2024 CVEs (page 296)
Page 296 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2328 | Medium | 6.4 | 2024-05-02 | The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image title and alt text… |
CVE-2024-2324 | Medium | 4.4 | 2024-05-02 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up… |
CVE-2024-2273 | Medium | 6.4 | 2024-05-02 | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all… |
CVE-2024-2109 | Medium | 5.3 | 2024-05-02 | The Booster Extension plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'booster_extensi… |
CVE-2024-2085 | Medium | 6.4 | 2024-05-02 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' value in several widgets all versi… |
CVE-2024-2084 | Medium | 6.4 | 2024-05-02 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox widget in all versions… |
CVE-2024-2082 | High | 7.2 | 2024-05-02 | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters… |
CVE-2024-2043 | Medium | 5.3 | 2024-05-02 | The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabi… |
CVE-2024-25290 | High | 8.0 | 2024-05-02 | An issue in Casa Systems NL1901ACV R6B032 allows a remote attacker to execute arbitrary code via the userName parameter of the add function. |
CVE-2024-1993 | Medium | 6.4 | 2024-05-02 | The Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.0 due… |
CVE-2024-1959 | Medium | 6.4 | 2024-05-02 | The Social Sharing Plugin – Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialWarfare' shortcode in all… |
CVE-2024-1945 | High | 7.1 | 2024-05-02 | The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a mis… |
CVE-2024-1897 | High | 7.5 | 2024-05-02 | The Grid Gallery – Photo Image Grid Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserial… |
CVE-2024-1896 | High | 7.5 | 2024-05-02 | The Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery plugin for WordPress is vulnerable to PHP Object… |
CVE-2024-1842 | Medium | 6.4 | 2024-05-02 | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Heading tag attribute in all versions up to, and including, 7.5 d… |
CVE-2024-1841 | Medium | 6.4 | 2024-05-02 | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Title tag attribute in all versions up to, and including, 7.5 due t… |
CVE-2024-1840 | Medium | 6.4 | 2024-05-02 | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Author tag attribute in all versions up to, and including, 7.5 due… |
CVE-2024-1809 | Medium | 5.4 | 2024-05-02 | The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access of data due to a m… |
CVE-2024-1805 | Medium | 6.4 | 2024-05-02 | The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all versions up to, and including, 7.5 due t… |
CVE-2024-1797 | High | 8.8 | 2024-05-02 | The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to SQL Injection via the 'status' and 'id' attributes of the 'wp_ul… |
CVE-2024-1759 | Medium | 6.4 | 2024-05-02 | The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all ver… |
CVE-2024-1716 | Medium | 4.3 | 2024-05-02 | The Admin Bar Remover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_form() function i… |
CVE-2024-1688 | Medium | 5.3 | 2024-05-02 | The Woo Total Sales plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_orders_archive() function in… |
CVE-2024-1679 | Medium | 6.4 | 2024-05-02 | The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-1678 | Medium | 5.3 | 2024-05-02 | The Subway – Private Site Option plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the REST… |
CVE-2024-1677 | Medium | 6.3 | 2024-05-02 | The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to unauthorized access of da… |
CVE-2024-1584 | Medium | 5.3 | 2024-05-02 | The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized modification of data due… |
CVE-2024-1572 | Medium | 6.4 | 2024-05-02 | The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_ulike' shortcode in all versions up to, and including, 4.6… |
CVE-2024-1567 | High | 8.2 | 2024-05-02 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity'… |
CVE-2024-1533 | Medium | 6.4 | 2024-05-02 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML Element in all versions up to… |
CVE-2024-1416 | Medium | 4.3 | 2024-05-02 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capabi… |
CVE-2024-1415 | Medium | 4.3 | 2024-05-02 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ… |
CVE-2024-1396 | Medium | 6.4 | 2024-05-02 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versio… |
CVE-2024-1386 | Medium | 6.4 | 2024-05-02 | The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions 1.5.0 to 1… |
CVE-2024-1348 | Medium | 6.4 | 2024-05-02 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions… |
CVE-2024-1173 | High | 7.2 | 2024-05-02 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection… |
CVE-2024-0908 | Medium | 5.3 | 2024-05-02 | The Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing… |
CVE-2024-0848 | Medium | 6.1 | 2024-05-02 | The AA Cash Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘invoice’ parameter in all versions up to, and including, 1… |
CVE-2024-0847 | Medium | 4.3 | 2024-05-02 | The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due t… |
CVE-2024-0710 | Medium | 5.3 | 2024-05-02 | The GP Unique ID plugin for WordPress is vulnerable to Unique ID Modification in all versions up to, and including, 1.5.5. This is due to insufficient input va… |
CVE-2024-0629 | Medium | 5.3 | 2024-05-02 | The 2Checkout Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-0615 | Medium | 5.3 | 2024-05-02 | The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensiti… |
CVE-2024-0613 | Medium | 6.1 | 2024-05-02 | The Delete Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.1. This is due to missing o… |
CVE-2024-4433 | Medium | 5.9 | 2024-05-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mr Digital Simple Image Popup allows Stored XSS.This issu… |
CVE-2024-33530 | High | 7.5 | 2024-05-02 | In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeting password when a… |
CVE-2024-32359 | Medium | 6.9 | 2024-05-02 | An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of th… |
CVE-2024-31967 | Critical | 9.1 | 2024-05-02 | A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1… |
CVE-2024-31966 | Medium | 6.2 | 2024-05-02 | A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1… |
CVE-2024-31965 | Medium | 4.2 | 2024-05-02 | A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1… |
CVE-2024-31964 | High | 7.5 | 2024-05-02 | A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1… |
CVE-2024-31963 | Medium | 6.4 | 2024-05-02 | A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1… |
CVE-2024-29309 | High | 7.7 | 2024-05-02 | An issue in Alfresco Content Services v.23.3.0.7 allows a remote attacker to execute arbitrary code via the Transfer Service. |
CVE-2024-4406 | Critical | 9.6 | 2024-05-02 | Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2024-4405 | Critical | 9.6 | 2024-05-02 | Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2024-4029 | Medium | 4.1 | 2024-05-02 | A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause… |
CVE-2024-3544 | High | 7.5 | 2024-05-02 | Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines… |
CVE-2024-4128 | Low | 2.6 | 2024-05-02 | This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from… |
CVE-2024-3543 | Medium | 6.4 | 2024-05-02 | Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stole… |
CVE-2024-34148 | Medium | 6.8 | 2024-05-02 | Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a re… |
CVE-2024-34147 | Medium | 4.3 | 2024-05-02 | Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can… |
CVE-2024-34146 | Medium | 6.5 | 2024-05-02 | Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, allowing attackers w… |
CVE-2024-34145 | High | 8.8 | 2024-05-02 | A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9… |
CVE-2024-34144 | Critical | 9.8 | 2024-05-02 | A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with per… |
CVE-2024-34061 | Medium | 4.3 | 2024-05-02 | changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in pa… |
CVE-2024-33305 | Medium | 6.1 | 2024-05-02 | SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Middle Name" parameter in Create User. |
CVE-2024-33303 | High | 8.2 | 2024-05-02 | SourceCodester Product Show Room 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" under Add Users. |
CVE-2024-33302 | Medium | 5.3 | 2024-05-02 | SourceCodester Product Show Room 1.0 and before is vulnerable to Cross Site Scripting (XSS) via "Middle Name" under Add Users. |
CVE-2024-30251 | High | 7.5 | 2024-05-02 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/f… |
CVE-2024-23462 | Low | 3.3 | 2024-05-02 | An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary an… |
CVE-2024-23461 | Medium | 4.2 | 2024-05-02 | An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Local Execution of Co… |
CVE-2024-23459 | High | 7.1 | 2024-05-02 | An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to be overwritten.This… |
CVE-2024-33944 | Medium | 6.5 | 2024-05-02 | Missing Authorization vulnerability in Kestrel WooCommerce AWeber Newsletter Subscription.This issue affects WooCommerce AWeber Newsletter Subscription: from n… |
CVE-2024-3005 | Medium | 6.4 | 2024-05-02 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's LaStudioKit Post Author widget in al… |
CVE-2024-33930 | Medium | 4.7 | 2024-05-02 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ILLID Share This Image.This issue affects Share This Image: from n/a through 1.97. |
CVE-2024-33922 | Medium | 5.3 | 2024-05-02 | Insertion of Sensitive Information into Log File vulnerability in Jordy Meow WP Media Cleaner.This issue affects WP Media Cleaner: from n/a through 6.7.2. |
CVE-2024-33913 | Critical | 9.6 | 2024-05-02 | Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload in Xserver Migrator.This issue affects Xserver Migrator: from n/a through 1.6… |
CVE-2024-33911 | High | 7.6 | 2024-05-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar School Management Pro.This issue affects School… |
CVE-2024-3955 | Critical | 9.8 | 2024-05-02 | URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" func… |
CVE-2024-32638 | Medium | 6.3 | 2024-05-02 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apac… |
CVE-2024-3883 | Medium | 6.4 | 2024-05-02 | The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and including, 1.15.4 due t… |
CVE-2024-32114 | High | 8.5 | 2024-05-02 | In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It… |
CVE-2024-3280 | Medium | 6.4 | 2024-05-02 | The Follow Us Badges plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsite_follow_us_badges shortcode in all versions up to… |
CVE-2024-3490 | Medium | 6.4 | 2024-05-02 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wprm-recipe-roundup-item shortcode in all versions up to… |
CVE-2024-32971 | Critical | 9.0 | 2024-05-02 | Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Rout… |
CVE-2024-32962 | Critical | 10.0 | 2024-05-02 | xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the s… |
CVE-2024-32882 | Low | 2.7 | 2024-05-02 | Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.c… |
CVE-2024-3481 | Medium | 5.2 | 2024-05-02 | The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unw… |
CVE-2024-3478 | Medium | 6.1 | 2024-05-02 | The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform un… |
CVE-2024-3477 | Medium | 4.3 | 2024-05-02 | The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwan… |
CVE-2024-3476 | High | 8.8 | 2024-05-02 | The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform… |
CVE-2024-3475 | High | 7.5 | 2024-05-02 | The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform… |
CVE-2024-3474 | High | 8.8 | 2024-05-02 | The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perfor… |
CVE-2024-3472 | Medium | 5.9 | 2024-05-02 | The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in a… |
CVE-2024-3471 | Low | 3.4 | 2024-05-02 | The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin d… |
CVE-2024-2405 | Medium | 4.5 | 2024-05-02 | The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrar… |
CVE-2024-4142 | Critical | 9.0 | 2024-05-01 | An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability… |
CVE-2024-33423 | High | 7.4 | 2024-05-01 | Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload… |
CVE-2024-33307 | Medium | 5.4 | 2024-05-01 | SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Last Name" parameter in Create User. |
CVE-2024-33306 | High | 7.4 | 2024-05-01 | SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" parameter in Create User. |
CVE-2024-25676 | Medium | 4.7 | 2024-05-01 | An issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leads to both open redir… |