2024 CVEs (page 279)
Page 279 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-31281 | Medium | 6.3 | 2024-05-17 | Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.6. |
CVE-2024-31237 | High | 7.5 | 2024-05-17 | Improper Privilege Management vulnerability in WP Sharks s2Member Pro allows Privilege Escalation.This issue affects s2Member Pro: from n/a through 240315. |
CVE-2024-31232 | High | 8.0 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sizam Design Rehub allows PHP Local File Inclusion.This issue a… |
CVE-2024-31231 | Critical | 9.0 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sizam Design Rehub allows PHP Local File Inclusion.This issue a… |
CVE-2024-30542 | Critical | 9.8 | 2024-05-17 | Improper Privilege Management vulnerability in Wholesale WholesaleX allows Privilege Escalation.This issue affects WholesaleX: from n/a through 1.3.2. |
CVE-2024-30540 | Medium | 5.3 | 2024-05-17 | Guessable CAPTCHA vulnerability in Guido VS Contact Form allows Functionality Bypass.This issue affects VS Contact Form: from n/a through 14.7. |
CVE-2024-30527 | High | 7.5 | 2024-05-17 | Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments) allows Manipulating Hidden… |
CVE-2024-30522 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in Stefano Lissa & The Newsletter Team Newsletter allows Functionality Bypass.This issue affects Newsletter: fr… |
CVE-2024-30509 | Medium | 6.5 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Artbees SellKit allows Relative Path Traversal.This issue affec… |
CVE-2024-30480 | Low | 3.7 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in Pippin Williamson CGC Maintenance Mode allows Functionality Bypass.This issue affects CGC Maintenance Mode… |
CVE-2024-30479 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in LionScripts IP Blocker Lite allows Functionality Bypass.This issue affects IP Blocker Lite: from n/a through… |
CVE-2024-27971 | High | 8.3 | 2024-05-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Permalink Manager… |
CVE-2024-27955 | High | 8.8 | 2024-05-17 | Cross-Site Request Forgery (CSRF) vulnerability in WP Automatic Automatic allows Privilege Escalation.This issue affects Automatic: from n/a through 3.92.0. |
CVE-2024-27954 | Critical | 9.3 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Reque… |
CVE-2024-25906 | Medium | 4.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in WP Happy Coders Comments Like Dislike allows Functionality Bypass.This issue affects Comments Like Dislike… |
CVE-2024-25595 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a throug… |
CVE-2024-24934 | High | 8.5 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Elementor Elementor Website Builder allows Manipulating Web Inp… |
CVE-2024-24882 | Critical | 9.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1… |
CVE-2024-24874 | Medium | 5.3 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CodePeople CP Polls allows Code Injection.This issue affects CP… |
CVE-2024-24873 | Medium | 5.3 | 2024-05-17 | : Improper Control of Interaction Frequency vulnerability in CodePeople CP Polls allows Flooding.This issue affects CP Polls: from n/a through 1.0.71. |
CVE-2024-24869 | High | 7.5 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BoldGrid Total Upkeep allows Relative Path Traversal.This issue… |
CVE-2024-24715 | Medium | 6.5 | 2024-05-17 | Improper Validation of Specified Quantity in Input vulnerability in The Events Calendar BookIt allows Manipulating Hidden Fields.This issue affects BookIt: fro… |
CVE-2024-23522 | Medium | 5.3 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Inject… |
CVE-2024-22157 | Critical | 9.8 | 2024-05-17 | Improper Privilege Management vulnerability in WebWizards SalesKing allows Privilege Escalation.This issue affects SalesKing: from n/a through 1.6.15. |
CVE-2024-22145 | High | 8.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8. |
CVE-2024-22139 | Low | 3.7 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in Filipe Seabra WordPress Manutenção allows Functionality Bypass.This issue affects WordPress Manutenção: from… |
CVE-2024-21746 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing.This issue affects Wp Ultimate Review… |
CVE-2024-35110 | Medium | 5.5 | 2024-05-17 | A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users access a… |
CVE-2024-33556 | High | 8.2 | 2024-05-17 | Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8. |
CVE-2024-31351 | Critical | 10.0 | 2024-05-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content… |
CVE-2024-3580 | Medium | 6.1 | 2024-05-17 | The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perf… |
CVE-2024-3231 | Medium | 6.1 | 2024-05-17 | The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scri… |
CVE-2024-34757 | Medium | 6.5 | 2024-05-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visualmodo Borderless borderless allows DOM-Based XSS.Thi… |
CVE-2024-34752 | High | 7.1 | 2024-05-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PluginOps Landing Page Builder allows Reflected XS… |
CVE-2024-34575 | Medium | 6.5 | 2024-05-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS… |
CVE-2024-34567 | Medium | 6.5 | 2024-05-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GhozyLab, Inc. Popup Builder allows Stored XSS.Thi… |
CVE-2024-32800 | Medium | 6.5 | 2024-05-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Felix Moira Popup More Popups allows Stored XSS.Th… |
CVE-2024-2744 | Medium | 4.3 | 2024-05-17 | The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-2697 | Medium | 6.5 | 2024-05-17 | The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the pa… |
CVE-2024-3551 | Critical | 9.8 | 2024-05-17 | The Penci Soledad Data Migrator plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.0 via the 'data' parameter… |
CVE-2024-30060 | High | 7.8 | 2024-05-16 | Azure Monitor Agent Elevation of Privilege Vulnerability |
CVE-2024-3134 | Medium | 6.4 | 2024-05-16 | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-4204 | Medium | 4.3 | 2024-05-16 | The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due… |
CVE-2024-3609 | Medium | 4.3 | 2024-05-16 | The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability c… |
CVE-2024-2619 | Medium | 5.0 | 2024-05-16 | The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sani… |
CVE-2024-24981 | High | 7.5 | 2024-05-16 | Improper input validation in PfrSmiUpdateFw driver in UEFI firmware for some Intel(R) Server M50FCP Family products may allow a privileged user to enable escal… |
CVE-2024-23980 | High | 7.5 | 2024-05-16 | Improper buffer restrictions in PlatformPfrDxe driver in UEFI firmware for some Intel(R) Server D50FCP Family products may allow a privileged user to enable es… |
CVE-2024-23487 | High | 7.5 | 2024-05-16 | Improper input validation in UserAuthenticationSmm driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enabl… |
CVE-2024-22476 | Critical | 10.0 | 2024-05-16 | Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation o… |
CVE-2024-22390 | Medium | 4.4 | 2024-05-16 | Improper input validation in firmware for some Intel(R) FPGA products before version 2.9.1 may allow denial of service. |
CVE-2024-22384 | Low | 2.8 | 2024-05-16 | Out-of-bounds read for some Intel(R) Trace Analyzer and Collector software before version 2022.0.0 published Nov 2023 may allow an authenticated user to potent… |
CVE-2024-22382 | High | 7.5 | 2024-05-16 | Improper input validation in PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escala… |
CVE-2024-22379 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) Inspector software before version 2024.0 may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2024-22095 | High | 7.2 | 2024-05-16 | Improper input validation in PlatformVariableInitDxe driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to ena… |
CVE-2024-22015 | Medium | 6.5 | 2024-05-16 | Improper input validation for some Intel(R) DLB driver software before version 8.5.0 may allow an authenticated user to potentially denial of service via local… |
CVE-2024-21864 | High | 7.8 | 2024-05-16 | Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially e… |
CVE-2024-21862 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) Quartus(R) Prime Standard Edition Design software before version 23.1 may allow an authenticated user to potentially… |
CVE-2024-21861 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.4 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2024-21843 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path for some Intel(R) Computing Improvement Program software before version 2.4.0.10654 may allow an authenticated user to potentially ena… |
CVE-2024-21841 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path for some Intel(R) Distribution for GDB software before version 2024.0 may allow an authenticated user to potentially enable escalation… |
CVE-2024-21837 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated user to potentially enab… |
CVE-2024-21835 | Medium | 6.7 | 2024-05-16 | Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow an authenticated user to potentially enable escalation of privi… |
CVE-2024-21831 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) Processor Diagnostic Tool software before version 4.1.9.41 may allow an authenticated user to potentially enable esca… |
CVE-2024-21828 | Medium | 6.7 | 2024-05-16 | Improper access control in some Intel(R) Ethernet Controller Administrative Tools software before version 28.3 may allow an authenticated user to potentially e… |
CVE-2024-21823 | High | 7.5 | 2024-05-16 | Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an author… |
CVE-2024-21818 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) PCM software before version 202311 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2024-21814 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path for some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalat… |
CVE-2024-21813 | High | 7.9 | 2024-05-16 | Exposure of resource to wrong sphere in some Intel(R) DTT software installers may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2024-21809 | Medium | 6.7 | 2024-05-16 | Improper conditions check for some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated user to potentially en… |
CVE-2024-21792 | Medium | 4.7 | 2024-05-16 | Time-of-check Time-of-use race condition in Intel(R) Neural Compressor software before version 2.5.0 may allow an authenticated user to potentially enable info… |
CVE-2024-21788 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) GPA software before version 2023.4 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2024-21777 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro Edition Design software before version 23.4 may allow an authenticated user to potentially enabl… |
CVE-2024-21774 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) Processor Identification Utility software before versions 6.10.34.1129, 7.1.6 may allow an authenticated user to pote… |
CVE-2024-21772 | Medium | 6.7 | 2024-05-16 | Uncontrolled search path in some Intel(R) Advisor software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2024-4733 | High | 7.5 | 2024-05-16 | The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the `hc3_session`-cookie… |
CVE-2024-31226 | Medium | 4.9 | 2024-05-16 | Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when te… |
CVE-2024-5023 | | 2024-05-16 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affe… | |
CVE-2024-3286 | High | 7.5 | 2024-05-16 | A buffer overflow vulnerability was identified in some Lenovo printers that could allow an unauthenticated user to trigger a device restart by sending a speci… |
CVE-2024-1417 | High | 7.8 | 2024-05-16 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in WatchGuard AuthPoint Password Manager on MacOS allows an a… |
CVE-2024-27260 | High | 8.4 | 2024-05-16 | IBM AIX could 7.2, 7.3, VIOS 3.1, and VIOS 4.1 allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary comman… |
CVE-2024-4956 | High | 7.5 | 2024-05-16 | Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1. |
CVE-2024-4609 | Critical | 9.8 | 2024-05-16 | A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if… |
CVE-2024-4603 | Medium | 5.3 | 2024-05-16 | Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() o… |
CVE-2024-3640 | | 2024-05-16 | An unquoted executable path exists in the Rockwell Automation FactoryTalk® Remote Access™ possibly resulting in remote code execution if exploited. While runni… | |
CVE-2024-35187 | Critical | 9.1 | 2024-05-16 | Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user (includin… |
CVE-2024-35185 | Medium | 5.3 | 2024-05-16 | Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service attack via an attac… |
CVE-2024-35176 | Medium | 5.3 | 2024-05-16 | REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute va… |
CVE-2024-34808 | Medium | 4.3 | 2024-05-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: f… |
CVE-2024-34805 | Medium | 6.5 | 2024-05-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webvitaly iFrame allows Stored XSS.This issue affe… |
CVE-2024-34760 | Medium | 6.5 | 2024-05-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPBlockart Magazine Blocks allows Stored XSS.This… |
CVE-2024-34751 | Medium | 4.4 | 2024-05-16 | Deserialization of Untrusted Data vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for Woo… |
CVE-2024-34273 | Medium | 5.9 | 2024-05-16 | njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method. |
CVE-2024-35039 | Low | 3.8 | 2024-05-16 | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/tplSys_deal.php?mudi=area. |
CVE-2024-34958 | Medium | 6.5 | 2024-05-16 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/banner_deal.php?mudi=add |
CVE-2024-34957 | Medium | 5.4 | 2024-05-16 | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/sysImages_deal.php?mudi=infoSet. |
CVE-2024-34905 | High | 7.5 | 2024-05-16 | FlyFish v3.0.0 was discovered to contain a buffer overflow via the password parameter on the login page. This vulnerability allows attackers to cause a Denial… |
CVE-2024-34582 | Medium | 6.1 | 2024-05-16 | Sunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi userid_change XSS within the Forgot Password feature. |
CVE-2024-31142 | High | 7.5 | 2024-05-16 | Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Retu… |
CVE-2024-20389 | High | 7.8 | 2024-05-16 | A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to rea… |
CVE-2024-20326 | High | 7.8 | 2024-05-16 | A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to rea… |