 8.8 | 2024-06-20 | The Custom Field Suite plugin for WordPress is vulnerable to SQL Injection via the the 'Term' custom field in all versions up to, and including, 2.6.7 due to i… |
CVE-2024-3558 | Medium | 6.4 | 2024-06-20 | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_title]' parameter versions up to, and including… |
CVE-2024-1168 | Medium | 6.4 | 2024-06-20 | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social image URL in all versions up to, and inclu… |
CVE-2024-6176 | | 2024-06-20 | Allocation of Resources Without Limits or Throttling vulnerability in LG Electronics LG SuperSign CMS allows Port Scanning.This issue affects LG SuperSign CMS… | |
CVE-2024-6103 | High | 8.8 | 2024-06-20 | Use after free in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2024-6102 | High | 8.8 | 2024-06-20 | Out of bounds memory access in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |