2024 CVEs (page 271)
Page 271 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5354 | Medium | 4.3 | 2024-05-26 | A vulnerability classified as problematic was found in anji-plus AJ-Report up to 1.4.1. This vulnerability affects unknown code of the file /reportShare/detail… |
CVE-2024-5353 | Medium | 6.3 | 2024-05-26 | A vulnerability classified as critical has been found in anji-plus AJ-Report up to 1.4.1. This affects the function decompress of the component ZIP File Handle… |
CVE-2024-5352 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been rated as critical. Affected by this issue is the function validationRules of the comp… |
CVE-2024-5351 | Medium | 6.3 | 2024-05-26 | A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been declared as critical. Affected by this vulnerability is the function getValueFromJs o… |
CVE-2024-5350 | Medium | 6.3 | 2024-05-25 | A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been classified as critical. Affected is the function pageList of the file /pageList. The… |
CVE-2024-5340 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been rated as critical. Affected by this issue is some unknown functionality of the file /vie… |
CVE-2024-30056 | High | 7.1 | 2024-05-25 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-5339 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-5338 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been classified as critical. Affected is an unknown function of the file /view/vpn/autovpn/on… |
CVE-2024-5337 | Medium | 4.7 | 2024-05-25 | A vulnerability was found in Ruijie RG-UAC up to 20240516 and classified as critical. This issue affects some unknown processing of the file /view/systemConfig… |
CVE-2024-5336 | Medium | 4.7 | 2024-05-25 | A vulnerability has been found in Ruijie RG-UAC up to 20240516 and classified as critical. This vulnerability affects the function addVlan of the file /view/ne… |
CVE-2024-4045 | Medium | 6.4 | 2024-05-25 | The Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-5218 | Medium | 6.4 | 2024-05-25 | The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions… |
CVE-2024-5229 | Medium | 6.4 | 2024-05-25 | The Primary Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to… |
CVE-2024-4858 | Medium | 5.3 | 2024-05-25 | The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_t… |
CVE-2024-5220 | Medium | 6.4 | 2024-05-25 | The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 d… |
CVE-2024-36079 | Medium | 6.5 | 2024-05-24 | An issue was discovered in Vaultize 21.07.27. When uploading files, there is no check that the filename parameter is correct. As a result, a temporary file wil… |
CVE-2024-35374 | Critical | 9.8 | 2024-05-24 | Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary c… |
CVE-2024-35373 | Critical | 9.8 | 2024-05-24 | Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php. |
CVE-2024-35232 | Low | 3.7 | 2024-05-24 | github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be ex… |
CVE-2024-35388 | High | 8.8 | 2024-05-24 | TOTOLINK NR1800X v9.1.0u.6681_B20230703 was discovered to contain a stack overflow via the password parameter in the function urldecode |
CVE-2024-33471 | High | 7.2 | 2024-05-24 | An issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request. NOT… |
CVE-2024-35387 | Critical | 9.8 | 2024-05-24 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth. |
CVE-2024-36049 | Medium | 6.5 | 2024-05-24 | Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and passwords from the dat… |
CVE-2024-35396 | Critical | 9.8 | 2024-05-24 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to lo… |
CVE-2024-35395 | High | 8.8 | 2024-05-24 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as… |
CVE-2024-34995 | Medium | 4.3 | 2024-05-24 | svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserController#importOve… |
CVE-2024-35618 | High | 7.5 | 2024-05-24 | PingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer. |
CVE-2024-35340 | High | 8.6 | 2024-05-24 | Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeCommand. |
CVE-2024-35339 | Critical | 9.8 | 2024-05-24 | Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac. |
CVE-2024-33809 | Medium | 6.5 | 2024-05-24 | PingCAP TiDB v7.5.1 was discovered to contain a buffer overflow vulnerability, which could lead to database crashes and denial of service attacks. |
CVE-2024-33470 | Medium | 4.9 | 2024-05-24 | An issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in plaintext via a passback attack. NOTE: Thi… |
CVE-2024-31510 | Critical | 9.8 | 2024-05-24 | An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /pqcrystals-dilithiu… |
CVE-2024-22588 | Medium | 6.5 | 2024-05-24 | Kwik commit 745fd4e2 does not discard unused encryption keys. |
CVE-2024-5273 | Medium | 4.3 | 2024-05-24 | Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item… |
CVE-2024-35595 | Medium | 6.1 | 2024-05-24 | An arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary code via uploading a cr… |
CVE-2024-35593 | Medium | 5.5 | 2024-05-24 | An arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uploading a crafted PDF… |
CVE-2024-35592 | Critical | 9.6 | 2024-05-24 | An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-35591 | Medium | 5.4 | 2024-05-24 | An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-5318 | Medium | 4.0 | 2024-05-24 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.11 prior to 16.10.6, starting from 16.11 prior to 16.11.3, and starting fr… |
CVE-2024-5312 | Medium | 6.3 | 2024-05-24 | PHP Server Monitor, version 3.2.0, is vulnerable to an XSS via the /phpservermon-3.2.0/vendor/phpmailer/phpmailer/test_script/index.php page in all visible par… |
CVE-2024-4455 | High | 7.2 | 2024-05-24 | The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2… |
CVE-2024-5315 | Critical | 9.1 | 2024-05-24 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a speciall… |
CVE-2024-5314 | Critical | 9.1 | 2024-05-24 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a speciall… |
CVE-2024-5310 | Low | 2.4 | 2024-05-24 | A vulnerability classified as problematic has been found in JFinalCMS up to 20221020. This affects an unknown part of the file /admin/content. The manipulation… |
CVE-2024-4037 | Medium | 6.5 | 2024-05-24 | The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to th… |
CVE-2024-4366 | Medium | 6.4 | 2024-05-24 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘block_id’ parameter in versions up to, and… |
CVE-2024-5060 | Medium | 6.4 | 2024-05-24 | The LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to… |
CVE-2024-4485 | Medium | 6.4 | 2024-05-24 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-4484 | Medium | 6.4 | 2024-05-24 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-1376 | Medium | 4.3 | 2024-05-24 | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all… |
CVE-2024-1332 | Medium | 6.4 | 2024-05-24 | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and inc… |
CVE-2024-0893 | Medium | 4.3 | 2024-05-24 | The Schema App Structured Data plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the MarkupUpdate fu… |
CVE-2024-5142 | Medium | 5.4 | 2024-05-24 | Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other use… |
CVE-2024-3718 | Medium | 6.4 | 2024-05-24 | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets all versions up to, and… |
CVE-2024-36361 | Medium | 6.8 | 2024-05-24 | Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or co… |
CVE-2024-1134 | Medium | 6.4 | 2024-05-24 | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and description parameters as well as others in… |
CVE-2024-0867 | High | 8.1 | 2024-05-24 | The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. Th… |
CVE-2024-3557 | Medium | 6.4 | 2024-05-24 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpgmza shortcode in all versions up… |
CVE-2024-2784 | Medium | 6.4 | 2024-05-24 | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Hover Card widget in all versions up to, and includ… |
CVE-2024-2618 | Medium | 6.4 | 2024-05-24 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versions up to, and inclu… |
CVE-2024-4544 | Critical | 9.8 | 2024-05-24 | The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due… |
CVE-2024-5205 | Medium | 6.4 | 2024-05-24 | The Videojs HTML5 Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videojs_video shortcode in all versions up to, and… |
CVE-2024-4409 | Medium | 4.3 | 2024-05-24 | The WP-ViperGB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrec… |
CVE-2024-5279 | Low | 3.5 | 2024-05-23 | A vulnerability was found in Qiwen Netdisk up to 1.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-5299 | High | 8.8 | 2024-05-23 | D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2024-5298 | High | 8.8 | 2024-05-23 | D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2024-5297 | High | 8.8 | 2024-05-23 | D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2024-5296 | Critical | 9.8 | 2024-05-23 | D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on a… |
CVE-2024-5295 | High | 8.8 | 2024-05-23 | D-Link G416 flupl self Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on… |
CVE-2024-5294 | Medium | 6.5 | 2024-05-23 | D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a deni… |
CVE-2024-5293 | High | 8.8 | 2024-05-23 | D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute a… |
CVE-2024-5292 | High | 7.8 | 2024-05-23 | D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privi… |
CVE-2024-5291 | High | 8.8 | 2024-05-23 | D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute… |
CVE-2024-5247 | High | 8.8 | 2024-05-23 | NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attacker… |
CVE-2024-5246 | High | 8.8 | 2024-05-23 | NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2024-5245 | High | 7.8 | 2024-05-23 | NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate p… |
CVE-2024-5244 | Medium | 4.2 | 2024-05-23 | TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability. This vulnerability allows network-adjacent attackers to access or spoof DDNS messages… |
CVE-2024-5243 | High | 7.5 | 2024-05-23 | TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affe… |
CVE-2024-5242 | High | 7.5 | 2024-05-23 | TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary… |
CVE-2024-5228 | High | 7.5 | 2024-05-23 | TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent a… |
CVE-2024-5227 | High | 7.5 | 2024-05-23 | TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute ar… |
CVE-2024-5202 | High | 7.7 | 2024-05-23 | Arbitrary File Read in OpenText Dimensions RM allows authenticated users to read files stored on the server via webservices |
CVE-2024-5201 | High | 8.8 | 2024-05-23 | Privilege Escalation in OpenText Dimensions RM allows an authenticated user to escalate there privilege to the privilege of another user via HTTP Request |
CVE-2024-35570 | Critical | 9.8 | 2024-05-23 | An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via… |
CVE-2024-35375 | Critical | 9.8 | 2024-05-23 | There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS |
CVE-2024-35080 | Critical | 9.8 | 2024-05-23 | An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file. |
CVE-2024-35079 | Critical | 9.8 | 2024-05-23 | An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file. |
CVE-2024-31843 | Medium | 4.1 | 2024-05-23 | An issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are processed on the ser… |
CVE-2024-5143 | Medium | 6.8 | 2024-05-23 | A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server credentials. By re… |
CVE-2024-4365 | Medium | 6.4 | 2024-05-23 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘add_iframe_url_as_param_direct’ parameter in versions up to, and… |
CVE-2024-35091 | Critical | 9.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml. |
CVE-2024-35090 | High | 8.2 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml. |
CVE-2024-35086 | Critical | 9.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml . |
CVE-2024-35085 | Medium | 5.4 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml. |
CVE-2024-35084 | Critical | 9.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml. |
CVE-2024-35083 | High | 8.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml. |
CVE-2024-35082 | Medium | 6.3 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml. |
CVE-2024-35081 | High | 7.5 | 2024-05-23 | LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter in the fileDownload method. |
CVE-2024-34936 | High | 8.6 | 2024-05-23 | A SQL injection vulnerability in /view/event1.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL comm… |