2024 CVEs (page 260)
Page 260 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35701 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects… |
CVE-2024-35699 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes HT Feed allows Stored XSS.This issue aff… |
CVE-2024-35698 | Medium | 5.9 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Tab Manager yith-woocommerce-ta… |
CVE-2024-35697 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThimPress Eduma allows Reflected XSS.This issue af… |
CVE-2024-35696 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Reflected XSS.This is… |
CVE-2024-35695 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Stored XSS.This issue… |
CVE-2024-35694 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobil… |
CVE-2024-35693 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list… |
CVE-2024-35691 | Medium | 6.5 | 2024-06-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - E… |
CVE-2024-35689 | Medium | 5.4 | 2024-06-08 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.2.3. |
CVE-2024-35688 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Sto… |
CVE-2024-35687 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows… |
CVE-2024-35684 | Medium | 4.3 | 2024-06-08 | Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress: from n/a through <= 5.1.1. |
CVE-2024-35682 | Medium | 4.3 | 2024-06-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2… |
CVE-2024-35681 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in gVectors Team wpDiscuz allows Stored XSS.This issu… |
CVE-2024-35679 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a… |
CVE-2024-34765 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sensei Sensei Pro (WC Paid Courses) allows Stored… |
CVE-2024-37408 | High | 7.3 | 2024-06-08 | fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pam_fprintd.so" for Sudo. NOTE… |
CVE-2024-35719 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagniGenie RestroPress allows Stored XSS.This issu… |
CVE-2024-35718 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS.This is… |
CVE-2024-35715 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in peregrinethemes Bloglo, peregrinethemes Blogvi all… |
CVE-2024-35714 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Idyllic allows Stored XSS.This issue… |
CVE-2024-35713 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in UAPP GROUP Testimonial Carousel For Elementor allo… |
CVE-2024-35711 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Event allows Stored XSS.This issue a… |
CVE-2024-35710 | Medium | 5.3 | 2024-06-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Podlove Podlove Web Player.This issue affects Podlove Web Player: from n/a through… |
CVE-2024-35709 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite… |
CVE-2024-35708 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in apollo13themes Rife Free allows Stored XSS.This is… |
CVE-2024-35707 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login allows Stored XS… |
CVE-2024-37407 | Critical | 9.1 | 2024-06-08 | Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directo… |
CVE-2024-36970 | Medium | 5.5 | 2024-06-08 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: Use request_module_nowait This appears to work around a deadlock regressio… |
CVE-2024-36969 | Medium | 5.5 | 2024-06-08 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix division by zero in setup_dsc_config When slice_height is 0, the div… |
CVE-2024-36968 | High | 7.6 | 2024-06-08 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() l2cap_le_flowctl_init() can… |
CVE-2024-36967 | Medium | 5.5 | 2024-06-08 | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak in tpm2_key_encode() 'scratch' is never freed. Fix this by… |
CVE-2024-36966 | Medium | 5.5 | 2024-06-08 | In the Linux kernel, the following vulnerability has been resolved: erofs: reliably distinguish block based and fscache mode When erofs_kill_sb() is called i… |
CVE-2024-36965 | High | 7.8 | 2024-06-08 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: mediatek: Make sure IPI buffer fits in L2TCM The IPI buffer location is read… |
CVE-2024-35752 | Medium | 5.9 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Enea Overclokk Stellissimo Text Box allows Stored… |
CVE-2024-35751 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Creative Motion, Will Bontrager Software, LLC Wood… |
CVE-2024-35750 | High | 8.5 | 2024-06-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsive Image Gallery, Gallery Album.This iss… |
CVE-2024-35740 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Pixgraphy allows Stored XSS.This iss… |
CVE-2024-35739 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affect… |
CVE-2024-35738 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kognetiks Kognetiks Chatbot for WordPress allows S… |
CVE-2024-35737 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Loopus WP Visitors Tracker allows Reflected XSS.Th… |
CVE-2024-35736 | High | 8.5 | 2024-06-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer.This issue affects Visualizer: from… |
CVE-2024-35734 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodePeople WP Time Slots Booking Form allows Store… |
CVE-2024-35733 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RLDD Auto Coupons for WooCommerce allows Reflected… |
CVE-2024-35732 | Medium | 5.9 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH Custom Login yith-custom-login.This issue a… |
CVE-2024-35731 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Moose Kenta Gutenberg Blocks Responsive Blocks… |
CVE-2024-35730 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in realmag777 Active Products Tables for WooCommerce… |
CVE-2024-5766 | Low | 2.4 | 2024-06-08 | A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin of the component… |
CVE-2024-35756 | Medium | 5.9 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CeiKay Tooltip CK tooltip-ck allows Stored XSS.Thi… |
CVE-2024-35755 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in El tiempo Weather Widget Pro allows Stored XSS.Thi… |
CVE-2024-35753 | Medium | 6.5 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TemplatesNext TemplatesNext OnePager allows Stored… |
CVE-2024-5654 | Medium | 6.5 | 2024-06-08 | The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_… |
CVE-2024-4468 | Medium | 4.3 | 2024-06-08 | The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functi… |
CVE-2024-5091 | High | 7.4 | 2024-06-08 | The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Age Gate and Creative Slider widgets in all ver… |
CVE-2024-5638 | Medium | 6.1 | 2024-06-08 | The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ti_customizer_notify_dismiss_recommended_plugins… |
CVE-2024-5613 | Medium | 6.1 | 2024-06-08 | The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'quality_customizer_notify_dismiss_action' AJAX a… |
CVE-2024-5087 | Medium | 6.3 | 2024-06-08 | The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the val… |
CVE-2024-4661 | Medium | 4.3 | 2024-06-08 | The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax function in all version… |
CVE-2024-5770 | Medium | 4.2 | 2024-06-08 | The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_sa… |
CVE-2024-3668 | High | 8.8 | 2024-06-08 | The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the pl… |
CVE-2024-5663 | Medium | 6.4 | 2024-06-08 | The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Cards widget in all versions up to, and includi… |
CVE-2024-0444 | High | 8.8 | 2024-06-07 | GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2024-1694 | High | 7.8 | 2024-06-07 | Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to bypass discretionary access control via a malic… |
CVE-2024-37388 | Critical | 9.1 | 2024-06-07 | An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cau… |
CVE-2024-36827 | High | 7.5 | 2024-06-07 | An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information o… |
CVE-2024-5745 | High | 7.3 | 2024-06-07 | A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /a… |
CVE-2024-37163 | Medium | 6.4 | 2024-06-07 | SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecured HTTP requests, le… |
CVE-2024-32502 | High | 8.4 | 2024-06-07 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos… |
CVE-2024-31959 | High | 8.4 | 2024-06-07 | An issue was discovered in Samsung Mobile Processor Exynos 2200, Exynos 1480, Exynos 2400. It lacks a check for the validation of native handles, which can res… |
CVE-2024-31958 | Medium | 6.8 | 2024-06-07 | An issue was discovered in Samsung Mobile Processor EExynos 2200, Exynos 1480, Exynos 2400. It lacks a check for the validation of native handles, which can re… |
CVE-2024-30163 | Critical | 9.8 | 2024-06-07 | Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryVi… |
CVE-2024-30162 | High | 7.2 | 2024-06-07 | Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolba… |
CVE-2024-32503 | High | 8.4 | 2024-06-07 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos… |
CVE-2024-37162 | Medium | 4.0 | 2024-06-07 | zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server t… |
CVE-2024-36792 | High | 8.2 | 2024-06-07 | An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to gain access to the router's pin. |
CVE-2024-36790 | High | 8.8 | 2024-06-07 | Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext. |
CVE-2024-36789 | High | 8.1 | 2024-06-07 | An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to create passwords that do not conform to defined security standards. |
CVE-2024-36788 | Medium | 4.8 | 2024-06-07 | Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly intercept and access sensi… |
CVE-2024-36787 | High | 8.8 | 2024-06-07 | An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 allows attackers to bypass authentication and access the administrative interface via unspecified vec… |
CVE-2024-36773 | Medium | 4.8 | 2024-06-07 | A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2024-37160 | Medium | 4.8 | 2024-06-07 | Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying si… |
CVE-2024-31878 | Medium | 5.3 | 2024-06-07 | IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can be used by a malici… |
CVE-2024-5599 | High | 7.5 | 2024-06-07 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin… |
CVE-2024-5542 | High | 7.2 | 2024-06-07 | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-5438 | Medium | 4.3 | 2024-06-07 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2024-5382 | Medium | 6.5 | 2024-06-07 | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification o… |
CVE-2024-36673 | Critical | 9.8 | 2024-06-07 | Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. This vulnerability stems from inadequate validation o… |
CVE-2024-5734 | Medium | 6.3 | 2024-06-07 | A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. Affected is an unknown function of the file /members/poster… |
CVE-2024-5733 | High | 7.3 | 2024-06-07 | A vulnerability was found in itsourcecode Online Discussion Forum 1.0. It has been rated as critical. This issue affects some unknown processing of the file re… |
CVE-2024-4610 | High | 7.8 | 2024-06-07 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU me… |
CVE-2024-5637 | High | 7.5 | 2024-06-07 | The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' function in all ver… |
CVE-2024-5732 | High | 7.3 | 2024-06-07 | A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Po… |
CVE-2024-5645 | Medium | 6.4 | 2024-06-07 | The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_css_id’ parameter within the Button widget in all versions up… |
CVE-2024-5481 | Medium | 6.8 | 2024-06-07 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 vi… |
CVE-2024-5426 | Medium | 6.4 | 2024-06-07 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ parameter in all ver… |
CVE-2024-4703 | Medium | 6.4 | 2024-06-07 | The One Page Express Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's one_page_express_contact_form shortcode in al… |
CVE-2024-4489 | Medium | 6.4 | 2024-06-07 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions u… |
CVE-2024-4488 | Medium | 6.4 | 2024-06-07 | The Royal Elementor Addons and Templates for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘inline_list’ parameter in versions up to, and incl… |
CVE-2024-4451 | Medium | 6.4 | 2024-06-07 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode in all versions up t… |