2024 CVEs (page 272)
Page 272 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34935 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /view/conversation_history_admin.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execut… |
CVE-2024-34934 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /view/emarks_range_grade_update_form.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to ex… |
CVE-2024-34933 | Medium | 6.3 | 2024-05-23 | A SQL injection vulnerability in /model/update_grade.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary S… |
CVE-2024-34932 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /model/update_exam.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQ… |
CVE-2024-34931 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /model/update_subject.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary… |
CVE-2024-34930 | Medium | 5.3 | 2024-05-23 | A SQL injection vulnerability in /model/all_events1.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL c… |
CVE-2024-34929 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /view/find_friends.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQ… |
CVE-2024-34928 | High | 7.3 | 2024-05-23 | A SQL injection vulnerability in /model/update_subject_routing.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute a… |
CVE-2024-34927 | Critical | 9.8 | 2024-05-23 | A SQL injection vulnerability in /model/update_classroom.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitra… |
CVE-2024-2301 | High | 7.6 | 2024-05-23 | Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the device. |
CVE-2024-5085 | High | 8.1 | 2024-05-23 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserializa… |
CVE-2024-5084 | Critical | 9.8 | 2024-05-23 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_a… |
CVE-2024-35222 | Medium | 5.9 | 2024-05-23 | Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints with… |
CVE-2024-5168 | Critical | 9.8 | 2024-05-23 | Improper access control vulnerability in Prodys' Quantum Audio codec affecting versions 2.3.4t and below. This vulnerability could allow an unauthenticated use… |
CVE-2024-4471 | High | 8.0 | 2024-05-23 | The 140+ Widgets | Best Addons For Elementor – FREE for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.3.1 via deseriali… |
CVE-2024-35224 | High | 7.6 | 2024-05-23 | OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when… |
CVE-2024-35197 | Medium | 5.4 | 2024-05-23 | gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths tha… |
CVE-2024-1803 | Medium | 4.3 | 2024-05-23 | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress… |
CVE-2024-34060 | High | 8.8 | 2024-05-23 | IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The `iris-evtx-module` is a pipeline plugin of `iri… |
CVE-2024-28188 | Medium | 5.3 | 2024-05-23 | Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users… |
CVE-2024-26139 | High | 8.3 | 2024-05-23 | OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security… |
CVE-2024-5258 | Medium | 4.4 | 2024-05-23 | An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated att… |
CVE-2024-4575 | Medium | 6.4 | 2024-05-23 | The LayerSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ls_search_form shortcode in version 7.11.0 due to insufficie… |
CVE-2024-4378 | Medium | 6.4 | 2024-05-23 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's menu and shape widgets in all versions up t… |
CVE-2024-3997 | Medium | 6.4 | 2024-05-23 | The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-1947 | Medium | 4.3 | 2024-05-23 | A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17… |
CVE-2024-1815 | Medium | 6.4 | 2024-05-23 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Gallery block in all versions… |
CVE-2024-1814 | Medium | 6.4 | 2024-05-23 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial block in all versions u… |
CVE-2024-5165 | Medium | 6.5 | 2024-05-23 | In Eclipse Ditto versions 3.0.0 to 3.5.5, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-i… |
CVE-2024-4779 | High | 8.8 | 2024-05-23 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to SQL Injection via the ‘data[post_ids][0]’ paramete… |
CVE-2024-2861 | Medium | 6.4 | 2024-05-23 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including… |
CVE-2024-5264 | Medium | 5.9 | 2024-05-23 | Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis |
CVE-2024-35223 | Medium | 5.3 | 2024-05-23 | Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of t… |
CVE-2024-35186 | High | 8.8 | 2024-05-23 | gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A speci… |
CVE-2024-32969 | Low | 2.7 | 2024-05-23 | vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that… |
CVE-2024-30280 | High | 7.8 | 2024-05-23 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could res… |
CVE-2024-30279 | High | 7.8 | 2024-05-23 | Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code executi… |
CVE-2024-4706 | Medium | 6.4 | 2024-05-23 | The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode i… |
CVE-2024-5241 | Medium | 4.7 | 2024-05-23 | A vulnerability was found in Huashi Private Cloud CDN Live Streaming Acceleration Server up to 20240520. It has been classified as critical. Affected is an unk… |
CVE-2024-5240 | Medium | 6.3 | 2024-05-23 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This issue affects some unknown processing o… |
CVE-2024-4835 | High | 8.0 | 2024-05-23 | A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker… |
CVE-2024-4043 | Medium | 6.4 | 2024-05-23 | The WP Ultimate Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpupg-text' shortcode in all versions up to, and… |
CVE-2024-3648 | Medium | 6.4 | 2024-05-23 | The ShareThis Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sharethis-inline-button' shortcode in all versi… |
CVE-2024-36013 | High | 8.8 | 2024-05-23 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to… |
CVE-2024-36012 | High | 7.8 | 2024-05-23 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: fix slab-use-after-free in msft_do_close() Tying the msft->data lifetime… |
CVE-2024-36011 | Medium | 5.5 | 2024-05-23 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Fix potential null-ptr-deref Fix potential null-ptr-deref in hci_le_big_s… |
CVE-2024-2874 | Medium | 6.5 | 2024-05-23 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered w… |
CVE-2024-2038 | High | 7.5 | 2024-05-23 | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized access in all versions up to, and i… |
CVE-2024-5239 | Medium | 6.3 | 2024-05-23 | A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This vulnerability affects unknown code… |
CVE-2024-5238 | Medium | 6.3 | 2024-05-23 | A vulnerability, which was classified as critical, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the… |
CVE-2024-5237 | Medium | 6.3 | 2024-05-23 | A vulnerability, which was classified as critical, has been found in Campcodes Complete Web-Based School Management System 1.0. Affected by this issue is some… |
CVE-2024-5177 | Medium | 6.4 | 2024-05-23 | The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter within multiple widgets in all versions up to, and… |
CVE-2024-4399 | Critical | 9.1 | 2024-05-23 | The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack |
CVE-2024-4388 | High | 7.5 | 2024-05-23 | This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server |
CVE-2024-4347 | High | 7.2 | 2024-05-23 | The WP Fastest Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the specificDeleteCache function… |
CVE-2024-3920 | Low | 3.5 | 2024-05-23 | The Flattr WordPress plugin through 1.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-3918 | Medium | 4.8 | 2024-05-23 | The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users such as Contributor… |
CVE-2024-3917 | Medium | 6.1 | 2024-05-23 | The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-3711 | Medium | 4.3 | 2024-05-23 | The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized plugin setting update due to a missing capability check on the functions action_req… |
CVE-2024-3626 | Medium | 4.3 | 2024-05-23 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthori… |
CVE-2024-3594 | High | 8.7 | 2024-05-23 | The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-2220 | Low | 3.5 | 2024-05-23 | The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-5236 | Medium | 6.3 | 2024-05-23 | A vulnerability classified as critical was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerability is an unknown fun… |
CVE-2024-5235 | Medium | 6.3 | 2024-05-23 | A vulnerability classified as critical has been found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the file… |
CVE-2024-5234 | Medium | 6.3 | 2024-05-23 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. This issue affects some unknown processi… |
CVE-2024-5233 | Medium | 6.3 | 2024-05-23 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. This vulnerability affects unknown co… |
CVE-2024-4662 | High | 8.8 | 2024-05-23 | The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to th… |
CVE-2024-5232 | Medium | 6.3 | 2024-05-23 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2024-4431 | Medium | 6.4 | 2024-05-23 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and inc… |
CVE-2024-5231 | Medium | 6.3 | 2024-05-23 | A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. Affected by this issue is some unknown funct… |
CVE-2024-4895 | Medium | 4.7 | 2024-05-23 | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CSV imp… |
CVE-2024-5230 | Medium | 5.3 | 2024-05-23 | A vulnerability has been found in EnvaySoft FleetCart up to 4.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. Th… |
CVE-2024-4978 | High | 8.4 | 2024-05-23 | Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, priv… |
CVE-2024-4783 | Medium | 6.4 | 2024-05-23 | The jQuery T(-) Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all versions up to, and… |
CVE-2024-4486 | Medium | 6.4 | 2024-05-23 | The Awesome Contact Form7 for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'AEP Contact Form 7' widget in all versions u… |
CVE-2024-3201 | Medium | 6.4 | 2024-05-23 | The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pp_link' shortcode in all versions up to, and inc… |
CVE-2024-3065 | Medium | 4.4 | 2024-05-23 | The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ve… |
CVE-2024-1855 | Medium | 5.3 | 2024-05-23 | The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side Reques… |
CVE-2024-29853 | High | 7.8 | 2024-05-22 | An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation. |
CVE-2024-29852 | Low | 2.7 | 2024-05-22 | Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs. |
CVE-2024-29851 | High | 7.2 | 2024-05-22 | Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account. |
CVE-2024-29850 | High | 8.8 | 2024-05-22 | Veeam Backup Enterprise Manager allows account takeover via NTLM relay. |
CVE-2024-29849 | Critical | 9.8 | 2024-05-22 | Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. |
CVE-2024-22026 | Medium | 6.7 | 2024-05-22 | A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary command… |
CVE-2024-4454 | High | 7.8 | 2024-05-22 | WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileg… |
CVE-2024-4453 | High | 7.8 | 2024-05-22 | GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2024-4267 | Critical | 9.8 | 2024-05-22 | A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5. The vulnerability ari… |
CVE-2024-31895 | Medium | 4.3 | 2024-05-22 | IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IB… |
CVE-2024-31894 | Medium | 4.3 | 2024-05-22 | IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IB… |
CVE-2024-27264 | High | 7.4 | 2024-05-22 | IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor… |
CVE-2024-35627 | Medium | 6.1 | 2024-05-22 | tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key. |
CVE-2024-31904 | Medium | 6.5 | 2024-05-22 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 integration nodes could allow an authenticated user to cause a denial of s… |
CVE-2024-31893 | Medium | 4.3 | 2024-05-22 | IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive calendar information using an expired access token… |
CVE-2024-25738 | Critical | 9.1 | 2024-05-22 | A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remo… |
CVE-2024-25737 | Medium | 5.4 | 2024-05-22 | A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9… |
CVE-2024-31617 | Medium | 5.3 | 2024-05-22 | OpenLiteSpeed before 1.8.1 mishandles chunked encoding. |
CVE-2024-29421 | Medium | 6.2 | 2024-05-22 | xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary code. |
CVE-2024-21791 | Medium | 4.7 | 2024-05-22 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability. |
CVE-2024-20360 | High | 8.8 | 2024-05-22 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to cond… |
CVE-2024-5166 | Medium | 6.5 | 2024-05-22 | An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model. |