2024 CVEs (page 28)
Page 28 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13571 | High | 7.1 | 2025-02-26 | The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-S… |
CVE-2024-13560 | Medium | 4.3 | 2025-02-26 | The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This i… |
CVE-2024-13113 | Medium | 5.9 | 2025-02-26 | The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the page, which could allo… |
CVE-2024-12878 | High | 7.1 | 2025-02-26 | The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-12737 | Medium | 6.1 | 2025-02-26 | The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in th… |
CVE-2024-12434 | Medium | 5.3 | 2025-02-26 | The SureMembers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.6 via the REST API. This makes… |
CVE-2024-10563 | Medium | 5.4 | 2025-02-26 | The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in… |
CVE-2024-10483 | High | 7.1 | 2025-02-26 | The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-10152 | High | 7.1 | 2025-02-26 | The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading t… |
CVE-2024-30150 | Medium | 5.3 | 2025-02-25 | HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potenti… |
CVE-2024-53879 | Low | 2.8 | 2025-02-25 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to… |
CVE-2024-53878 | Low | 2.8 | 2025-02-25 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to… |
CVE-2024-53877 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause a NULL pointer exception by passing a malformed… |
CVE-2024-53876 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed EL… |
CVE-2024-53875 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed E… |
CVE-2024-53874 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed E… |
CVE-2024-53873 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for Windows contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF fil… |
CVE-2024-53872 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed E… |
CVE-2024-53871 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed EL… |
CVE-2024-53870 | Low | 3.3 | 2025-02-25 | NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed E… |
CVE-2024-27246 | Medium | 4.3 | 2025-02-25 | Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-27245 | Medium | 4.3 | 2025-02-25 | Buffer overflow in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-27239 | Medium | 4.3 | 2025-02-25 | Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-0148 | High | 7.6 | 2025-02-25 | NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with physical access to the de… |
CVE-2024-45426 | Medium | 4.9 | 2025-02-25 | Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. |
CVE-2024-45425 | Medium | 4.9 | 2025-02-25 | Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. |
CVE-2024-45424 | Medium | 5.3 | 2025-02-25 | Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access. |
CVE-2024-45421 | High | 8.5 | 2025-02-25 | Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2024-45418 | Medium | 5.4 | 2025-02-25 | Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via… |
CVE-2024-45417 | Medium | 6.0 | 2025-02-25 | Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of inf… |
CVE-2024-36259 | High | 7.5 | 2025-02-25 | Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information v… |
CVE-2024-12368 | High | 8.1 | 2025-02-25 | Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other us… |
CVE-2024-11955 | Medium | 4.3 | 2025-02-25 | A vulnerability was found in GLPI up to 10.0.17. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /i… |
CVE-2024-54444 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stor… |
CVE-2024-34036 | Medium | 4.3 | 2025-02-25 | An issue was discovered in O-RAN Near Realtime RIC I-Release. To exploit this vulnerability, an attacker can disrupt the initial connection between a gNB and t… |
CVE-2024-34035 | Medium | 5.7 | 2025-02-25 | An issue was discovered in O-RAN Near Realtime RIC H-Release. To trigger the crashing of the e2mgr, an adversary must flood the system with a significant quant… |
CVE-2024-34034 | Medium | 5.7 | 2025-02-25 | An issue was discovered in FlexRIC 2.0.0. It crashes during a Subscription Request denial-of-service (DoS) attack, triggered by an assertion error. An attacker… |
CVE-2024-51539 | Low | 2.3 | 2025-02-25 | The Dell Secure Connect Gateway (SCG) Application and Appliance, versions prior to 5.28, contains a SQL injection vulnerability due to improper neutralization… |
CVE-2024-13695 | Medium | 6.4 | 2025-02-25 | The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This… |
CVE-2024-13693 | Medium | 5.3 | 2025-02-25 | The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, a… |
CVE-2024-13494 | Medium | 4.3 | 2025-02-25 | The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing… |
CVE-2024-10545 | Low | 3.5 | 2025-02-25 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privi… |
CVE-2024-57685 | Medium | 5.3 | 2025-02-24 | An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file. |
CVE-2024-56525 | Critical | 9.8 | 2025-02-24 | In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as… |
CVE-2024-53544 | Critical | 9.8 | 2025-02-24 | NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the getCookieNames method in the s… |
CVE-2024-53543 | Medium | 5.4 | 2025-02-24 | NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the addProject method in the smart… |
CVE-2024-53542 | Medium | 6.5 | 2025-02-24 | Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to… |
CVE-2024-57608 | Medium | 6.5 | 2025-02-24 | An issue in Via Browser 6.1.0 allows a a remote attacker to execute arbitrary code via the mark.via.Shell component. |
CVE-2024-57026 | Medium | 6.1 | 2025-02-24 | TawkTo Widget Version <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) due to processing user input in a way that allows JavaScript execution. |
CVE-2024-54820 | Critical | 9.8 | 2025-02-24 | XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerability allows attacke… |
CVE-2024-56897 | Critical | 9.8 | 2025-02-24 | Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made… |
CVE-2024-12918 | High | 8.8 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Health4All allows SQL Injection. This iss… |
CVE-2024-12917 | High | 8.3 | 2025-02-24 | Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-12916 | High | 8.8 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Life4All allows SQL Injection. This issue… |
CVE-2024-5174 | | 2025-02-24 | A flaw in Gliffy results in broken authentication through the reset functionality of the application. | |
CVE-2024-13822 | Medium | 6.1 | 2025-02-24 | The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page… |
CVE-2024-13605 | Medium | 4.8 | 2025-02-24 | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-12308 | Medium | 5.4 | 2025-02-24 | The Logo Slider WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where t… |
CVE-2024-55898 | High | 8.5 | 2025-02-24 | IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library c… |
CVE-2024-13728 | Medium | 6.1 | 2025-02-23 | The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the rf parameter in all versions up to, and… |
CVE-2024-52939 | High | 7.8 | 2025-02-22 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised… |
CVE-2024-47896 | Low | 3.3 | 2025-02-22 | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memor… |
CVE-2024-46975 | High | 7.9 | 2025-02-22 | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data into another Guest's virtualised GPU memo… |
CVE-2024-12577 | High | 7.3 | 2025-02-22 | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memor… |
CVE-2024-13869 | High | 7.2 | 2025-02-22 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in… |
CVE-2024-13564 | Medium | 6.4 | 2025-02-22 | The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Writing Effect Headline shortcode… |
CVE-2024-13798 | Medium | 5.3 | 2025-02-22 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5… |
CVE-2024-13474 | High | 7.5 | 2025-02-22 | The LTL Freight Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versi… |
CVE-2024-12467 | Medium | 6.1 | 2025-02-22 | The Pago por Redsys plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'Ds_MerchantParameters' parameter in all versions up to, and i… |
CVE-2024-12038 | Medium | 6.4 | 2025-02-22 | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to St… |
CVE-2024-13899 | High | 7.2 | 2025-02-22 | The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted input… |
CVE-2024-13873 | Medium | 4.3 | 2025-02-22 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in al… |
CVE-2024-22341 | Medium | 5.3 | 2025-02-22 | IBM Watson Query on Cloud Pak for Data 4.0.0 through 4.0.9, 4.5.0 through 4.5.3, 4.6.0 through 4.6.6, 4.7.0 through 4.7.4, and 4.8.0 through 4.8.7 could allow… |
CVE-2024-45674 | Low | 3.3 | 2025-02-22 | IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gat… |
CVE-2024-57176 | High | 7.6 | 2025-02-21 | An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal and access sensitive endpoints via a craf… |
CVE-2024-55159 | Medium | 4.2 | 2025-02-21 | GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list. |
CVE-2024-55156 | Medium | 5.5 | 2025-02-21 | An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information… |
CVE-2024-45673 | Medium | 5.5 | 2025-02-21 | IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gat… |
CVE-2024-10222 | Medium | 6.4 | 2025-02-21 | The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.5.10 due to insu… |
CVE-2024-9150 | | 2025-02-21 | Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a… | |
CVE-2024-13900 | Medium | 4.1 | 2025-02-21 | The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. This makes it possib… |
CVE-2024-13846 | Medium | 4.9 | 2025-02-21 | The Indeed Ultimate Learning Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions up to, and includin… |
CVE-2024-13713 | Medium | 6.5 | 2025-02-21 | The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to… |
CVE-2024-13455 | Medium | 6.4 | 2025-02-21 | The igumbi Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'igumbi_calendar' shortcode in all versions up to… |
CVE-2024-13648 | Medium | 6.4 | 2025-02-21 | The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions up to, and including… |
CVE-2024-13461 | Medium | 6.4 | 2025-02-21 | The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-sc… |
CVE-2024-13353 | High | 8.8 | 2025-02-21 | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Local File Inclusion in all ve… |
CVE-2024-12452 | Medium | 6.4 | 2025-02-21 | The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeo_event' shortcode in all versions up to, and including, 3… |
CVE-2024-12276 | Medium | 5.3 | 2025-02-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to second… |
CVE-2024-13585 | Low | 3.5 | 2025-02-21 | The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-13314 | Low | 3.5 | 2025-02-21 | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.7.4 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-11260 | High | 7.5 | 2025-02-21 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in a… |
CVE-2024-13883 | Medium | 4.3 | 2025-02-21 | The WPUpper Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.51. This is due to missing o… |
CVE-2024-13818 | Medium | 5.3 | 2025-02-21 | The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress… |
CVE-2024-13751 | Medium | 6.4 | 2025-02-21 | The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des[]' parameter in all versions up to, and including, 1.3 due… |
CVE-2024-13672 | Medium | 6.4 | 2025-02-21 | The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mcg'… |
CVE-2024-13537 | Medium | 5.3 | 2025-02-21 | The C9 Blocks plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.7.7. This is due the plugin containing a publi… |
CVE-2024-13388 | Medium | 6.4 | 2025-02-21 | The TCBD Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbdtooltip_text' shortcode in all versions up to, and inc… |
CVE-2024-13379 | Medium | 6.4 | 2025-02-21 | The C9 Admin Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.5 due t… |
CVE-2024-13235 | Medium | 6.5 | 2025-02-21 | The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter in all versions up t… |