2024 CVEs (page 263)
Page 263 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4608 | Medium | 6.4 | 2024-06-06 | The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-4459 | Medium | 6.4 | 2024-06-06 | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget's titles in all versions up to, a… |
CVE-2024-4458 | Medium | 6.4 | 2024-06-06 | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in several widgets via URL parameters in all versions up… |
CVE-2024-4364 | Medium | 6.4 | 2024-06-06 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button widgets in all versions up to, and includ… |
CVE-2024-4212 | Medium | 6.4 | 2024-06-06 | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TF Group Image, TF Nav Menu, TF Posts, T… |
CVE-2024-2922 | Medium | 6.4 | 2024-06-06 | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget tags in all versions up to, and including, 2.1… |
CVE-2024-1175 | Medium | 5.3 | 2024-06-06 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the… |
CVE-2024-0972 | Medium | 5.3 | 2024-06-06 | The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 via the REST API… |
CVE-2024-2017 | Medium | 5.4 | 2024-06-06 | The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the… |
CVE-2024-5342 | Medium | 6.4 | 2024-06-06 | The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sips_popup' shortcode in all versions up t… |
CVE-2024-5324 | High | 8.8 | 2024-06-06 | Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'imp… |
CVE-2024-5224 | Medium | 6.4 | 2024-06-06 | The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cardoza_facebook_like_box… |
CVE-2024-5179 | High | 8.8 | 2024-06-06 | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'item_style' an… |
CVE-2024-5001 | Medium | 6.4 | 2024-06-06 | The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_id', 'oxi_addons_f_… |
CVE-2024-4942 | Medium | 4.4 | 2024-06-06 | The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insuffi… |
CVE-2024-4788 | Medium | 4.3 | 2024-06-06 | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-4705 | Medium | 6.4 | 2024-06-06 | The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all versions up to, and in… |
CVE-2024-4194 | Medium | 6.5 | 2024-06-06 | The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. Th… |
CVE-2024-2350 | Medium | 6.4 | 2024-06-06 | The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CAFE Icon, CAFE Team Member, and CAFE Slider widgets… |
CVE-2024-0910 | Medium | 5.3 | 2024-06-06 | The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 due to improper res… |
CVE-2024-0912 | Medium | 4.2 | 2024-06-06 | Under certain circumstances the Microsoft® Internet Information Server (IIS) used to host the C•CURE 9000 Web Server will log Microsoft Windows credential deta… |
CVE-2024-5653 | High | 7.3 | 2024-06-05 | A vulnerability, which was classified as critical, has been found in Chanjet Smooth T+system 3.5. This issue affects some unknown processing of the file /tplus… |
CVE-2024-5171 | Critical | 9.8 | 2024-06-05 | Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers: * Calling aom_… |
CVE-2024-36670 | High | 8.8 | 2024-06-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=del |
CVE-2024-36669 | High | 8.8 | 2024-06-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=add. |
CVE-2024-36668 | High | 8.8 | 2024-06-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=del |
CVE-2024-36667 | High | 8.8 | 2024-06-05 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/idcProType_deal.php?mudi=add&nohrefStr=close |
CVE-2024-28818 | Medium | 5.9 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280… |
CVE-2024-27382 | Medium | 6.0 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame()… |
CVE-2024-27381 | Medium | 6.0 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame_u… |
CVE-2024-27380 | Medium | 6.0 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_set_delayed_wakeup_… |
CVE-2024-27379 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_subscribe_get_n… |
CVE-2024-27378 | Medium | 6.0 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame_c… |
CVE-2024-27377 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_get_security_in… |
CVE-2024-27376 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_subscribe_get_n… |
CVE-2024-27375 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl… |
CVE-2024-27374 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_publish_get_nl_… |
CVE-2024-27373 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_p… |
CVE-2024-27372 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_p… |
CVE-2024-27371 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl… |
CVE-2024-27370 | Medium | 6.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_p… |
CVE-2024-5184 | Medium | 6.5 | 2024-06-05 | The EmailGPT service contains a prompt injection vulnerability. The service uses an API service that allows a malicious user to inject a direct prompt and take… |
CVE-2024-5037 | High | 7.5 | 2024-06-05 | A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON… |
CVE-2024-4009 | Critical | 9.2 | 2024-06-05 | Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-Syst… |
CVE-2024-4008 | Critical | 9.6 | 2024-06-05 | FDSK Leak in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to take control via access to local KNX Bus-System |
CVE-2024-36129 | High | 8.2 | 2024-06-05 | The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability… |
CVE-2024-35674 | Medium | 4.3 | 2024-06-05 | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.T… |
CVE-2024-20405 | Medium | 4.8 | 2024-06-05 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploi… |
CVE-2024-20404 | High | 7.2 | 2024-06-05 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected… |
CVE-2024-24790 | Critical | 9.8 | 2024-06-05 | The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return t… |
CVE-2024-24789 | Medium | 5.5 | 2024-06-05 | The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be expl… |
CVE-2024-5629 | Medium | 4.7 | 2024-06-05 | An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception whic… |
CVE-2024-4812 | Medium | 4.8 | 2024-06-05 | A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can… |
CVE-2024-3716 | Medium | 6.2 | 2024-06-05 | A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list an… |
CVE-2024-36837 | High | 7.5 | 2024-06-05 | SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController… |
CVE-2024-35673 | Medium | 4.3 | 2024-06-05 | Cross-Site Request Forgery (CSRF) vulnerability in Pure Chat by Ruby Pure Chat.This issue affects Pure Chat: from n/a through 2.22. |
CVE-2024-5459 | Medium | 4.3 | 2024-06-05 | The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on 'add_section', '… |
CVE-2024-3469 | Medium | 6.1 | 2024-06-05 | The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due t… |
CVE-2024-5526 | High | 7.7 | 2024-06-05 | Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tai… |
CVE-2024-1662 | High | 7.5 | 2024-06-05 | Missing Authentication for Critical Function, Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application allo… |
CVE-2024-4001 | Medium | 6.4 | 2024-06-05 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in all versions up to… |
CVE-2024-5536 | Medium | 6.4 | 2024-06-05 | The GamiPress – Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gamipress_link shortcode in all versions up to, and inc… |
CVE-2024-5571 | Medium | 6.4 | 2024-06-05 | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress… |
CVE-2024-4821 | Medium | 6.4 | 2024-06-05 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbox shortcode in all… |
CVE-2024-4743 | High | 8.8 | 2024-06-05 | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlms_favorites sho… |
CVE-2024-1272 | High | 7.5 | 2024-06-05 | Inclusion of Sensitive Information in Source Code vulnerability in TNB Mobile Solutions Cockpit Software allows Retrieve Embedded Sensitive Data. This issue a… |
CVE-2024-5453 | Medium | 4.3 | 2024-06-05 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2024-5439 | Medium | 6.4 | 2024-06-05 | The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and including, 2.0.50 due t… |
CVE-2024-5006 | Medium | 6.4 | 2024-06-05 | The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up… |
CVE-2024-4939 | Medium | 6.4 | 2024-06-05 | The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all versions up to, and inc… |
CVE-2024-23669 | Medium | 6.5 | 2024-06-05 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-5222 | Medium | 6.4 | 2024-06-05 | The Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. plugin for WordPress is vulnerable to Stored Cross-S… |
CVE-2024-4088 | Medium | 4.3 | 2024-06-05 | The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-2368 | Medium | 4.3 | 2024-06-05 | The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due to missing or incor… |
CVE-2024-1164 | Medium | 6.4 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error message and redirect URL… |
CVE-2024-4886 | Medium | 4.3 | 2024-06-05 | The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request |
CVE-2024-4295 | Critical | 9.8 | 2024-06-05 | The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, and including, 5.7… |
CVE-2024-3667 | High | 7.4 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in all versions up to, a… |
CVE-2024-2087 | High | 7.2 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form name values in all versions up to, and including, 2.4.4… |
CVE-2024-1940 | High | 7.1 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content in all versions up to, and including, 2.4.41 due to… |
CVE-2024-1161 | Medium | 6.4 | 2024-06-05 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes for blocks in all versions up to… |
CVE-2024-5149 | Medium | 6.5 | 2024-06-05 | The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently ran… |
CVE-2024-34055 | Medium | 6.5 | 2024-06-05 | Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single c… |
CVE-2024-5262 | Critical | 9.8 | 2024-06-05 | Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files… |
CVE-2024-5483 | Medium | 5.3 | 2024-06-05 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to… |
CVE-2024-5317 | Medium | 6.4 | 2024-06-05 | The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions up to, and including, 8.3.4 due to ins… |
CVE-2024-5636 | Medium | 6.3 | 2024-06-05 | A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2024-4084 | High | 7.5 | 2024-06-05 | A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix in… |
CVE-2024-5635 | Medium | 6.3 | 2024-06-04 | A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2024-36675 | Critical | 9.1 | 2024-06-04 | LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function. |
CVE-2024-36121 | Medium | 5.9 | 2024-06-04 | netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this s… |
CVE-2024-30889 | Medium | 5.4 | 2024-06-04 | Cross Site Scripting vulnerability in audimex audimexEE v.15.1.2 and fixed in 15.1.3.9 allows a remote attacker to execute arbitrary code via the service, meth… |
CVE-2024-4220 | Medium | 4.3 | 2024-06-04 | Prior to 23.1, an information disclosure vulnerability exists within BeyondInsight which can allow an attacker to enumerate usernames. |
CVE-2024-4219 | Medium | 4.8 | 2024-06-04 | Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a server-side request forg… |
CVE-2024-34364 | Medium | 5.7 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will… |
CVE-2024-34363 | High | 7.5 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception… |
CVE-2024-34362 | Medium | 5.9 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in `HttpConnectionManager` (HCM) with `EnvoyQuicServerStream` that can c… |
CVE-2024-32976 | High | 7.5 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data w… |
CVE-2024-32975 | Medium | 5.9 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. There is a crash at `QuicheDataReader::PeekVarInt62Length()`. It is caused by integer underflow in… |
CVE-2024-32974 | Medium | 5.9 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call st… |