2024 CVEs (page 265)
Page 265 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4274 | Medium | 4.3 | 2024-06-04 | The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_property_attachment_ajax… |
CVE-2024-4273 | Medium | 6.4 | 2024-06-04 | The Essential Real Estate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ere_property_map' shortcode in all versions up to… |
CVE-2024-4180 | Critical | 9.1 | 2024-06-04 | The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX. |
CVE-2024-4057 | Medium | 6.1 | 2024-06-04 | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them bac… |
CVE-2024-3555 | High | 7.2 | 2024-06-04 | The Social Link Pages: link-in-bio landing pages for your social media profiles plugin for WordPress is vulnerable to unauthorized access due to a missing capa… |
CVE-2024-3230 | Medium | 6.4 | 2024-06-04 | The Download Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'download-attachments' shortcode in all versions up… |
CVE-2024-3031 | Medium | 4.4 | 2024-06-04 | The Fluid Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.3 due… |
CVE-2024-2470 | Medium | 5.4 | 2024-06-04 | The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-2382 | Medium | 5.3 | 2024-06-04 | The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 8.0. This is due t… |
CVE-2024-2019 | High | 7.5 | 2024-06-04 | The WP-DB-Table-Editor plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to lack of a default capab… |
CVE-2024-1718 | Medium | 5.3 | 2024-06-04 | The Claudio Sanches – Checkout Cielo for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient payment valida… |
CVE-2024-1717 | Medium | 4.3 | 2024-06-04 | The Admin Notices Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_ajax_call() functio… |
CVE-2024-0757 | Medium | 5.4 | 2024-06-04 | The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on… |
CVE-2024-3888 | Medium | 6.4 | 2024-06-04 | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button shortcode in all versions up to, and including, 4… |
CVE-2024-4870 | High | 7.2 | 2024-06-04 | The Frontend Registration – Contact Form 7 plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1 due to insufficient… |
CVE-2024-4552 | Critical | 9.8 | 2024-06-04 | The Social Login Lite For WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.6.0. This is due to insuf… |
CVE-2024-29976 | Medium | 6.5 | 2024-06-04 | ** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.2… |
CVE-2024-29975 | Medium | 6.7 | 2024-06-04 | ** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AA… |
CVE-2024-29974 | Critical | 9.8 | 2024-06-04 | ** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZ… |
CVE-2024-29973 | Critical | 9.8 | 2024-06-04 | ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and… |
CVE-2024-29972 | Critical | 9.8 | 2024-06-04 | ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17… |
CVE-2024-36782 | Critical | 9.8 | 2024-06-03 | TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root. |
CVE-2024-36783 | Critical | 9.8 | 2024-06-03 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection via the host_time parameter in the NTPSyncWithHost function. |
CVE-2024-34987 | Critical | 9.1 | 2024-06-03 | A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2. The vulnerability allows attackers to… |
CVE-2024-34051 | Medium | 4.6 | 2024-06-03 | A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arb… |
CVE-2024-31682 | Critical | 9.8 | 2024-06-03 | Incorrect access control in the fingerprint authentication mechanism of Phone Cleaner: Boost & Clean v2.2.0 allows attackers to bypass fingerprint authenticati… |
CVE-2024-31684 | Low | 3.5 | 2024-06-03 | Incorrect access control in the fingerprint authentication mechanism of Bitdefender Mobile Security v4.11.3-gms allows attackers to bypass fingerprint authenti… |
CVE-2024-4332 | | 2024-06-03 | An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use L… | |
CVE-2024-37019 | Critical | 9.8 | 2024-06-03 | Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication. |
CVE-2024-4540 | High | 7.5 | 2024-06-03 | A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RES… |
CVE-2024-36674 | Medium | 6.1 | 2024-06-03 | LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php. |
CVE-2024-32983 | High | 8.2 | 2024-06-03 | Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed Activit… |
CVE-2024-36128 | High | 7.5 | 2024-06-03 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string ge… |
CVE-2024-36127 | High | 7.5 | 2024-06-03 | apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed… |
CVE-2024-36124 | Medium | 5.3 | 2024-06-03 | iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because… |
CVE-2024-36123 | Medium | 6.5 | 2024-06-03 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML… |
CVE-2024-5197 | Critical | 9.1 | 2024-06-03 | There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may resul… |
CVE-2024-36729 | Medium | 6.3 | 2024-06-03 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbit… |
CVE-2024-36728 | High | 8.1 | 2024-06-03 | TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbit… |
CVE-2024-36569 | High | 8.1 | 2024-06-03 | Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php. |
CVE-2024-36568 | Critical | 9.8 | 2024-06-03 | Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=. |
CVE-2024-0336 | | 2024-06-03 | Missing Authentication for Critical Function vulnerability in EMTA Grup PDKS allows Exploiting Incorrectly Configured Access Control Security Levels. This iss… | |
CVE-2024-35632 | Medium | 4.3 | 2024-06-03 | Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks. Integration for Contact Form 7 and Constant Contact.This issue affects Integration for Contact Fo… |
CVE-2024-34770 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Popup Maker Popup Maker WP popup-maker-wp allows Stored X… |
CVE-2024-34769 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in cyclonetheme Elegant Blocks allows Stored XSS.This… |
CVE-2024-34767 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes ShopLentor allows Stored XSS.This issue… |
CVE-2024-34766 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic ChaosTheory allows Stored XSS.This issu… |
CVE-2024-34385 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Wishlist yith-woocommerce-wishl… |
CVE-2024-35631 | High | 7.1 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Foliovision FV Flowplayer Video Player allows Refl… |
CVE-2024-35630 | High | 7.6 | 2024-06-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LJ Apps WP TripAdvisor Review Slider allows Blind SQL Inj… |
CVE-2024-34803 | Medium | 4.3 | 2024-06-03 | Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25. |
CVE-2024-34801 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mervin Praison Praison SEO WordPress seo-wordpress allows… |
CVE-2024-34798 | Medium | 5.3 | 2024-06-03 | Insertion of Sensitive Information into Log File vulnerability in Lukman Nakib Debug Log – Manger Tool.This issue affects Debug Log – Manger Tool: from n/a thr… |
CVE-2024-34797 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Benoit Mercusot Simple Popup Manager allows Stored… |
CVE-2024-34796 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue… |
CVE-2024-34795 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: f… |
CVE-2024-34794 | High | 7.1 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: f… |
CVE-2024-34793 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kharim Tomlinson WP Next Post Navi allows Stored X… |
CVE-2024-34791 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpbean WPB Elementor Addons allows Stored XSS.This… |
CVE-2024-34790 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hans van Eijsden,niwreg ImageMagick Sharpen Resize… |
CVE-2024-34789 | Medium | 6.5 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Hait Post Grid Elementor Addon allows Stored XS… |
CVE-2024-34754 | Medium | 5.3 | 2024-06-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Contact Form Widget.This issue affects Contact Form Widget: from n/a thro… |
CVE-2024-3829 | Critical | 9.1 | 2024-06-03 | qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability b… |
CVE-2024-35635 | Medium | 4.4 | 2024-06-03 | Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9. |
CVE-2024-35633 | Medium | 4.4 | 2024-06-03 | Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through… |
CVE-2024-23670 | High | 7.8 | 2024-06-03 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-23668 | High | 8.8 | 2024-06-03 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-23667 | High | 7.8 | 2024-06-03 | An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, F… |
CVE-2024-23665 | Medium | 5.9 | 2024-06-03 | Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3… |
CVE-2024-23664 | Medium | 6.1 | 2024-06-03 | A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow… |
CVE-2024-23363 | High | 7.5 | 2024-06-03 | Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame. |
CVE-2024-23360 | High | 8.4 | 2024-06-03 | Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers. |
CVE-2024-21478 | Medium | 6.2 | 2024-06-03 | transient DOS when setting up a fence callback to free a KGSL memory entry object during DMA. |
CVE-2024-5404 | Critical | 9.8 | 2024-06-03 | An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism. |
CVE-2024-35639 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webliberty Simple Spoiler simple-spoiler.This issue affec… |
CVE-2024-35638 | Medium | 4.3 | 2024-06-03 | Cross-Site Request Forgery (CSRF) vulnerability in JumpDEMAND Inc. ActiveDEMAND.This issue affects ActiveDEMAND: from n/a through 0.2.43. |
CVE-2024-35637 | Medium | 4.4 | 2024-06-03 | Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6. |
CVE-2024-36964 | High | 8.8 | 2024-06-03 | In the Linux kernel, the following vulnerability has been resolved: fs/9p: only translate RWX permissions for plain 9P2000 Garbage in plain 9P2000's perm bit… |
CVE-2024-36963 | High | 7.8 | 2024-06-03 | In the Linux kernel, the following vulnerability has been resolved: tracefs: Reset permissions on remount if permissions are options There's an inconsistency… |
CVE-2024-36962 | High | 7.5 | 2024-06-03 | In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs Currently the drive… |
CVE-2024-36961 | High | 7.8 | 2024-06-03 | In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Fix two locking issues with thermal zone debug With the current thermal… |
CVE-2024-36960 | High | 7.1 | 2024-06-03 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix invalid reads in fence signaled events Correctly set the length of the dr… |
CVE-2024-35640 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tomas Cordero Safety Exit allows Stored XSS.This i… |
CVE-2024-31493 | Medium | 6.5 | 2024-06-03 | An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7… |
CVE-2024-23107 | Medium | 5.5 | 2024-06-03 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and bel… |
CVE-2024-5311 | Critical | 9.8 | 2024-06-03 | DigiWin EasyFlow .NET lacks validation for certain input parameters. An unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and… |
CVE-2024-35643 | Medium | 5.9 | 2024-06-03 | Cross Site Scripting (XSS) vulnerability in Xabier Miranda WP Back Button allows Stored XSS.This issue affects WP Back Button: from n/a through 1.1.3. |
CVE-2024-35642 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bryan Hadaway Site Favicon allows Stored XSS.This… |
CVE-2024-35641 | Medium | 5.9 | 2024-06-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GregRoss Just Writing Statistics allows Stored XSS… |
CVE-2024-37031 | Medium | 6.1 | 2024-06-03 | The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be late… |
CVE-2024-36042 | Critical | 9.8 | 2024-06-03 | Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with supe… |
CVE-2024-20075 | Medium | 6.7 | 2024-06-03 | In eemgpu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2024-20074 | Medium | 6.6 | 2024-06-03 | In dmc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2024-20073 | Medium | 6.6 | 2024-06-03 | In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System executi… |
CVE-2024-20072 | Medium | 6.6 | 2024-06-03 | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System executio… |
CVE-2024-20071 | Medium | 4.4 | 2024-06-03 | In wlan driver, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution… |
CVE-2024-20070 | Medium | 5.1 | 2024-06-03 | In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation. This could lead to… |
CVE-2024-20069 | Medium | 6.5 | 2024-06-03 | In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check. This could lead to remote informati… |
CVE-2024-20068 | Medium | 5.9 | 2024-06-03 | In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privilege… |
CVE-2024-20067 | Critical | 9.8 | 2024-06-03 | In modem, there is a possible out of bounds write due to improper input invalidation. This could lead to remote denial of service with no additional execution… |