2024 CVEs (page 25)
Page 25 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5667 | Medium | 6.4 | 2025-03-05 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js JavaScript library (versions 1.7.13 to 1… |
CVE-2024-13839 | Medium | 6.1 | 2025-03-05 | The Staff Directory Plugin: Company Directory plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appr… |
CVE-2024-13815 | Medium | 6.5 | 2025-03-05 | The The Listingo theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.7. This is due to the software al… |
CVE-2024-13811 | Medium | 4.3 | 2025-03-05 | The Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability c… |
CVE-2024-13810 | Medium | 4.3 | 2025-03-05 | The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on th… |
CVE-2024-13809 | Medium | 6.5 | 2025-03-05 | The Hero Slider - WordPress Slider Plugin plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 1.3… |
CVE-2024-13787 | Critical | 9.8 | 2025-03-05 | The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization… |
CVE-2024-13780 | Medium | 6.5 | 2025-03-05 | The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in… |
CVE-2024-13779 | Medium | 6.1 | 2025-03-05 | The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'index' parameter in all ver… |
CVE-2024-13778 | Medium | 6.5 | 2025-03-05 | The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to SQL Injection via several functions in all versions up to, and incl… |
CVE-2024-13777 | High | 8.1 | 2025-03-05 | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.9… |
CVE-2024-13757 | Medium | 6.4 | 2025-03-05 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_layer shortcode in all versio… |
CVE-2024-13747 | Medium | 4.3 | 2025-03-05 | The WooMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'template_d… |
CVE-2024-13232 | High | 8.8 | 2025-03-05 | The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalati… |
CVE-2024-12815 | Medium | 6.4 | 2025-03-05 | The Point Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'point_maker' shortcode in all versions up to, and including… |
CVE-2024-11731 | Medium | 6.4 | 2025-03-05 | The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slider shortcode in all versi… |
CVE-2024-8682 | Medium | 5.3 | 2025-03-05 | The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and includin… |
CVE-2024-13866 | Medium | 6.4 | 2025-03-05 | The Simple Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input s… |
CVE-2024-13827 | Medium | 6.1 | 2025-03-05 | The Razorpay Subscription Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() and re… |
CVE-2024-13350 | Medium | 6.4 | 2025-03-05 | The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions… |
CVE-2024-0141 | Medium | 6.8 | 2025-03-05 | NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the GPU vBIOS that may allow a malicious actor with tenant level GPU access to write to an unsupported… |
CVE-2024-0114 | High | 8.1 | 2025-03-05 | NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the… |
CVE-2024-9135 | Medium | 5.3 | 2025-03-04 | On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing p… |
CVE-2024-8000 | Medium | 5.3 | 2025-03-04 | On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in… |
CVE-2024-41147 | High | 7.7 | 2025-03-04 | An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality of Miniaudio miniaudio v0.11.21. A specially crafted .flac fil… |
CVE-2024-10930 | High | 7.8 | 2025-03-04 | An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated… |
CVE-2024-50707 | Critical | 10.0 | 2025-03-04 | Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the X-Forwarded-… |
CVE-2024-50704 | Critical | 10.0 | 2025-03-04 | Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially craf… |
CVE-2024-11957 | | 2025-03-04 | Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276 on Windows allows an attac… | |
CVE-2024-9149 | High | 8.6 | 2025-03-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wind Media E-Commerce Website Template allows SQL Injecti… |
CVE-2024-50706 | Critical | 9.8 | 2025-03-04 | Unauthenticated SQL injection vulnerability in Uniguest Tripleplay version 23.1+ allows remote attackers to execute arbitrary SQL queries on the backend databa… |
CVE-2024-50705 | High | 7.1 | 2025-03-04 | Unauthenticated reflected cross-site scripting (XSS) vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary scripts vi… |
CVE-2024-9618 | Medium | 6.4 | 2025-03-04 | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross… |
CVE-2024-13724 | Medium | 4.3 | 2025-03-04 | The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized ac… |
CVE-2024-13682 | Medium | 4.3 | 2025-03-04 | The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Requ… |
CVE-2024-58050 | Medium | 6.2 | 2025-03-04 | Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58049 | Medium | 5.0 | 2025-03-04 | Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58048 | Medium | 6.7 | 2025-03-04 | Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58047 | Medium | 5.0 | 2025-03-04 | Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58046 | Medium | 6.2 | 2025-03-04 | Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-58045 | High | 8.6 | 2025-03-04 | Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58044 | High | 8.4 | 2025-03-04 | Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-58043 | High | 7.3 | 2025-03-04 | Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-48248 | High | 8.6 | 2025-03-04 | NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code… |
CVE-2024-47262 | Medium | 5.3 | 2025-03-04 | Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attack allowing for an… |
CVE-2024-47260 | Medium | 6.5 | 2025-03-04 | 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading… |
CVE-2024-47259 | Low | 3.5 | 2025-03-04 | Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing fo… |
CVE-2024-13685 | Medium | 5.3 | 2025-03-04 | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to… |
CVE-2024-13686 | Medium | 4.3 | 2025-03-04 | The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vw_storefront_reset_all_setti… |
CVE-2024-55064 | Medium | 5.4 | 2025-03-03 | Multiple cross-site scripting (XSS) vulnerabilities in EasyVirt DC NetScope <= 8.6.4 allow remote attackers to inject arbitrary JavaScript or HTML code via the… |
CVE-2024-5888 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51966 | Medium | 4.9 | 2025-03-03 | There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with… |
CVE-2024-51963 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a… |
CVE-2024-51962 | High | 8.7 | 2025-03-03 | A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed… |
CVE-2024-51961 | High | 7.5 | 2025-03-03 | There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could poten… |
CVE-2024-51960 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51959 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51958 | Medium | 4.9 | 2025-03-03 | There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with… |
CVE-2024-51957 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51956 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51954 | High | 8.5 | 2025-03-03 | There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote… |
CVE-2024-51953 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51952 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51951 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51950 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51949 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51948 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51947 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51946 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51945 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51944 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-51942 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-10904 | Medium | 4.8 | 2025-03-03 | There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a s… |
CVE-2024-30154 | Medium | 5.3 | 2025-03-03 | HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a… |
CVE-2024-53384 | Medium | 5.1 | 2025-03-03 | A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript… |
CVE-2024-51091 | Medium | 5.4 | 2025-03-03 | Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs package |
CVE-2024-57240 | Medium | 5.4 | 2025-03-03 | A Cross-Site Scripting (XSS) vulnerability in the Rendering Engine component in Apryse WebViewer v11.1 and earlier allows attackers to execute arbitrary code v… |
CVE-2024-53388 | High | 8.8 | 2025-03-03 | A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element. |
CVE-2024-53387 | High | 8.8 | 2025-03-03 | A DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element. |
CVE-2024-45782 | High | 7.8 | 2025-03-03 | A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-prov… |
CVE-2024-45778 | Medium | 4.1 | 2025-03-03 | A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash. |
CVE-2024-55570 | Medium | 5.4 | 2025-03-03 | /api/user/users in the web GUI for the Cubro EXA48200 network packet broker (build 20231025055018) fixed in V5.0R14.5P4-V3.3R1 allows remote authenticated user… |
CVE-2024-55532 | Critical | 9.8 | 2025-03-03 | Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to versio… |
CVE-2024-43169 | High | 8.8 | 2025-03-03 | IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a user to download a malicious file without verifying the integrity of the… |
CVE-2024-41771 | High | 7.5 | 2025-03-03 | IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose applicati… |
CVE-2024-41770 | High | 7.5 | 2025-03-03 | IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose applicati… |
CVE-2024-8262 | Critical | 9.8 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Proliz Software OBS allows Path Traversal. This issue affects… |
CVE-2024-8261 | High | 7.5 | 2025-03-03 | Authorization Bypass Through User-Controlled Key vulnerability in Proliz Software OBS allows Exploiting Incorrectly Configured Access Control Security Levels. … |
CVE-2024-45780 | Medium | 6.7 | 2025-03-03 | A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation ag… |
CVE-2024-45779 | Medium | 6.0 | 2025-03-03 | An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number… |
CVE-2024-54179 | Medium | 5.4 | 2025-03-03 | IBM Business Automation Workflow and IBM Business Automation Workflow Enterprise Service Bus 24.0.0, 24.0.1 and earlier unsupported versions are vulnerable to… |
CVE-2024-47092 | Critical | 9.8 | 2025-03-03 | Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api prior to 5.8.1 |
CVE-2024-53034 | High | 7.8 | 2025-03-03 | Memory corruption occurs during an Escape call if an invalid Kernel Mode CPU event and sync object handle are passed with the DriverKnownEscape flag reset. |
CVE-2024-53033 | High | 7.8 | 2025-03-03 | Memory corruption while doing Escape call when user provides valid kernel address in the place of valid user buffer address. |
CVE-2024-53032 | High | 7.8 | 2025-03-03 | Memory corruption may occur in keyboard virtual device due to guest VM interaction. |
CVE-2024-53031 | High | 7.8 | 2025-03-03 | Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine. |
CVE-2024-53030 | High | 7.8 | 2025-03-03 | Memory corruption while processing input message passed from FE driver. |
CVE-2024-53029 | High | 7.8 | 2025-03-03 | Memory corruption while reading a value from a buffer controlled by the Guest Virtual Machine. |
CVE-2024-53028 | High | 7.8 | 2025-03-03 | Memory corruption may occur while processing message from frontend during allocation. |
CVE-2024-53027 | High | 7.5 | 2025-03-03 | Transient DOS may occur while processing the country IE. |