2024 CVEs (page 286)
Page 286 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-3990 | Medium | 6.4 | 2024-05-14 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover Widget in all versions… |
CVE-2024-3989 | Medium | 6.4 | 2024-05-14 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gallery Justify Widget in all ve… |
CVE-2024-3974 | Medium | 6.4 | 2024-05-14 | The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and including, 12.4.0 due to… |
CVE-2024-3956 | Medium | 5.4 | 2024-05-14 | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pod Form widget in all versions up to, and… |
CVE-2024-3954 | High | 8.8 | 2024-05-14 | The Ditty plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.1.38 via deserialization of untrusted input when adding a new ditt… |
CVE-2024-3952 | Medium | 6.4 | 2024-05-14 | The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Ad widget in all versions up to, and… |
CVE-2024-3941 | Medium | 4.7 | 2024-05-14 | The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allo… |
CVE-2024-3940 | High | 8.8 | 2024-05-14 | The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-3923 | Medium | 6.4 | 2024-05-14 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_target parameter in all versions up… |
CVE-2024-3916 | Medium | 6.4 | 2024-05-14 | The Swift Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and includi… |
CVE-2024-3915 | Medium | 5.3 | 2024-05-14 | The Swift Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sf_edit_directory_item() f… |
CVE-2024-3903 | High | 7.1 | 2024-05-14 | The Add Custom CSS and JS WordPress plugin through 1.20 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-3831 | Medium | 6.4 | 2024-05-14 | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all vers… |
CVE-2024-3828 | High | 8.8 | 2024-05-14 | The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the plugin allowing lowe… |
CVE-2024-3809 | High | 8.8 | 2024-05-14 | The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshow_type'… |
CVE-2024-3808 | High | 8.8 | 2024-05-14 | The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the 'porto_portfolio… |
CVE-2024-3807 | High | 8.8 | 2024-05-14 | The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'porto_page_header_shortcode_type', 'slides… |
CVE-2024-3806 | Critical | 9.8 | 2024-05-14 | The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'porto_ajax_posts' function. This makes… |
CVE-2024-3796 | Medium | 4.8 | 2024-05-14 | Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/BackupSchedule, description field. Exploitation of t… |
CVE-2024-3795 | Medium | 4.8 | 2024-05-14 | Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/BackupTemplate, name / description fields. Exploitat… |
CVE-2024-3794 | Medium | 4.8 | 2024-05-14 | Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/AdvancedSystem, description field, all parameters. E… |
CVE-2024-3793 | Medium | 4.8 | 2024-05-14 | Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/CloudAccounts, account name / user password / server… |
CVE-2024-3792 | Medium | 4.8 | 2024-05-14 | Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/DeviceReplication, execution range field, all parame… |
CVE-2024-3791 | Medium | 4.8 | 2024-05-14 | Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemConfiguration, name / free memory limit fields… |
CVE-2024-3790 | Medium | 4.8 | 2024-05-14 | Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemUsers, login / description fields, passwd1/ pa… |
CVE-2024-3789 | Medium | 6.5 | 2024-05-14 | Uncontrolled resource consumption vulnerability in White Bear Solutions WBSAirback, version 21.02.04. This vulnerability could allow an attacker to send multip… |
CVE-2024-3788 | Medium | 6.6 | 2024-05-14 | Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through License (/admin/CDPUsers). Exploitation of… |
CVE-2024-3787 | Medium | 6.6 | 2024-05-14 | Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through S3 disks (/admin/DeviceS3). Exploitation of… |
CVE-2024-3727 | High | 8.3 | 2024-05-14 | A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a vi… |
CVE-2024-3722 | Medium | 5.4 | 2024-05-14 | The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax_handler() function in all ve… |
CVE-2024-3680 | Medium | 6.4 | 2024-05-14 | The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animation Title widget's i… |
CVE-2024-3595 | Medium | 6.4 | 2024-05-14 | The Pure Chat – Live Chat Plugin & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the purechatwid and purechatwname parameter in a… |
CVE-2024-3590 | Medium | 6.1 | 2024-05-14 | The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted… |
CVE-2024-3582 | Medium | 4.8 | 2024-05-14 | The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attack… |
CVE-2024-3547 | Medium | 6.1 | 2024-05-14 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_con… |
CVE-2024-3462 | Medium | 5.4 | 2024-05-14 | Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-ad… |
CVE-2024-3461 | Medium | 6.2 | 2024-05-14 | KioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application from being closed, as there are no mechani… |
CVE-2024-3460 | High | 7.4 | 2024-05-14 | In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window… |
CVE-2024-3459 | High | 8.4 | 2024-05-14 | KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF… |
CVE-2024-3263 | Critical | 9.8 | 2024-05-14 | YMS VIS Pro is an information system for veterinary and food administration, veterinarians and farm. Due to a combination of improper method for system credent… |
CVE-2024-3239 | Medium | 5.4 | 2024-05-14 | The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputtin… |
CVE-2024-3070 | Critical | 9.8 | 2024-05-14 | The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization… |
CVE-2024-3068 | Medium | 4.4 | 2024-05-14 | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cfs[fields][*][name]' parameter in all versions up to, and in… |
CVE-2024-3055 | High | 8.8 | 2024-05-14 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in… |
CVE-2024-3037 | High | 7.8 | 2024-05-14 | An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability… |
CVE-2024-3016 | Critical | 9.1 | 2024-05-14 | NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change sett… |
CVE-2024-35205 | High | 7.8 | 2024-05-14 | The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them through external app… |
CVE-2024-35204 | High | 8.4 | 2024-05-14 | Veritas System Recovery before 23.3_Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users can conduct attacks. |
CVE-2024-35172 | Medium | 4.4 | 2024-05-14 | Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Ima… |
CVE-2024-35171 | Medium | 5.3 | 2024-05-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.This issue affects Academy LMS: from n/a through 1.9.25. |
CVE-2024-35170 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidden Depth Sticky banner allows Stored XSS.This issue a… |
CVE-2024-35169 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-b… |
CVE-2024-35167 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCo… |
CVE-2024-35166 | Medium | 5.3 | 2024-05-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a through 5.6.3. |
CVE-2024-35165 | Medium | 5.3 | 2024-05-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gutenify.This issue affects Gutenify: from n/a through 1.4.0. |
CVE-2024-35099 | Critical | 9.8 | 2024-05-14 | TOTOLINK LR350 V9.3.5u.6698_B20230810 was discovered to contain a stack overflow via the password parameter in the function loginAuth. |
CVE-2024-35050 | High | 8.8 | 2024-05-14 | An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin. |
CVE-2024-35049 | Critical | 9.1 | 2024-05-14 | SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590. |
CVE-2024-35048 | Medium | 4.3 | 2024-05-14 | An issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password. |
CVE-2024-34974 | High | 8.2 | 2024-05-14 | Tenda AC18 v15.03.05.19 is vulnerable to Buffer Overflow in the formSetPPTPServer function via the endIp parameter. |
CVE-2024-34946 | Medium | 6.5 | 2024-05-14 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/DhcpListClient. |
CVE-2024-34945 | Critical | 9.8 | 2024-05-14 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the PPW parameter at ip/goform/WizardHandle. |
CVE-2024-34944 | High | 8.8 | 2024-05-14 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at ip/goform/DhcpListClient. |
CVE-2024-34943 | Critical | 9.8 | 2024-05-14 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/NatStaticSetting. |
CVE-2024-34942 | High | 8.8 | 2024-05-14 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/exeCommand. |
CVE-2024-34921 | High | 8.8 | 2024-05-14 | TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function. |
CVE-2024-34899 | Medium | 5.4 | 2024-05-14 | WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS). |
CVE-2024-34828 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.32. |
CVE-2024-34827 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Razvan Mocanu, Madalin Ungureanu, Cristophor Hurduban TranslatePress.This issue affects Translat… |
CVE-2024-34825 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Warfare Plugins Social Warfare.This issue affects Social Warfare: from n/a through 4.4.5.1. |
CVE-2024-34823 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter.This issue affects Arigato Autoresponder and Newsletter: fr… |
CVE-2024-34818 | High | 7.1 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress.This issue affects WebinarPress: from n/a through 1.33.17. |
CVE-2024-34817 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects I… |
CVE-2024-34816 | Medium | 5.4 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io – Easy Meeting Scheduler.This issue affects WPCal.Io – Easy Meeting Scheduler: from n/a thr… |
CVE-2024-34814 | Medium | 5.4 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Unyson Unyson unyson.This issue affects Unyson: from n/a through <= 2.7.29. |
CVE-2024-34812 | Medium | 5.3 | 2024-05-14 | Insertion of Sensitive Information Into Sent Data vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder.This issue affect… |
CVE-2024-34811 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP… |
CVE-2024-34749 | Medium | 6.1 | 2024-05-14 | Phormer prior to version 3.35 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote unauthenticated attacker may execute… |
CVE-2024-34709 | Medium | 5.4 | 2024-05-14 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they… |
CVE-2024-34708 | Medium | 4.9 | 2024-05-14 | Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can… |
CVE-2024-34707 | High | 7.5 | 2024-05-14 | Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and… |
CVE-2024-34706 | Critical | 9.8 | 2024-05-14 | Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api… |
CVE-2024-34704 | Medium | 5.9 | 2024-05-14 | era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the `DAGCombine` phase while visiting the XOR… |
CVE-2024-34701 | Medium | 5.9 | 2024-05-14 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki req… |
CVE-2024-34699 | Medium | 6.5 | 2024-05-14 | GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious te… |
CVE-2024-34698 | Medium | 4.6 | 2024-05-14 | FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the `/publ… |
CVE-2024-34697 | High | 7.6 | 2024-05-14 | FreeScout is a free, self-hosted help desk and shared mailbox. A stored HTML Injection vulnerability has been identified in the Email Receival Module of the Fr… |
CVE-2024-34695 | Medium | 6.3 | 2024-05-14 | WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the mo… |
CVE-2024-34559 | High | 7.5 | 2024-05-14 | Insertion of Sensitive Information into Log File vulnerability in Ghost Foundation Ghost.This issue affects Ghost: from n/a through 1.4.0. |
CVE-2024-34557 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to… |
CVE-2024-34556 | Medium | 5.3 | 2024-05-14 | Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-sca… |
CVE-2024-34555 | Critical | 10.0 | 2024-05-14 | Unrestricted Upload of File with Dangerous Type vulnerability in URBAN BASE Z-Downloads.This issue affects Z-Downloads: from n/a through 1.11.3. |
CVE-2024-34550 | Medium | 5.3 | 2024-05-14 | Insertion of Sensitive Information into Log File vulnerability in AlexaCRM Dynamics 365 Integration.This issue affects Dynamics 365 Integration: from n/a throu… |
CVE-2024-34549 | Medium | 5.3 | 2024-05-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.2.2. |
CVE-2024-34459 | High | 7.5 | 2024-05-14 | An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buff… |
CVE-2024-34445 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKT Themes SKT Addons for Elementor allows Stored XSS.Thi… |
CVE-2024-34441 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bootstrapped Ventures Easy Affiliate Links allows Stored… |
CVE-2024-34440 | Critical | 9.1 | 2024-05-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a… |
CVE-2024-34439 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in divSpot DS Site Message.This issue affects DS Site Message: from n/a through 1.14.4. |
CVE-2024-34437 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored… |