2024 CVEs (page 250)
Page 250 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-3813 | High | 8.8 | 2024-06-15 | The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'bl… |
CVE-2024-2544 | High | 7.4 | 2024-06-15 | The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX action… |
CVE-2024-6003 | High | 7.3 | 2024-06-14 | A vulnerability was found in Guangdong Baolun Electronics IP Network Broadcasting Service Platform 2.0. It has been classified as critical. Affected is an unkn… |
CVE-2024-30120 | Low | 2.9 | 2024-06-14 | HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application. |
CVE-2024-30119 | Low | 3.7 | 2024-06-14 | HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header. This could allow an attacker to intercept or manipulate data durin… |
CVE-2024-21988 | Medium | 5.3 | 2024-06-14 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information via complex MiTM a… |
CVE-2024-37889 | Medium | 6.5 | 2024-06-14 | MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an… |
CVE-2024-37831 | Critical | 9.8 | 2024-06-14 | Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. |
CVE-2024-36600 | High | 8.4 | 2024-06-14 | Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file. |
CVE-2024-37888 | Medium | 6.1 | 2024-06-14 | The Open Link is a CKEditor plugin, extending context menu with a possibility to open link in a new tab. The vulnerability allowed to execute JavaScript code b… |
CVE-2024-36599 | Medium | 6.1 | 2024-06-14 | A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-36598 | High | 8.1 | 2024-06-14 | An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file. |
CVE-2024-36597 | High | 8.8 | 2024-06-14 | Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php. |
CVE-2024-24320 | High | 8.8 | 2024-06-14 | Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information and execute arbitrar… |
CVE-2024-5659 | Medium | 6.5 | 2024-06-14 | Rockwell Automation was made aware of a vulnerability that causes all affected controllers on the same network to result in a major nonrecoverable fault(MNRF/A… |
CVE-2024-37369 | High | 8.8 | 2024-06-14 | A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lis… |
CVE-2024-37887 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that t… |
CVE-2024-37886 | Medium | 5.4 | 2024-06-14 | user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the c… |
CVE-2024-37885 | Low | 3.8 | 2024-06-14 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS al… |
CVE-2024-37884 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with… |
CVE-2024-37883 | Medium | 4.3 | 2024-06-14 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access… |
CVE-2024-37882 | High | 8.1 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is… |
CVE-2024-37645 | High | 8.8 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow vulnerability via the submit-url parameter at /formSysLog . |
CVE-2024-37643 | High | 8.8 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow vulnerability via the submit-url parameter at /formPasswordAuth . |
CVE-2024-37642 | Critical | 9.1 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /formSystemCheck . |
CVE-2024-37641 | High | 8.8 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule |
CVE-2024-37317 | Medium | 4.6 | 2024-06-14 | The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created use… |
CVE-2024-37316 | Medium | 4.6 | 2024-06-14 | Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for pa… |
CVE-2024-37315 | Low | 3.5 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the f… |
CVE-2024-33373 | Medium | 6.3 | 2024-06-14 | An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for authentication. Th… |
CVE-2024-37644 | High | 8.8 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root. |
CVE-2024-37368 | High | 7.5 | 2024-06-14 | A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to… |
CVE-2024-37367 | High | 7.5 | 2024-06-14 | A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE v12. The vulnerability allows a user from a remote system with FTVie… |
CVE-2024-37314 | Low | 3.5 | 2024-06-14 | Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded… |
CVE-2024-37313 | High | 7.3 | 2024-06-14 | Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providin… |
CVE-2024-37312 | Medium | 6.3 | 2024-06-14 | user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventuall… |
CVE-2024-36656 | Medium | 6.1 | 2024-06-14 | In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack. |
CVE-2024-34694 | High | 8.1 | 2024-06-14 | LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment b… |
CVE-2024-34539 | Critical | 9.4 | 2024-06-14 | Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials ca… |
CVE-2024-33377 | High | 8.1 | 2024-06-14 | LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arb… |
CVE-2024-33375 | Critical | 9.8 | 2024-06-14 | LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware. |
CVE-2024-33374 | Critical | 9.8 | 2024-06-14 | Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access the root terminal without authentication. |
CVE-2024-23442 | Medium | 6.1 | 2024-06-14 | An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. |
CVE-2024-5731 | Medium | 6.8 | 2024-06-14 | A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by man… |
CVE-2024-5671 | Critical | 9.8 | 2024-06-14 | Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vul… |
CVE-2024-37640 | High | 8.8 | 2024-06-14 | TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid5g in the function setWiFiEasyGuestCfg. |
CVE-2024-37639 | High | 8.8 | 2024-06-14 | TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via eport in the function setIpPortFilterRules. |
CVE-2024-37637 | Critical | 9.8 | 2024-06-14 | TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid5g in the function setWizardCfg. |
CVE-2024-2024 | High | 8.8 | 2024-06-14 | The Folders Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_folders_file_upload' function i… |
CVE-2024-2023 | Medium | 4.3 | 2024-06-14 | The Folders and Folders Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0 in Folders and 3.0.2 in Folders… |
CVE-2024-36459 | | 2024-06-14 | A CRLF cross-site scripting vulnerability has been identified in certain configurations of the SiteMinder Web Agent for IIS Web Server and SiteMinder Web Agent… | |
CVE-2024-5685 | High | 7.6 | 2024-06-14 | Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call… |
CVE-2024-3912 | Critical | 9.8 | 2024-06-14 | Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute ar… |
CVE-2024-34012 | Medium | 4.4 | 2024-06-14 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.24135.272. |
CVE-2024-2472 | Critical | 9.1 | 2024-06-14 | The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start… |
CVE-2024-4863 | Medium | 6.4 | 2024-06-14 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titleFont’ parame… |
CVE-2024-37182 | Medium | 4.7 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim ove… |
CVE-2024-36287 | Low | 3.8 | 2024-06-14 | Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS. |
CVE-2024-25142 | Medium | 5.5 | 2024-06-14 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content… |
CVE-2024-5995 | High | 8.8 | 2024-06-14 | The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly configured, remainin… |
CVE-2024-5961 | | 2024-06-14 | Improper neutralization of input during web page generation vulnerability in 2ClickPortal software allows reflected cross-site scripting (XSS). An attacker mig… | |
CVE-2024-5577 | Critical | 9.8 | 2024-06-14 | The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version <= 1.1.1 via the WIW_HEADER parameter of the /system/in… |
CVE-2024-5465 | Medium | 5.9 | 2024-06-14 | Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-5464 | Medium | 4.0 | 2024-06-14 | Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2024-36503 | High | 7.3 | 2024-06-14 | Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-36502 | High | 7.9 | 2024-06-14 | Out-of-bounds read vulnerability in the audio module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-36501 | Medium | 5.6 | 2024-06-14 | Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect integrity. |
CVE-2024-36500 | High | 7.8 | 2024-06-14 | Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-36499 | Medium | 6.8 | 2024-06-14 | Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-5994 | Medium | 6.4 | 2024-06-14 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions up to, and includin… |
CVE-2024-31163 | High | 7.2 | 2024-06-14 | ASUS Download Master has a buffer overflow vulnerability. An unauthenticated remote attacker with administrative privileges can exploit this vulnerability to e… |
CVE-2024-31162 | High | 7.2 | 2024-06-14 | The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote attacker with administrative privileges… |
CVE-2024-5551 | High | 7.5 | 2024-06-14 | The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This i… |
CVE-2024-5155 | Medium | 6.1 | 2024-06-14 | The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow att… |
CVE-2024-4751 | Medium | 4.3 | 2024-06-14 | The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2024-4480 | Medium | 6.1 | 2024-06-14 | The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logge… |
CVE-2024-4404 | High | 8.5 | 2024-06-14 | The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'render_raw' function. Th… |
CVE-2024-4271 | Medium | 4.6 | 2024-06-14 | The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaSc… |
CVE-2024-4270 | Medium | 5.4 | 2024-06-14 | The SVGMagic WordPress plugin through 1.1 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScri… |
CVE-2024-4005 | Medium | 4.8 | 2024-06-14 | The Social Pixel WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-3993 | Medium | 4.6 | 2024-06-14 | The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attack… |
CVE-2024-3992 | Medium | 4.8 | 2024-06-14 | The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor… |
CVE-2024-3978 | Medium | 5.4 | 2024-06-14 | The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/… |
CVE-2024-3977 | Medium | 4.8 | 2024-06-14 | The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-3972 | Medium | 4.3 | 2024-06-14 | The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2024-3971 | Medium | 4.3 | 2024-06-14 | The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admi… |
CVE-2024-3966 | Medium | 6.1 | 2024-06-14 | The Pray For Me WordPress plugin through 1.0.4 does not sanitise and escape some parameters, which could unauthenticated visitors to perform Cross-Site Scripti… |
CVE-2024-3965 | Medium | 5.4 | 2024-06-14 | The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-3754 | Medium | 4.7 | 2024-06-14 | The Alemha watermarker WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-2218 | Medium | 4.6 | 2024-06-14 | The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-2122 | Medium | 6.4 | 2024-06-14 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via album gallery custom URLs in all versions… |
CVE-2024-23504 | Medium | 5.3 | 2024-06-14 | Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5. |
CVE-2024-1295 | Medium | 6.5 | 2024-06-14 | The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contribut… |
CVE-2024-4936 | Critical | 9.8 | 2024-06-14 | The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it poss… |
CVE-2024-3498 | High | 7.8 | 2024-06-14 | Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As fo… |
CVE-2024-3497 | High | 8.8 | 2024-06-14 | Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the af… |
CVE-2024-3496 | High | 8.8 | 2024-06-14 | Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer. As fo… |
CVE-2024-1094 | High | 7.3 | 2024-06-14 | The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modifica… |
CVE-2024-5469 | Low | 3.1 | 2024-06-14 | DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC r… |
CVE-2024-31161 | High | 7.2 | 2024-06-14 | The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerabi… |