2024 CVEs (page 255)
Page 255 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37297 | Medium | 5.4 | 2024-06-12 | WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad acto… |
CVE-2024-36840 | Critical | 9.1 | 2024-06-12 | SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive information via the… |
CVE-2024-36691 | Medium | 6.3 | 2024-06-12 | Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account informati… |
CVE-2024-36265 | Critical | 9.8 | 2024-06-12 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0… |
CVE-2024-34065 | High | 7.1 | 2024-06-12 | Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @s… |
CVE-2024-31217 | Medium | 5.3 | 2024-06-12 | Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing t… |
CVE-2024-2300 | Medium | 6.2 | 2024-06-12 | HP Advance Mobile Applications for iOS and Android are potentially vulnerable to information disclosure when using an outdated version of the application via m… |
CVE-2024-29181 | Low | 2.3 | 2024-06-12 | Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an assoc… |
CVE-2024-28964 | High | 7.8 | 2024-06-12 | Dell Common Event Enabler, version 8.9.10.0 and prior, contain an insecure deserialization vulnerability in CAVATools. A local unauthenticated attacker could p… |
CVE-2024-5891 | Medium | 4.2 | 2024-06-12 | A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having a… |
CVE-2024-36264 | Critical | 9.8 | 2024-06-12 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set `submarine.auth.de… |
CVE-2024-36263 | High | 8.1 | 2024-06-12 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Submarine Server C… |
CVE-2024-23445 | Medium | 6.5 | 2024-06-12 | It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#… |
CVE-2024-1659 | Critical | 9.8 | 2024-06-12 | Arbitrary File Upload vulnerability in MegaBIP software allows attacker to upload any file to the server (including a PHP code file) without an authentication… |
CVE-2024-1577 | Critical | 9.8 | 2024-06-12 | Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by th… |
CVE-2024-1576 | Critical | 9.8 | 2024-06-12 | SQL Injection vulnerability in MegaBIP software allows attacker to obtain site administrator privileges, including access to the administration panel and the a… |
CVE-2024-5313 | Medium | 6.5 | 2024-06-12 | CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This does not allow to dir… |
CVE-2024-25949 | High | 8.8 | 2024-06-12 | Dell OS10 Networking Switches, versions10.5.6.x, 10.5.5.x, 10.5.4.x and 10.5.3.x ,contain an improper authorization vulnerability. A remote authenticated attac… |
CVE-2024-5211 | High | 7.2 | 2024-06-12 | A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the `normalizePath()` function, intended to defend against path traver… |
CVE-2024-5056 | Medium | 6.5 | 2024-06-12 | CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behav… |
CVE-2024-5674 | Medium | 6.5 | 2024-06-12 | The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_… |
CVE-2024-4898 | Critical | 9.8 | 2024-06-12 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on th… |
CVE-2024-3492 | Medium | 6.4 | 2024-06-12 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'event', 'locati… |
CVE-2024-1766 | Medium | 4.4 | 2024-06-12 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.2.86 d… |
CVE-2024-4845 | High | 8.8 | 2024-06-12 | The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘options[list_id]’ parameter in all versions up to, and including, 5.7.22 due t… |
CVE-2024-2092 | Medium | 5.4 | 2024-06-12 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Twitter Widget in all versions up to, and inclu… |
CVE-2024-5742 | Medium | 6.7 | 2024-06-12 | A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file i… |
CVE-2024-5468 | Medium | 6.5 | 2024-06-12 | The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability… |
CVE-2024-5266 | Medium | 6.4 | 2024-06-12 | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packages, wpdm_search_re… |
CVE-2024-5154 | High | 8.1 | 2024-06-12 | A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows th… |
CVE-2024-3183 | High | 8.1 | 2024-06-12 | A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session… |
CVE-2024-3925 | Medium | 6.4 | 2024-06-12 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-2698 | High | 8.8 | 2024-06-12 | A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on… |
CVE-2024-5739 | Medium | 6.1 | 2024-06-12 | The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS (UXSS) vulnerability. This vulnerability allows for cross-site scripti… |
CVE-2024-28970 | Medium | 4.7 | 2024-06-12 | Dell Client BIOS contains an Out-of-bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulne… |
CVE-2024-0160 | Medium | 6.8 | 2024-06-12 | Dell Client Platform contains an incorrect authorization vulnerability. An attacker with physical access to the system could potentially exploit this vulnerabi… |
CVE-2024-5892 | Medium | 6.4 | 2024-06-12 | The Divi Torque Lite – Divi Theme and Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘support_unfiltered_files_upload’ f… |
CVE-2024-4924 | Medium | 6.1 | 2024-06-12 | The Social Sharing Plugin WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-36454 | Medium | 5.3 | 2024-06-12 | Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 and earlier. If this… |
CVE-2024-0427 | Medium | 6.3 | 2024-06-12 | The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some o… |
CVE-2024-3559 | Medium | 6.4 | 2024-06-12 | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_content]' parameter versions up to, and includin… |
CVE-2024-5553 | Medium | 4.4 | 2024-06-12 | The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via several parameters in all versions up to, and… |
CVE-2024-4564 | Medium | 6.4 | 2024-06-12 | The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-36856 | High | 7.5 | 2024-06-12 | RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management. An attacker can exhaust system memory and crash the da… |
CVE-2024-5543 | High | 8.1 | 2024-06-12 | The Slideshow Gallery LITE plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.8.1 due… |
CVE-2024-4892 | Medium | 6.4 | 2024-06-12 | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due… |
CVE-2024-4315 | Critical | 9.1 | 2024-06-12 | parisneo/lollms version 9.5 is vulnerable to Local File Inclusion (LFI) attacks due to insufficient path sanitization. The `sanitize_path_from_endpoint` functi… |
CVE-2024-36103 | Medium | 6.8 | 2024-06-12 | OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent attacker with an admi… |
CVE-2024-35225 | Critical | 9.6 | 2024-06-11 | Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of… |
CVE-2024-5847 | High | 8.8 | 2024-06-11 | Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chro… |
CVE-2024-5846 | High | 8.8 | 2024-06-11 | Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chro… |
CVE-2024-5845 | High | 8.8 | 2024-06-11 | Use after free in Audio in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chrom… |
CVE-2024-5844 | High | 8.8 | 2024-06-11 | Heap buffer overflow in Tab Strip in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML… |
CVE-2024-5843 | Medium | 6.5 | 2024-06-11 | Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file. (Chr… |
CVE-2024-5842 | High | 8.8 | 2024-06-11 | Use after free in Browser UI in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perfor… |
CVE-2024-5841 | High | 8.8 | 2024-06-11 | Use after free in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-5840 | Medium | 6.5 | 2024-06-11 | Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromi… |
CVE-2024-5839 | Medium | 6.5 | 2024-06-11 | Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a… |
CVE-2024-5838 | High | 8.8 | 2024-06-11 | Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromiu… |
CVE-2024-5837 | High | 8.8 | 2024-06-11 | Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pa… |
CVE-2024-5836 | High | 8.8 | 2024-06-11 | Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malicious extension to e… |
CVE-2024-5835 | High | 8.8 | 2024-06-11 | Heap buffer overflow in Tab Groups in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2024-5834 | High | 8.8 | 2024-06-11 | Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chro… |
CVE-2024-5833 | High | 8.8 | 2024-06-11 | Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pa… |
CVE-2024-5832 | High | 8.8 | 2024-06-11 | Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2024-5831 | High | 8.8 | 2024-06-11 | Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2024-5830 | High | 8.8 | 2024-06-11 | Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chrom… |
CVE-2024-5646 | Medium | 6.4 | 2024-06-11 | The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘header_size’ attribute within the Advanced Text Block widget in al… |
CVE-2024-4669 | Medium | 6.4 | 2024-06-11 | The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Basic Slider, Upcoming Events, and Schedule widgets in… |
CVE-2024-33606 | High | 8.8 | 2024-06-11 | An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM View… |
CVE-2024-28877 | High | 8.8 | 2024-06-11 | MicroDicom DICOM Viewer is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code on affected installations of DICO… |
CVE-2024-37301 | High | 7.2 | 2024-06-11 | Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are v… |
CVE-2024-36702 | High | 7.4 | 2024-06-11 | libiec61850 v1.5 was discovered to contain a heap overflow via the BerEncoder_encodeLength function at /asn1/ber_encoder.c. |
CVE-2024-35213 | Critical | 9.0 | 2024-06-11 | An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause a denial… |
CVE-2024-34406 | Medium | 5.3 | 2024-06-11 | Improper exception handling in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to cause a denial of service through the use of… |
CVE-2024-34405 | Critical | 9.1 | 2024-06-11 | Improper deep link validation in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to launch an arbitrary URL within the app. |
CVE-2024-28024 | Medium | 4.1 | 2024-06-11 | A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessible to another contr… |
CVE-2024-28022 | Medium | 6.5 | 2024-06-11 | A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts usin… |
CVE-2024-28020 | High | 8.0 | 2024-06-11 | A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a malicious high-privileged user could use the… |
CVE-2024-5851 | Low | 3.5 | 2024-06-11 | A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=feature_sc… |
CVE-2024-4190 | High | 8.1 | 2024-06-11 | Stored Cross-Site Scripting (XSS) vulnerabilities have been identified in OpenText ArcSight Logger. The vulnerabilities could be remotely exploited. |
CVE-2024-36821 | Medium | 6.8 | 2024-06-11 | Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root. |
CVE-2024-37325 | High | 8.1 | 2024-06-11 | Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability |
CVE-2024-37293 | High | 7.5 | 2024-06-11 | The AWS Deployment Framework (ADF) is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allow… |
CVE-2024-35265 | High | 7.0 | 2024-06-11 | Windows Perception Service Elevation of Privilege Vulnerability |
CVE-2024-35263 | Medium | 5.7 | 2024-06-11 | Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability |
CVE-2024-35255 | Medium | 5.5 | 2024-06-11 | Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability |
CVE-2024-35254 | High | 7.1 | 2024-06-11 | Azure Monitor Agent Elevation of Privilege Vulnerability |
CVE-2024-35253 | Medium | 4.4 | 2024-06-11 | Microsoft Azure File Sync Elevation of Privilege Vulnerability |
CVE-2024-35252 | High | 7.5 | 2024-06-11 | Azure Storage Movement Client Library Denial of Service Vulnerability |
CVE-2024-35250 | High | 7.8 | 2024-06-11 | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability |
CVE-2024-35249 | High | 8.8 | 2024-06-11 | Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability |
CVE-2024-35248 | High | 7.3 | 2024-06-11 | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
CVE-2024-34815 | Medium | 5.4 | 2024-06-11 | Missing Authorization vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export… |
CVE-2024-34804 | Medium | 5.4 | 2024-06-11 | Missing Authorization vulnerability in Tagembed.This issue affects Tagembed: from n/a through 5.8. |
CVE-2024-34799 | Medium | 6.5 | 2024-06-11 | Missing Authorization vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.82. |
CVE-2024-34768 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25. |
CVE-2024-34763 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in Saleswonder Team: Tobias Builder for WooCommerce reviews shortcodes – ReviewShort woo-product-reviews-shortcode.This iss… |
CVE-2024-34758 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in Wpmet WP Fundraising Donation and Crowdfunding Platform.This issue affects WP Fundraising Donation and Crowdfunding Plat… |
CVE-2024-32146 | Medium | 4.3 | 2024-06-11 | Missing Authorization vulnerability in Aspose.Cloud Marketplace Aspose.Words Exporter.This issue affects Aspose.Words Exporter: from n/a through 6.3.1. |