2024 CVEs (page 287)
Page 287 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-34436 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKT Themes SKT Addons for Elementor allows Stored XSS.Thi… |
CVE-2024-34433 | Medium | 4.4 | 2024-05-14 | Deserialization of Untrusted Data vulnerability in OCDI One Click Demo Import.This issue affects One Click Demo Import: from n/a through 3.2.0. |
CVE-2024-34432 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BetterAddons Better Elementor Addons better-elementor-add… |
CVE-2024-34431 | High | 7.1 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-etracker WP etracker allows Reflected XSS.This issue a… |
CVE-2024-34430 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rashed Latif TT Custom Post Type Creator allows Stored XS… |
CVE-2024-34429 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data a… |
CVE-2024-34428 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harknell AWSOM News Announcement allows Stored XSS.This i… |
CVE-2024-34427 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Favorite Posts.This issue affects WP Favorite Posts: from n/a through 1.6.8. |
CVE-2024-34426 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benoti Brozzme Scroll Top allows Stored XSS.This issue af… |
CVE-2024-34425 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phil Baylog QuickieBar allows Stored XSS.This issue affec… |
CVE-2024-34424 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iePlexus Featured Content Gallery allows Stored XSS.This… |
CVE-2024-34423 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpbits Forty Four – 404 Plugin for WordPress allows Stor… |
CVE-2024-34422 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trinhtuantai Viet Affiliate Link allows Stored XSS.This i… |
CVE-2024-34421 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsurface BlogLentor allows Stored XSS.This issue affects… |
CVE-2024-34420 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in talspotim Comments Evolved for WordPress allows Stored XS… |
CVE-2024-34419 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nathan Vonnahme Configure Login Timeout allows Stored XSS… |
CVE-2024-34418 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tech9logy Creators WPCS ( WordPress Custom Search ) allow… |
CVE-2024-34417 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toidicode.Com (thanhtaivtt) Viet Nam Affiliate allows Sto… |
CVE-2024-34416 | Critical | 9.1 | 2024-05-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Pk Favicon Manager.This issue affects Pk Favicon Manager: from n/a through 2.1. |
CVE-2024-34415 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Thim Elementor Kit allows Stored XSS.This issue… |
CVE-2024-34411 | Critical | 9.9 | 2024-05-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Thomas Scholl canvasio3D Light.This issue affects canvasio3D Light: from n/a through 2.5.0. |
CVE-2024-34365 | Critical | 9.1 | 2024-05-14 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf Cave. As this pro… |
CVE-2024-34360 | High | 8.2 | 2024-05-14 | go-spacemesh is a Go implementation of the Spacemesh protocol full node. Nodes can publish activations transactions (ATXs) which reference the incorrect previo… |
CVE-2024-34359 | Critical | 9.6 | 2024-05-14 | llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine L… |
CVE-2024-34354 | Medium | 6.5 | 2024-05-14 | CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72e… |
CVE-2024-34353 | Medium | 5.5 | 2024-05-14 | The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the… |
CVE-2024-34352 | Medium | 6.5 | 2024-05-14 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and… |
CVE-2024-34351 | High | 7.5 | 2024-05-14 | Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in… |
CVE-2024-34350 | High | 7.5 | 2024-05-14 | Next.js is a React framework that can provide building blocks to create web applications. Prior to 13.5.1, an inconsistent interpretation of a crafted HTTP req… |
CVE-2024-34349 | Medium | 4.8 | 2024-05-14 | Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to per… |
CVE-2024-34345 | High | 8.1 | 2024-05-14 | The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, whe… |
CVE-2024-34340 | Critical | 9.1 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their passw… |
CVE-2024-34338 | High | 7.2 | 2024-05-14 | Tenda O3V2 with firmware versions V1.0.0.10 and V1.0.0.12 was discovered to contain a Blind Command Injection via dest parameter in /goform/getTraceroute. This… |
CVE-2024-34310 | High | 8.8 | 2024-05-14 | Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter. |
CVE-2024-34308 | High | 8.8 | 2024-05-14 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the function urldecode. |
CVE-2024-34245 | Medium | 6.5 | 2024-05-14 | An arbitrary file read vulnerability in DedeCMS v5.7.114 allows authenticated attackers to read arbitrary files by specifying any path in makehtml_js_action.ph… |
CVE-2024-34231 | High | 7.1 | 2024-05-14 | A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2024-34230 | Medium | 6.1 | 2024-05-14 | A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2024-34226 | Critical | 9.4 | 2024-05-14 | SQL injection vulnerability in /php-sqlite-vms/?page=manage_visitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to execute arbitrary S… |
CVE-2024-34225 | Medium | 6.1 | 2024-05-14 | Cross Site Scripting vulnerability in php-lms/admin/?page=system_info in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers t… |
CVE-2024-34224 | High | 7.3 | 2024-05-14 | Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers… |
CVE-2024-34223 | Medium | 4.3 | 2024-05-14 | Insecure permission vulnerability in /hrm/leaverequest.php in SourceCodester Human Resource Management System 1.0 allow attackers to approve or reject leave ti… |
CVE-2024-34222 | Medium | 5.9 | 2024-05-14 | Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the searccountry parameter. |
CVE-2024-34221 | High | 8.8 | 2024-05-14 | Sourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escalation. |
CVE-2024-34220 | High | 7.5 | 2024-05-14 | Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the 'leave' parameter. |
CVE-2024-34219 | High | 8.6 | 2024-05-14 | TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet. |
CVE-2024-34218 | Low | 3.8 | 2024-05-14 | TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime… |
CVE-2024-34217 | High | 7.7 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the addWlProfileClientMode function. |
CVE-2024-34215 | High | 7.3 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setUrlFilterRules function. |
CVE-2024-34213 | Critical | 9.8 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the SetPortForwardRules function. |
CVE-2024-34212 | High | 7.3 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the CloudACMunualUpdate function. |
CVE-2024-34211 | High | 8.8 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as r… |
CVE-2024-34210 | High | 7.3 | 2024-05-14 | TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the CloudACMunualUpdate function via the FileN… |
CVE-2024-34209 | Critical | 9.8 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpPortFilterRules function. |
CVE-2024-34207 | High | 8.8 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setStaticDhcpConfig function. |
CVE-2024-34206 | Medium | 6.5 | 2024-05-14 | TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx… |
CVE-2024-34205 | High | 7.3 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the download_firmware function. |
CVE-2024-34204 | Critical | 9.8 | 2024-05-14 | TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function via the FileName par… |
CVE-2024-34203 | Low | 3.8 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setLanguageCfg function. |
CVE-2024-34202 | Medium | 6.5 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setMacFilterRules function. |
CVE-2024-34201 | High | 7.3 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the getSaveConfig function. |
CVE-2024-34200 | High | 8.8 | 2024-05-14 | TOTOLINK CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpQosRules function. |
CVE-2024-34199 | High | 8.6 | 2024-05-14 | TinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sending excessively large elements in the re… |
CVE-2024-34196 | High | 8.8 | 2024-05-14 | Totolink AC1200 Wireless Dual Band Gigabit Router A3002RU_V3 Firmware V3.0.0-B20230809.1615 is vulnerable to Buffer Overflow. The "boa" program allows attacker… |
CVE-2024-34081 | Medium | 6.6 | 2024-05-14 | MantisBT (Mantis Bug Tracker) is an open source issue tracker. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settin… |
CVE-2024-34080 | Medium | 5.3 | 2024-05-14 | MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to… |
CVE-2024-34079 | Low | 3.7 | 2024-05-14 | octo-sts is a GitHub App that acts like a Security Token Service (STS) for the Github API. This vulnerability can spike the resource utilization of the STS ser… |
CVE-2024-34077 | High | 7.3 | 2024-05-14 | MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to… |
CVE-2024-34074 | Medium | 6.1 | 2024-05-14 | Frappe is a full-stack web application framework. Prior to 15.26.0 and 14.74.0, the login page accepts redirect argument and it allowed redirect to untrusted e… |
CVE-2024-34070 | Critical | 9.6 | 2024-05-14 | Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Log… |
CVE-2024-33956 | Medium | 4.3 | 2024-05-14 | Missing Authorization vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: fr… |
CVE-2024-33955 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Freesia Empire allows Stored XSS.This issue… |
CVE-2024-33954 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atanas Yonkov Pliska allows Stored XSS.This issue affects… |
CVE-2024-33953 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt van Andel Adventure Journal allows Stored XSS.This i… |
CVE-2024-33952 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Unique allows Stored XSS.This issue affect… |
CVE-2024-33951 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adam DeHaven Perfect Pullquotes allows Stored XSS.This is… |
CVE-2024-33950 | Medium | 5.9 | 2024-05-14 | Administrator Cross Site Scripting (XSS) in Archives Calendar Widget <= 1.0.15 versions. |
CVE-2024-33942 | Medium | 4.3 | 2024-05-14 | Missing Authorization vulnerability in Eric Alli Google Typography.This issue affects Google Typography: from n/a through 1.1.2. |
CVE-2024-33938 | Medium | 6.5 | 2024-05-14 | Missing Authorization vulnerability in codename065 Sliding Widgets allows Cross-Site Scripting (XSS).This issue affects Sliding Widgets: from n/a through 1.5.0. |
CVE-2024-33877 | High | 8.8 | 2024-05-14 | HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5T__conv_struct_opt in H5Tconv.c. |
CVE-2024-33876 | Medium | 5.7 | 2024-05-14 | HDF5 Library through 1.14.3 has a heap buffer overflow in H5S__point_deserialize in H5Spoint.c. |
CVE-2024-33875 | Medium | 5.7 | 2024-05-14 | HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5O__layout_encode in H5Olayout.c, resulting in the corruption of the instruction pointer. |
CVE-2024-33874 | Critical | 9.8 | 2024-05-14 | HDF5 Library through 1.14.3 has a heap buffer overflow in H5O__mtime_new_encode in H5Omtime.c. |
CVE-2024-33873 | High | 8.8 | 2024-05-14 | HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5D__scatter_mem in H5Dscatgath.c. |
CVE-2024-33819 | Medium | 4.6 | 2024-05-14 | Globitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Save Query function. |
CVE-2024-33818 | High | 7.5 | 2024-05-14 | Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference (IDOR) via the userID parameter. |
CVE-2024-33774 | Medium | 6.5 | 2024-05-14 | A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formWlanSetup_Wizard allows remote authenticated users to trigger a denial of s… |
CVE-2024-33773 | Medium | 6.5 | 2024-05-14 | A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formWlanGuestSetup allows remote authenticated users to trigger a denial of ser… |
CVE-2024-33772 | Medium | 5.7 | 2024-05-14 | A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formTcpipSetup allows remote authenticated users to trigger a denial of service… |
CVE-2024-33771 | Medium | 6.5 | 2024-05-14 | A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via goform/formWPS, allows remote authenticated users to trigger a denial of servic… |
CVE-2024-33454 | Medium | 6.5 | 2024-05-14 | Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the Bluetooth stack component. |
CVE-2024-33433 | Medium | 4.8 | 2024-05-14 | Cross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via the Guest Access Cont… |
CVE-2024-33263 | Medium | 4.0 | 2024-05-14 | QuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JS_FreeRuntime(JSRuntime *) at quickjs.c. |
CVE-2024-33250 | High | 7.2 | 2024-05-14 | An issue in Open-Source Technology Committee SRS real-time video server RS/4.0.268(Leo) and SRS/4.0.195(Leo) allows a remote attacker to execute arbitrary code… |
CVE-2024-32999 | Medium | 6.8 | 2024-05-14 | Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-32998 | Medium | 5.9 | 2024-05-14 | NULL pointer access vulnerability in the clock module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-32997 | High | 8.4 | 2024-05-14 | Race condition vulnerability in the binder driver module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-32996 | Medium | 6.2 | 2024-05-14 | Privilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-32995 | Medium | 6.2 | 2024-05-14 | Denial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-32993 | Medium | 5.6 | 2024-05-14 | Out-of-bounds access vulnerability in the memory module Impact: Successful exploitation of this vulnerability will affect availability. |