2024 CVEs (page 251)
Page 251 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5155 | Medium | 6.1 | 2024-06-14 | The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow att… |
CVE-2024-4751 | Medium | 4.3 | 2024-06-14 | The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2024-4480 | Medium | 6.1 | 2024-06-14 | The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logge… |
CVE-2024-4404 | High | 8.5 | 2024-06-14 | The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'render_raw' function. Th… |
CVE-2024-4271 | Medium | 4.6 | 2024-06-14 | The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaSc… |
CVE-2024-4270 | Medium | 5.4 | 2024-06-14 | The SVGMagic WordPress plugin through 1.1 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScri… |
CVE-2024-4005 | Medium | 4.8 | 2024-06-14 | The Social Pixel WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-3993 | Medium | 4.6 | 2024-06-14 | The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attack… |
CVE-2024-3992 | Medium | 4.8 | 2024-06-14 | The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor… |
CVE-2024-3978 | Medium | 5.4 | 2024-06-14 | The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/… |
CVE-2024-3977 | Medium | 4.8 | 2024-06-14 | The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-3972 | Medium | 4.3 | 2024-06-14 | The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacke… |
CVE-2024-3971 | Medium | 4.3 | 2024-06-14 | The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admi… |
CVE-2024-3966 | Medium | 6.1 | 2024-06-14 | The Pray For Me WordPress plugin through 1.0.4 does not sanitise and escape some parameters, which could unauthenticated visitors to perform Cross-Site Scripti… |
CVE-2024-3965 | Medium | 5.4 | 2024-06-14 | The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-3754 | Medium | 4.7 | 2024-06-14 | The Alemha watermarker WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-2218 | Medium | 4.6 | 2024-06-14 | The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-2122 | Medium | 6.4 | 2024-06-14 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via album gallery custom URLs in all versions… |
CVE-2024-23504 | Medium | 5.3 | 2024-06-14 | Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5. |
CVE-2024-1295 | Medium | 6.5 | 2024-06-14 | The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contribut… |
CVE-2024-4936 | Critical | 9.8 | 2024-06-14 | The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it poss… |
CVE-2024-3498 | High | 7.8 | 2024-06-14 | Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As fo… |
CVE-2024-3497 | High | 8.8 | 2024-06-14 | Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the af… |
CVE-2024-3496 | High | 8.8 | 2024-06-14 | Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer. As fo… |
CVE-2024-1094 | High | 7.3 | 2024-06-14 | The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modifica… |
CVE-2024-5469 | Low | 3.1 | 2024-06-14 | DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC r… |
CVE-2024-31161 | High | 7.2 | 2024-06-14 | The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerabi… |
CVE-2024-31160 | Medium | 4.8 | 2024-06-14 | The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can ins… |
CVE-2024-31159 | Medium | 4.8 | 2024-06-14 | The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can ins… |
CVE-2024-27180 | Medium | 6.7 | 2024-06-14 | An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27179 | Medium | 4.7 | 2024-06-14 | Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/ver… |
CVE-2024-27178 | High | 7.2 | 2024-06-14 | An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying file name variable. This vulnerability can be execut… |
CVE-2024-27177 | High | 7.2 | 2024-06-14 | An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying package name variable. This vulnerability can be exe… |
CVE-2024-27176 | High | 7.2 | 2024-06-14 | An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying session ID variable. This vulnerability can be execut… |
CVE-2024-27175 | Medium | 4.4 | 2024-06-14 | Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the… |
CVE-2024-27174 | Critical | 9.8 | 2024-06-14 | Remote Command program allows an attacker to get Remote Code Execution. This vulnerability can be executed in combination with other vulnerabilities and diffi… |
CVE-2024-27173 | Critical | 9.8 | 2024-06-14 | Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This vulnerability can… |
CVE-2024-27172 | Critical | 9.8 | 2024-06-14 | Remote Command program allows an attacker to get Remote Code Execution. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27171 | High | 7.4 | 2024-06-14 | A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for the affected products… |
CVE-2024-27170 | High | 7.4 | 2024-06-14 | It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with W… |
CVE-2024-27169 | High | 8.4 | 2024-06-14 | Toshiba printers provides API without authentication for internal access. A local attacker can bypass authentication in applications, providing administrative… |
CVE-2024-27168 | High | 7.1 | 2024-06-14 | It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and re… |
CVE-2024-27167 | High | 7.4 | 2024-06-14 | Toshiba printers use Sendmail to send emails to recipients. Sendmail is used with several insecure directories. A local attacker can inject a malicious Sendmai… |
CVE-2024-27166 | High | 7.4 | 2024-06-14 | Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/vers… |
CVE-2024-27165 | High | 7.8 | 2024-06-14 | Toshiba printers contain a suidperl binary and it has a Local Privilege Escalation vulnerability. A local attacker can get root privileges. As for the affected… |
CVE-2024-27164 | High | 7.1 | 2024-06-14 | Toshiba printers contain hardcoded credentials. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27163 | Medium | 6.5 | 2024-06-14 | Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API… |
CVE-2024-27162 | Medium | 6.1 | 2024-06-14 | Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the we… |
CVE-2024-27161 | Medium | 6.2 | 2024-06-14 | all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. I… |
CVE-2024-27160 | Medium | 6.2 | 2024-06-14 | All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded k… |
CVE-2024-27159 | Medium | 6.2 | 2024-06-14 | All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded k… |
CVE-2024-27158 | High | 7.4 | 2024-06-14 | All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27157 | Medium | 6.8 | 2024-06-14 | The sessions are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the aut… |
CVE-2024-27156 | Medium | 6.8 | 2024-06-14 | The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve t… |
CVE-2024-27155 | High | 7.7 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be… |
CVE-2024-0892 | Medium | 4.3 | 2024-06-14 | The Schema App Structured Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to mis… |
CVE-2024-3080 | Critical | 9.8 | 2024-06-14 | Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device. |
CVE-2024-3079 | High | 7.2 | 2024-06-14 | Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on… |
CVE-2024-27154 | Medium | 6.2 | 2024-06-14 | Passwords are stored in clear-text logs. An attacker can retrieve passwords. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27153 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27152 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27151 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be… |
CVE-2024-27150 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27149 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27148 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27147 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27146 | Medium | 6.7 | 2024-06-14 | The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27145 | Critical | 9.8 | 2024-06-14 | The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compromise any Toshiba printer. An attacker c… |
CVE-2024-27144 | Critical | 9.8 | 2024-06-14 | The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the… |
CVE-2024-27143 | Critical | 9.8 | 2024-06-14 | Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as root on the remote printer. Using this… |
CVE-2024-27142 | Medium | 5.9 | 2024-06-14 | Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a ti… |
CVE-2024-27141 | Medium | 5.9 | 2024-06-14 | Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a ti… |
CVE-2024-5985 | Medium | 6.3 | 2024-06-14 | A vulnerability classified as critical has been found in SourceCodester Best Online News Portal 1.0. This affects an unknown part of the file /admin/index.php… |
CVE-2024-5984 | High | 7.3 | 2024-06-14 | A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-5983 | High | 7.3 | 2024-06-14 | A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-5981 | Medium | 6.3 | 2024-06-14 | A vulnerability was found in itsourcecode Online House Rental System 1.0. It has been classified as critical. Affected is an unknown function of the file manag… |
CVE-2024-33253 | Medium | 5.4 | 2024-06-13 | Cross-site scripting (XSS) vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute… |
CVE-2024-31777 | Critical | 9.8 | 2024-06-13 | File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint. |
CVE-2024-0103 | Medium | 5.4 | 2024-06-13 | NVIDIA Triton Inference Server for Linux contains a vulnerability where a user may cause an incorrect Initialization of resource by network issue. A successful… |
CVE-2024-0099 | High | 7.8 | 2024-06-13 | NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where the guest OS could cause buffer overrun in the host. A successful exp… |
CVE-2024-0095 | Critical | 9.0 | 2024-06-13 | NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where a user can inject forged logs and executable commands by injecting arbitrar… |
CVE-2024-0094 | Medium | 5.5 | 2024-06-13 | NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where an untrusted guest VM can cause improper control of the interaction f… |
CVE-2024-0093 | Medium | 6.5 | 2024-06-13 | NVIDIA GPU software for Linux contains a vulnerability where it can expose sensitive information to an actor that is not explicitly authorized to have access t… |
CVE-2024-0092 | Medium | 5.5 | 2024-06-13 | NVIDIA GPU Driver for Windows and Linux contains a vulnerability where an improper check or improper handling of exception conditions might lead to denial of s… |
CVE-2024-0091 | High | 7.8 | 2024-06-13 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an untrusted pointer dereference by executing a driver API. A s… |
CVE-2024-0090 | High | 7.8 | 2024-06-13 | NVIDIA GPU driver for Windows and Linux contains a vulnerability where a user can cause an out-of-bounds write. A successful exploit of this vulnerability migh… |
CVE-2024-0089 | High | 7.8 | 2024-06-13 | NVIDIA GPU Display Driver for Windows contains a vulnerability where the information from a previous client or another process could be disclosed. A successful… |
CVE-2024-0086 | Medium | 5.5 | 2024-06-13 | NVIDIA vGPU software for Linux contains a vulnerability where the software can dereference a NULL pointer. A successful exploit of this vulnerability might lea… |
CVE-2024-0085 | Medium | 6.3 | 2024-06-13 | NVIDIA vGPU software for Windows and Linux contains a vulnerability where unprivileged users could execute privileged operations on the host. A successful expl… |
CVE-2024-0084 | High | 7.8 | 2024-06-13 | NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where the guest OS could execute privileged operations. A successful exploi… |
CVE-2024-5976 | High | 7.3 | 2024-06-13 | A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been classified as critical. Affected is the function log… |
CVE-2024-32930 | Medium | 5.5 | 2024-06-13 | In plugin_ipc_handler of slc_plugin.c, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure of… |
CVE-2024-32929 | High | 8.1 | 2024-06-13 | In gpu_slc_get_region of pixel_gpu_slc.c, there is a possible EoP due to a use after free. This could lead to local escalation of privilege with no additional… |
CVE-2024-32926 | Medium | 5.5 | 2024-06-13 | there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure with no additional execu… |
CVE-2024-32925 | High | 8.8 | 2024-06-13 | In dhd_prot_txstatus_process of dhd_msgbuf.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution w… |
CVE-2024-32924 | High | 7.5 | 2024-06-13 | In DeregAcceptProcINT of cn_NrmmStateDeregInit.cpp, there is a possible denial of service due to a logic error in the code. This could lead to remote denial of… |
CVE-2024-32923 | Medium | 4.0 | 2024-06-13 | there is a possible cellular denial of service due to a logic error in the code. This could lead to remote denial of service with no additional execution privi… |
CVE-2024-32922 | High | 7.4 | 2024-06-13 | In gpu_pm_power_on_top_nolock of pixel_gpu_power.c, there is a possible compromise of protected memory due to a logic error in the code. This could lead to loc… |
CVE-2024-32921 | High | 7.4 | 2024-06-13 | In lwis_initialize_transaction_fences of lwis_fence.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati… |
CVE-2024-32920 | High | 7.1 | 2024-06-13 | In set_secure_reg of sac_handler.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure of 4… |