2024 CVEs (page 273)
Page 273 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4563 | Medium | 6.1 | 2024-05-22 | The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length. |
CVE-2024-36077 | High | 8.8 | 2024-05-22 | Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation. The attacker can elevate thei… |
CVE-2024-20363 | Medium | 5.8 | 2024-05-22 | Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote… |
CVE-2024-20361 | Medium | 5.8 | 2024-05-22 | A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated… |
CVE-2024-20355 | Medium | 5.0 | 2024-05-22 | A vulnerability in the implementation of SAML 2.0 single sign-on (SSO) for remote access VPN services in Cisco Adaptive Security Appliance (ASA) Software and C… |
CVE-2024-20293 | Medium | 5.8 | 2024-05-22 | A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD)… |
CVE-2024-20261 | Medium | 5.8 | 2024-05-22 | A vulnerability in the file policy feature that is used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software could allow an unau… |
CVE-2024-5160 | High | 8.8 | 2024-05-22 | Heap buffer overflow in Dawn in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page… |
CVE-2024-5159 | High | 8.8 | 2024-05-22 | Heap buffer overflow in ANGLE in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2024-5158 | High | 8.1 | 2024-05-22 | Type Confusion in V8 in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to potentially perform arbitrary read/write via a crafted HTML page. (Ch… |
CVE-2024-5157 | High | 8.8 | 2024-05-22 | Use after free in Scheduling in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2024-35362 | Medium | 5.4 | 2024-05-22 | Ecshop 3.6 is vulnerable to Cross Site Scripting (XSS) via ecshop/article_cat.php. |
CVE-2024-34448 | High | 8.8 | 2024-05-22 | Ghost before 5.82.0 allows CSV Injection during a member CSV export. |
CVE-2024-33228 | High | 8.4 | 2024-05-22 | An issue in the component segwindrvx64.sys of Insyde Software Corp SEG Windows Driver v100.00.07.02 allows attackers to escalate privileges and execute arbitra… |
CVE-2024-33227 | High | 8.8 | 2024-05-22 | An issue in the component ddcdrv.sys of Nicomsoft WinI2C/DDC v3.7.4.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IO… |
CVE-2024-33226 | Critical | 9.9 | 2024-05-22 | An issue in the component Access64.sys of Wistron Corporation TBT Force Power Control v1.0.0.0 allows attackers to escalate privileges and execute arbitrary co… |
CVE-2024-33225 | High | 7.8 | 2024-05-22 | An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows attackers to escalate… |
CVE-2024-33224 | High | 8.4 | 2024-05-22 | An issue in the component rtkio64.sys of Realtek Semiconductor Corp Realtek lO Driver v1.008.0823.2017 allows attackers to escalate privileges and execute arbi… |
CVE-2024-33223 | High | 8.8 | 2024-05-22 | An issue in the component IOMap64.sys of ASUSTeK Computer Inc ASUS GPU TweakII v1.4.5.2 allows attackers to escalate privileges and execute arbitrary code via… |
CVE-2024-33222 | High | 8.4 | 2024-05-22 | An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execute arbitrary code v… |
CVE-2024-29392 | Medium | 5.4 | 2024-05-22 | Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController. |
CVE-2024-3926 | Medium | 6.4 | 2024-05-22 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-33221 | High | 7.8 | 2024-05-22 | An issue in the component AsusBSItf.sys of ASUSTeK Computer Inc ASUS BIOS Flash Driver v3.2.12.0 allows attackers to escalate privileges and execute arbitrary… |
CVE-2024-33220 | High | 8.8 | 2024-05-22 | An issue in the component AslO3_64.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and execute arbitrary code via… |
CVE-2024-33219 | High | 7.8 | 2024-05-22 | An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and execute arbitrary… |
CVE-2024-33218 | High | 7.8 | 2024-05-22 | An issue in the component AsUpIO64.sys of ASUSTeK Computer Inc ASUS USB 3.0 Boost Storage Driver 5.30.20.0 allows attackers to escalate privileges and execute… |
CVE-2024-35561 | Medium | 5.4 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=add&nohrefStr=close. |
CVE-2024-35560 | Medium | 4.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=del&dataType=&dataTypeCN. |
CVE-2024-35559 | High | 8.8 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-35558 | High | 8.8 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-35557 | Medium | 5.5 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApi_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-35556 | High | 8.8 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsSys_deal.php?mudi=infoSet. |
CVE-2024-35555 | Medium | 6.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=newsWeb&fieldName=sta… |
CVE-2024-35554 | Medium | 5.4 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=del&dataType=newsWeb&dataTypeCN. |
CVE-2024-35553 | High | 8.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=add&nohrefStr=close. |
CVE-2024-35552 | High | 8.8 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=del&dataType=logo&dataTypeCN. |
CVE-2024-35551 | Medium | 4.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=add. |
CVE-2024-35550 | Medium | 6.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=rev. |
CVE-2024-35475 | Medium | 6.4 | 2024-05-22 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/Da… |
CVE-2024-35409 | Critical | 9.8 | 2024-05-22 | WeBid 1.1.2 is vulnerable to SQL Injection via admin/tax.php. |
CVE-2024-4261 | Medium | 5.4 | 2024-05-22 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-5196 | Medium | 4.7 | 2024-05-22 | A vulnerability classified as critical has been found in Arris VAP2500 08.50. This affects an unknown part of the file /tools_command.php. The manipulation of… |
CVE-2024-36010 | Medium | 5.5 | 2024-05-22 | In the Linux kernel, the following vulnerability has been resolved: igb: Fix string truncation warnings in igb_set_fw_version Commit 1978d3ead82c ("intel: fi… |
CVE-2024-5195 | Medium | 4.7 | 2024-05-22 | A vulnerability was found in Arris VAP2500 08.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file /diag_s.php… |
CVE-2024-5194 | Medium | 4.7 | 2024-05-22 | A vulnerability was found in Arris VAP2500 08.50. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ass… |
CVE-2024-5193 | Medium | 5.3 | 2024-05-22 | A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipu… |
CVE-2024-4262 | Medium | 6.4 | 2024-05-22 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2… |
CVE-2024-5031 | High | 8.5 | 2024-05-22 | The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file'… |
CVE-2024-5025 | Medium | 6.4 | 2024-05-22 | The Memberpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arglist’ parameter in all versions up to, and including, 1.11.29 due… |
CVE-2024-4896 | Medium | 6.4 | 2024-05-22 | The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.0.9… |
CVE-2024-4362 | Medium | 6.4 | 2024-05-22 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortcode in all versions… |
CVE-2024-3495 | Critical | 9.8 | 2024-05-22 | The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2… |
CVE-2024-2036 | Medium | 4.3 | 2024-05-22 | The ApplyOnline – Application Form Builder and Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-5147 | Critical | 9.8 | 2024-05-22 | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 vi… |
CVE-2024-4157 | High | 7.5 | 2024-05-22 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all ver… |
CVE-2024-3671 | Medium | 6.4 | 2024-05-22 | The Print-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'print-me' shortcode in all versions up to, and including… |
CVE-2024-3666 | Medium | 6.4 | 2024-05-22 | The Opal Estate Pro – Property Management and Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the agent latitude and longitude… |
CVE-2024-32988 | High | 7.5 | 2024-05-22 | 'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. Secret key for JWT… |
CVE-2024-2953 | Medium | 5.5 | 2024-05-22 | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.1.4… |
CVE-2024-2163 | Medium | 6.4 | 2024-05-22 | The Ninja Beaver Add-ons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, a… |
CVE-2024-2119 | Medium | 6.1 | 2024-05-22 | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions up to, and including… |
CVE-2024-0632 | Medium | 4.4 | 2024-05-22 | The Automatic Translator with Google Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom font setting in all versions up… |
CVE-2024-3927 | Medium | 5.3 | 2024-05-22 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submissi… |
CVE-2024-3663 | Medium | 4.3 | 2024-05-22 | The WP Scraper plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_scraper_multi_scrape_action() function in… |
CVE-2024-3198 | Medium | 6.4 | 2024-05-22 | The WP Font Awesome Share Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpfai_social' shortcode in all versions u… |
CVE-2024-2088 | High | 8.5 | 2024-05-22 | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.3 v… |
CVE-2024-1762 | Medium | 6.1 | 2024-05-22 | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP_USER_AGENT header in all versions u… |
CVE-2024-1446 | Medium | 5.4 | 2024-05-22 | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.3. This… |
CVE-2024-5092 | Medium | 6.4 | 2024-05-22 | The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Switcher, Slider, and Iconbox widgets in al… |
CVE-2024-4971 | Medium | 6.4 | 2024-05-22 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and in… |
CVE-2024-4443 | Critical | 9.8 | 2024-05-22 | The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ p… |
CVE-2024-3611 | Medium | 6.4 | 2024-05-22 | The Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tbex… |
CVE-2024-3066 | Medium | 6.4 | 2024-05-22 | The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and includin… |
CVE-2024-35162 | Medium | 6.5 | 2024-05-22 | Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authent… |
CVE-2024-31340 | Medium | 4.8 | 2024-05-22 | TP-Link Tether versions prior to 4.5.13 and TP-Link Tapo versions prior to 3.3.6 do not properly validate certificates, which may allow a remote unauthenticate… |
CVE-2024-4980 | Medium | 6.4 | 2024-05-22 | The WPKoi Templates for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id', 'mixColor', 'backgroundColor', 'saveInCookies', a… |
CVE-2024-31396 | Medium | 6.6 | 2024-05-22 | Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vuln… |
CVE-2024-31395 | Medium | 6.1 | 2024-05-22 | Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11… |
CVE-2024-31394 | Medium | 6.5 | 2024-05-22 | Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x… |
CVE-2024-30420 | Medium | 4.4 | 2024-05-22 | Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver… |
CVE-2024-30419 | Medium | 5.4 | 2024-05-22 | Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11… |
CVE-2024-0453 | Medium | 5.0 | 2024-05-22 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_delete_callback fun… |
CVE-2024-0452 | Medium | 5.0 | 2024-05-22 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback fun… |
CVE-2024-0451 | Medium | 5.0 | 2024-05-22 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in… |
CVE-2024-3519 | Medium | 6.1 | 2024-05-22 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3… |
CVE-2024-3518 | High | 8.8 | 2024-05-22 | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to… |
CVE-2024-21683 | High | 8.8 | 2024-05-21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Executi… |
CVE-2024-5040 | High | 7.8 | 2024-05-21 | There are multiple ways in LCDS LAquis SCADA for an attacker to access locations outside of their own directory. |
CVE-2024-35220 | High | 7.4 | 2024-05-21 | @fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is… |
CVE-2024-34274 | Low | 3.9 | 2024-05-21 | OpenBD 20210306203917-6cbe797 is vulnerable to Deserialization of Untrusted Data. The cookies bdglobals and bdclient_spot of the OpenBD software uses serialize… |
CVE-2024-31756 | High | 7.8 | 2024-05-21 | An issue in MarvinTest Solutions Hardware Access Driver v.5.0.3.0 and before and fixed in v.5.0.4.0 allows a local attacker to escalate privileges via the Hw65… |
CVE-2024-35061 | High | 7.3 | 2024-05-21 | NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. Wh… |
CVE-2024-35060 | High | 7.5 | 2024-05-21 | An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file. |
CVE-2024-35059 | High | 7.5 | 2024-05-21 | An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands. |
CVE-2024-33525 | Medium | 4.3 | 2024-05-21 | A Stored Cross-site Scripting (XSS) vulnerability in the "Import of organizational units and title of organizational unit" feature in ILIAS 7.20 to 7.29 and IL… |
CVE-2024-31989 | Critical | 9.0 | 2024-05-21 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same… |
CVE-2024-25724 | High | 7.3 | 2024-05-21 | In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and Cl… |
CVE-2024-4154 | Medium | 6.5 | 2024-05-21 | In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to. Specific… |
CVE-2024-35058 | High | 7.5 | 2024-05-21 | An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string. |
CVE-2024-35057 | High | 7.5 | 2024-05-21 | An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet. |