2024 CVEs (page 273)
Page 273 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4783 | Medium | 6.4 | 2024-05-23 | The jQuery T(-) Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all versions up to, and… |
CVE-2024-4486 | Medium | 6.4 | 2024-05-23 | The Awesome Contact Form7 for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'AEP Contact Form 7' widget in all versions u… |
CVE-2024-3201 | Medium | 6.4 | 2024-05-23 | The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pp_link' shortcode in all versions up to, and inc… |
CVE-2024-3065 | Medium | 4.4 | 2024-05-23 | The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ve… |
CVE-2024-1855 | Medium | 5.3 | 2024-05-23 | The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side Reques… |
CVE-2024-29853 | High | 7.8 | 2024-05-22 | An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation. |
CVE-2024-29852 | Low | 2.7 | 2024-05-22 | Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs. |
CVE-2024-29851 | High | 7.2 | 2024-05-22 | Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account. |
CVE-2024-29850 | High | 8.8 | 2024-05-22 | Veeam Backup Enterprise Manager allows account takeover via NTLM relay. |
CVE-2024-29849 | Critical | 9.8 | 2024-05-22 | Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. |
CVE-2024-22026 | Medium | 6.7 | 2024-05-22 | A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary command… |
CVE-2024-4454 | High | 7.8 | 2024-05-22 | WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileg… |
CVE-2024-4453 | High | 7.8 | 2024-05-22 | GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2024-4267 | Critical | 9.8 | 2024-05-22 | A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5. The vulnerability ari… |
CVE-2024-31895 | Medium | 4.3 | 2024-05-22 | IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IB… |
CVE-2024-31894 | Medium | 4.3 | 2024-05-22 | IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IB… |
CVE-2024-27264 | High | 7.4 | 2024-05-22 | IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor… |
CVE-2024-35627 | Medium | 6.1 | 2024-05-22 | tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key. |
CVE-2024-31904 | Medium | 6.5 | 2024-05-22 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 integration nodes could allow an authenticated user to cause a denial of s… |
CVE-2024-31893 | Medium | 4.3 | 2024-05-22 | IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive calendar information using an expired access token… |
CVE-2024-25738 | Critical | 9.1 | 2024-05-22 | A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remo… |
CVE-2024-25737 | Medium | 5.4 | 2024-05-22 | A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9… |
CVE-2024-31617 | Medium | 5.3 | 2024-05-22 | OpenLiteSpeed before 1.8.1 mishandles chunked encoding. |
CVE-2024-29421 | Medium | 6.2 | 2024-05-22 | xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary code. |
CVE-2024-21791 | Medium | 4.7 | 2024-05-22 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability. |
CVE-2024-20360 | High | 8.8 | 2024-05-22 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to cond… |
CVE-2024-5166 | Medium | 6.5 | 2024-05-22 | An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model. |
CVE-2024-4563 | Medium | 6.1 | 2024-05-22 | The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length. |
CVE-2024-36077 | High | 8.8 | 2024-05-22 | Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation. The attacker can elevate thei… |
CVE-2024-20363 | Medium | 5.8 | 2024-05-22 | Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote… |
CVE-2024-20361 | Medium | 5.8 | 2024-05-22 | A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated… |
CVE-2024-20355 | Medium | 5.0 | 2024-05-22 | A vulnerability in the implementation of SAML 2.0 single sign-on (SSO) for remote access VPN services in Cisco Adaptive Security Appliance (ASA) Software and C… |
CVE-2024-20293 | Medium | 5.8 | 2024-05-22 | A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD)… |
CVE-2024-20261 | Medium | 5.8 | 2024-05-22 | A vulnerability in the file policy feature that is used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software could allow an unau… |
CVE-2024-5160 | High | 8.8 | 2024-05-22 | Heap buffer overflow in Dawn in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page… |
CVE-2024-5159 | High | 8.8 | 2024-05-22 | Heap buffer overflow in ANGLE in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2024-5158 | High | 8.1 | 2024-05-22 | Type Confusion in V8 in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to potentially perform arbitrary read/write via a crafted HTML page. (Ch… |
CVE-2024-5157 | High | 8.8 | 2024-05-22 | Use after free in Scheduling in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2024-35362 | Medium | 5.4 | 2024-05-22 | Ecshop 3.6 is vulnerable to Cross Site Scripting (XSS) via ecshop/article_cat.php. |
CVE-2024-34448 | High | 8.8 | 2024-05-22 | Ghost before 5.82.0 allows CSV Injection during a member CSV export. |
CVE-2024-33228 | High | 8.4 | 2024-05-22 | An issue in the component segwindrvx64.sys of Insyde Software Corp SEG Windows Driver v100.00.07.02 allows attackers to escalate privileges and execute arbitra… |
CVE-2024-33227 | High | 8.8 | 2024-05-22 | An issue in the component ddcdrv.sys of Nicomsoft WinI2C/DDC v3.7.4.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IO… |
CVE-2024-33226 | Critical | 9.9 | 2024-05-22 | An issue in the component Access64.sys of Wistron Corporation TBT Force Power Control v1.0.0.0 allows attackers to escalate privileges and execute arbitrary co… |
CVE-2024-33225 | High | 7.8 | 2024-05-22 | An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows attackers to escalate… |
CVE-2024-33224 | High | 8.4 | 2024-05-22 | An issue in the component rtkio64.sys of Realtek Semiconductor Corp Realtek lO Driver v1.008.0823.2017 allows attackers to escalate privileges and execute arbi… |
CVE-2024-33223 | High | 8.8 | 2024-05-22 | An issue in the component IOMap64.sys of ASUSTeK Computer Inc ASUS GPU TweakII v1.4.5.2 allows attackers to escalate privileges and execute arbitrary code via… |
CVE-2024-33222 | High | 8.4 | 2024-05-22 | An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execute arbitrary code v… |
CVE-2024-29392 | Medium | 5.4 | 2024-05-22 | Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController. |
CVE-2024-3926 | Medium | 6.4 | 2024-05-22 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-33221 | High | 7.8 | 2024-05-22 | An issue in the component AsusBSItf.sys of ASUSTeK Computer Inc ASUS BIOS Flash Driver v3.2.12.0 allows attackers to escalate privileges and execute arbitrary… |
CVE-2024-33220 | High | 8.8 | 2024-05-22 | An issue in the component AslO3_64.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and execute arbitrary code via… |
CVE-2024-33219 | High | 7.8 | 2024-05-22 | An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and execute arbitrary… |
CVE-2024-33218 | High | 7.8 | 2024-05-22 | An issue in the component AsUpIO64.sys of ASUSTeK Computer Inc ASUS USB 3.0 Boost Storage Driver 5.30.20.0 allows attackers to escalate privileges and execute… |
CVE-2024-35561 | Medium | 5.4 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=add&nohrefStr=close. |
CVE-2024-35560 | Medium | 4.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=del&dataType=&dataTypeCN. |
CVE-2024-35559 | High | 8.8 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-35558 | High | 8.8 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-35557 | Medium | 5.5 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApi_deal.php?mudi=rev&nohrefStr=close. |
CVE-2024-35556 | High | 8.8 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsSys_deal.php?mudi=infoSet. |
CVE-2024-35555 | Medium | 6.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=newsWeb&fieldName=sta… |
CVE-2024-35554 | Medium | 5.4 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=del&dataType=newsWeb&dataTypeCN. |
CVE-2024-35553 | High | 8.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=add&nohrefStr=close. |
CVE-2024-35552 | High | 8.8 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=del&dataType=logo&dataTypeCN. |
CVE-2024-35551 | Medium | 4.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=add. |
CVE-2024-35550 | Medium | 6.3 | 2024-05-22 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=rev. |
CVE-2024-35475 | Medium | 6.4 | 2024-05-22 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/Da… |
CVE-2024-35409 | Critical | 9.8 | 2024-05-22 | WeBid 1.1.2 is vulnerable to SQL Injection via admin/tax.php. |
CVE-2024-4261 | Medium | 5.4 | 2024-05-22 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-5196 | Medium | 4.7 | 2024-05-22 | A vulnerability classified as critical has been found in Arris VAP2500 08.50. This affects an unknown part of the file /tools_command.php. The manipulation of… |
CVE-2024-36010 | Medium | 5.5 | 2024-05-22 | In the Linux kernel, the following vulnerability has been resolved: igb: Fix string truncation warnings in igb_set_fw_version Commit 1978d3ead82c ("intel: fi… |
CVE-2024-5195 | Medium | 4.7 | 2024-05-22 | A vulnerability was found in Arris VAP2500 08.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file /diag_s.php… |
CVE-2024-5194 | Medium | 4.7 | 2024-05-22 | A vulnerability was found in Arris VAP2500 08.50. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ass… |
CVE-2024-5193 | Medium | 5.3 | 2024-05-22 | A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipu… |
CVE-2024-4262 | Medium | 6.4 | 2024-05-22 | The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2… |
CVE-2024-5031 | High | 8.5 | 2024-05-22 | The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file'… |
CVE-2024-5025 | Medium | 6.4 | 2024-05-22 | The Memberpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arglist’ parameter in all versions up to, and including, 1.11.29 due… |
CVE-2024-4896 | Medium | 6.4 | 2024-05-22 | The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.0.9… |
CVE-2024-4362 | Medium | 6.4 | 2024-05-22 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortcode in all versions… |
CVE-2024-3495 | Critical | 9.8 | 2024-05-22 | The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2… |
CVE-2024-2036 | Medium | 4.3 | 2024-05-22 | The ApplyOnline – Application Form Builder and Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-5147 | Critical | 9.8 | 2024-05-22 | The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 vi… |
CVE-2024-4157 | High | 7.5 | 2024-05-22 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all ver… |
CVE-2024-3671 | Medium | 6.4 | 2024-05-22 | The Print-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'print-me' shortcode in all versions up to, and including… |
CVE-2024-3666 | Medium | 6.4 | 2024-05-22 | The Opal Estate Pro – Property Management and Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the agent latitude and longitude… |
CVE-2024-32988 | High | 7.5 | 2024-05-22 | 'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. Secret key for JWT… |
CVE-2024-2953 | Medium | 5.5 | 2024-05-22 | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.1.4… |
CVE-2024-2163 | Medium | 6.4 | 2024-05-22 | The Ninja Beaver Add-ons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, a… |
CVE-2024-2119 | Medium | 6.1 | 2024-05-22 | The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions up to, and including… |
CVE-2024-0632 | Medium | 4.4 | 2024-05-22 | The Automatic Translator with Google Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom font setting in all versions up… |
CVE-2024-3927 | Medium | 5.3 | 2024-05-22 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submissi… |
CVE-2024-3663 | Medium | 4.3 | 2024-05-22 | The WP Scraper plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_scraper_multi_scrape_action() function in… |
CVE-2024-3198 | Medium | 6.4 | 2024-05-22 | The WP Font Awesome Share Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpfai_social' shortcode in all versions u… |
CVE-2024-2088 | High | 8.5 | 2024-05-22 | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.3 v… |
CVE-2024-1762 | Medium | 6.1 | 2024-05-22 | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP_USER_AGENT header in all versions u… |
CVE-2024-1446 | Medium | 5.4 | 2024-05-22 | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.3. This… |
CVE-2024-5092 | Medium | 6.4 | 2024-05-22 | The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Switcher, Slider, and Iconbox widgets in al… |
CVE-2024-4971 | Medium | 6.4 | 2024-05-22 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and in… |
CVE-2024-4443 | Critical | 9.8 | 2024-05-22 | The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ p… |
CVE-2024-3611 | Medium | 6.4 | 2024-05-22 | The Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tbex… |
CVE-2024-3066 | Medium | 6.4 | 2024-05-22 | The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and includin… |