2024 CVEs (page 272)
Page 272 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5291 | High | 8.8 | 2024-05-23 | D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute… |
CVE-2024-5247 | High | 8.8 | 2024-05-23 | NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attacker… |
CVE-2024-5246 | High | 8.8 | 2024-05-23 | NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2024-5245 | High | 7.8 | 2024-05-23 | NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate p… |
CVE-2024-5244 | Medium | 4.2 | 2024-05-23 | TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability. This vulnerability allows network-adjacent attackers to access or spoof DDNS messages… |
CVE-2024-5243 | High | 7.5 | 2024-05-23 | TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affe… |
CVE-2024-5242 | High | 7.5 | 2024-05-23 | TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary… |
CVE-2024-5228 | High | 7.5 | 2024-05-23 | TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent a… |
CVE-2024-5227 | High | 7.5 | 2024-05-23 | TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute ar… |
CVE-2024-5202 | High | 7.7 | 2024-05-23 | Arbitrary File Read in OpenText Dimensions RM allows authenticated users to read files stored on the server via webservices |
CVE-2024-5201 | High | 8.8 | 2024-05-23 | Privilege Escalation in OpenText Dimensions RM allows an authenticated user to escalate there privilege to the privilege of another user via HTTP Request |
CVE-2024-35570 | Critical | 9.8 | 2024-05-23 | An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via… |
CVE-2024-35375 | Critical | 9.8 | 2024-05-23 | There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS |
CVE-2024-35080 | Critical | 9.8 | 2024-05-23 | An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file. |
CVE-2024-35079 | Critical | 9.8 | 2024-05-23 | An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file. |
CVE-2024-31843 | Medium | 4.1 | 2024-05-23 | An issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are processed on the ser… |
CVE-2024-5143 | Medium | 6.8 | 2024-05-23 | A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server credentials. By re… |
CVE-2024-4365 | Medium | 6.4 | 2024-05-23 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘add_iframe_url_as_param_direct’ parameter in versions up to, and… |
CVE-2024-35091 | Critical | 9.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml. |
CVE-2024-35090 | High | 8.2 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml. |
CVE-2024-35086 | Critical | 9.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml . |
CVE-2024-35085 | Medium | 5.4 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml. |
CVE-2024-35084 | Critical | 9.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml. |
CVE-2024-35083 | High | 8.8 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml. |
CVE-2024-35082 | Medium | 6.3 | 2024-05-23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml. |
CVE-2024-35081 | High | 7.5 | 2024-05-23 | LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter in the fileDownload method. |
CVE-2024-34936 | High | 8.6 | 2024-05-23 | A SQL injection vulnerability in /view/event1.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL comm… |
CVE-2024-34935 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /view/conversation_history_admin.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execut… |
CVE-2024-34934 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /view/emarks_range_grade_update_form.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to ex… |
CVE-2024-34933 | Medium | 6.3 | 2024-05-23 | A SQL injection vulnerability in /model/update_grade.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary S… |
CVE-2024-34932 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /model/update_exam.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQ… |
CVE-2024-34931 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /model/update_subject.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary… |
CVE-2024-34930 | Medium | 5.3 | 2024-05-23 | A SQL injection vulnerability in /model/all_events1.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL c… |
CVE-2024-34929 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /view/find_friends.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQ… |
CVE-2024-34928 | High | 7.3 | 2024-05-23 | A SQL injection vulnerability in /model/update_subject_routing.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute a… |
CVE-2024-34927 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /model/update_classroom.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitra… |
CVE-2024-2301 | High | 7.6 | 2024-05-23 | Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the device. |
CVE-2024-5085 | High | 8.1 | 2024-05-23 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserializa… |
CVE-2024-5084 | Critical | 9.8 | 2024-05-23 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_a… |
CVE-2024-35222 | Medium | 5.9 | 2024-05-23 | Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints with… |
CVE-2024-5168 | Critical | 9.8 | 2024-05-23 | Improper access control vulnerability in Prodys' Quantum Audio codec affecting versions 2.3.4t and below. This vulnerability could allow an unauthenticated use… |
CVE-2024-4471 | High | 8.0 | 2024-05-23 | The 140+ Widgets | Best Addons For Elementor – FREE for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.3.1 via deseriali… |
CVE-2024-35224 | High | 7.6 | 2024-05-23 | OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when… |
CVE-2024-35197 | Medium | 5.4 | 2024-05-23 | gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths tha… |
CVE-2024-1803 | Medium | 4.3 | 2024-05-23 | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress… |
CVE-2024-34060 | High | 8.8 | 2024-05-23 | IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The `iris-evtx-module` is a pipeline plugin of `iri… |
CVE-2024-28188 | Medium | 5.3 | 2024-05-23 | Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users… |
CVE-2024-26139 | High | 8.3 | 2024-05-23 | OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security… |
CVE-2024-5258 | Medium | 4.4 | 2024-05-23 | An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated att… |
CVE-2024-4575 | Medium | 6.4 | 2024-05-23 | The LayerSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ls_search_form shortcode in version 7.11.0 due to insufficie… |
CVE-2024-4378 | Medium | 6.4 | 2024-05-23 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's menu and shape widgets in all versions up t… |
CVE-2024-3997 | Medium | 6.4 | 2024-05-23 | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-1947 | Medium | 4.3 | 2024-05-23 | A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17… |
CVE-2024-1815 | Medium | 6.4 | 2024-05-23 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Gallery block in all versions… |
CVE-2024-1814 | Medium | 6.4 | 2024-05-23 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial block in all versions u… |
CVE-2024-5165 | Medium | 6.5 | 2024-05-23 | In Eclipse Ditto versions 3.0.0 to 3.5.5, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-i… |
CVE-2024-4779 | High | 8.8 | 2024-05-23 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injection via the ‘data[post_ids][0]’ paramete… |
CVE-2024-2861 | Medium | 6.4 | 2024-05-23 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including… |
CVE-2024-5264 | Medium | 5.9 | 2024-05-23 | Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis |
CVE-2024-35223 | Medium | 5.3 | 2024-05-23 | Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of t… |
CVE-2024-35186 | High | 8.8 | 2024-05-23 | gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A speci… |
CVE-2024-32969 | Low | 2.7 | 2024-05-23 | vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that… |
CVE-2024-30280 | High | 7.8 | 2024-05-23 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could res… |
CVE-2024-30279 | High | 7.8 | 2024-05-23 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code executi… |
CVE-2024-4706 | Medium | 6.4 | 2024-05-23 | The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode i… |
CVE-2024-5241 | Medium | 4.7 | 2024-05-23 | A vulnerability was found in Huashi Private Cloud CDN Live Streaming Acceleration Server up to 20240520. It has been classified as critical. Affected is an unk… |
CVE-2024-5240 | Medium | 6.3 | 2024-05-23 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This issue affects some unknown processing o… |
CVE-2024-4835 | High | 8.0 | 2024-05-23 | A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker… |
CVE-2024-4043 | Medium | 6.4 | 2024-05-23 | The WP Ultimate Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpupg-text' shortcode in all versions up to, and… |
CVE-2024-3648 | Medium | 6.4 | 2024-05-23 | The ShareThis Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sharethis-inline-button' shortcode in all versi… |
CVE-2024-36013 | High | 8.8 | 2024-05-23 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to… |
CVE-2024-36012 | High | 7.8 | 2024-05-23 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: fix slab-use-after-free in msft_do_close() Tying the msft->data lifetime… |
CVE-2024-36011 | Medium | 5.5 | 2024-05-23 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Fix potential null-ptr-deref Fix potential null-ptr-deref in hci_le_big_s… |
CVE-2024-2874 | Medium | 6.5 | 2024-05-23 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered w… |
CVE-2024-2038 | High | 7.5 | 2024-05-23 | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized access in all versions up to, and i… |
CVE-2024-5239 | Medium | 6.3 | 2024-05-23 | A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This vulnerability affects unknown code… |
CVE-2024-5238 | Medium | 6.3 | 2024-05-23 | A vulnerability, which was classified as critical, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the… |
CVE-2024-5237 | Medium | 6.3 | 2024-05-23 | A vulnerability, which was classified as critical, has been found in Campcodes Complete Web-Based School Management System 1.0. Affected by this issue is some… |
CVE-2024-5177 | Medium | 6.4 | 2024-05-23 | The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter within multiple widgets in all versions up to, and… |
CVE-2024-4399 | Critical | 9.1 | 2024-05-23 | The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack |
CVE-2024-4388 | High | 7.5 | 2024-05-23 | This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server |
CVE-2024-4347 | High | 7.2 | 2024-05-23 | The WP Fastest Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the specificDeleteCache function… |
CVE-2024-3920 | Low | 3.5 | 2024-05-23 | The Flattr WordPress plugin through 1.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-3918 | Medium | 4.8 | 2024-05-23 | The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users such as Contributor… |
CVE-2024-3917 | Medium | 6.1 | 2024-05-23 | The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-3711 | Medium | 4.3 | 2024-05-23 | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized plugin setting update due to a missing capability check on the functions action_req… |
CVE-2024-3626 | Medium | 4.3 | 2024-05-23 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthori… |
CVE-2024-3594 | High | 8.7 | 2024-05-23 | The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-2220 | Low | 3.5 | 2024-05-23 | The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-5236 | Medium | 6.3 | 2024-05-23 | A vulnerability classified as critical was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerability is an unknown fun… |
CVE-2024-5235 | Medium | 6.3 | 2024-05-23 | A vulnerability classified as critical has been found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the file… |
CVE-2024-5234 | Medium | 6.3 | 2024-05-23 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. This issue affects some unknown processi… |
CVE-2024-5233 | Medium | 6.3 | 2024-05-23 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. This vulnerability affects unknown co… |
CVE-2024-4662 | High | 8.8 | 2024-05-23 | The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to th… |
CVE-2024-5232 | Medium | 6.3 | 2024-05-23 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2024-4431 | Medium | 6.4 | 2024-05-23 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and inc… |
CVE-2024-5231 | Medium | 6.3 | 2024-05-23 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. Affected by this issue is some unknown funct… |
CVE-2024-4895 | Medium | 4.7 | 2024-05-23 | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CSV imp… |
CVE-2024-5230 | Medium | 5.3 | 2024-05-23 | A vulnerability has been found in EnvaySoft FleetCart up to 4.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. Th… |
CVE-2024-4978 | High | 8.4 | 2024-05-23 | Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, priv… |