2024 CVEs (page 30)
Page 30 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13712 | Medium | 4.9 | 2025-02-19 | The Pollin plugin for WordPress is vulnerable to SQL Injection via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient es… |
CVE-2024-13711 | Medium | 6.1 | 2025-02-19 | The Pollin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'question' parameter in all versions up to, and including, 1.01.1 due t… |
CVE-2024-13679 | Medium | 6.4 | 2025-02-19 | The Widget BUY.BOX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buybox-widget' shortcode in all versions up to, and incl… |
CVE-2024-13676 | Medium | 6.5 | 2025-02-19 | The Categorized Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' attribute of the 'image_gallery' shortcode in all versions u… |
CVE-2024-13674 | Medium | 6.4 | 2025-02-19 | The Cosmic Blocks (40+) Content Editor Blocks Collection plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cwp_social_share'… |
CVE-2024-13663 | Medium | 6.4 | 2025-02-19 | The Coaching Staffs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstw-cs-table' shortcode in all versions up to, and inc… |
CVE-2024-13660 | Medium | 6.4 | 2025-02-19 | The Responsive Flickr Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fshow' shortcode in all versions up to, and… |
CVE-2024-13657 | Medium | 6.4 | 2025-02-19 | The Store Locator Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'storelocatorwidget' shortcode in all versions up t… |
CVE-2024-13592 | High | 7.5 | 2025-02-19 | The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl… |
CVE-2024-13591 | Medium | 6.4 | 2025-02-19 | The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'team-b… |
CVE-2024-13589 | Medium | 6.4 | 2025-02-19 | The YouTube Playlists with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yt_grid' shortcode in all versions up to… |
CVE-2024-13468 | High | 7.5 | 2025-02-19 | The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'duplicates-actio… |
CVE-2024-13462 | Medium | 6.4 | 2025-02-19 | The WP Wiki Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wiki' shortcode in all versions up to, and including, 2… |
CVE-2024-13405 | Medium | 4.3 | 2025-02-19 | The Apptivo Business Site CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missin… |
CVE-2024-13390 | Medium | 6.4 | 2025-02-19 | The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adfo_list' shortcode in all versi… |
CVE-2024-12522 | Medium | 6.4 | 2025-02-19 | The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yayforms'… |
CVE-2024-12339 | Medium | 6.1 | 2025-02-19 | The Digihood HTML Sitemap plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘channel' parameter in all versions up to, and including… |
CVE-2024-12069 | Medium | 6.1 | 2025-02-19 | The Lexicata plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in al… |
CVE-2024-11778 | Medium | 6.4 | 2025-02-19 | The CanadaHelps Embedded Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedcdn' shortcode in all versions… |
CVE-2024-11753 | Medium | 6.4 | 2025-02-19 | The UMich OIDC Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'umich_oidc_button' shortcode in all versions up to, an… |
CVE-2024-11335 | Medium | 6.4 | 2025-02-19 | The UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the p… |
CVE-2024-13799 | Medium | 6.4 | 2025-02-19 | The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘new… |
CVE-2024-12173 | Low | 3.5 | 2025-02-19 | The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor and… |
CVE-2024-13443 | Medium | 6.4 | 2025-02-19 | The Easypromos Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Easypromos shortcode in all versions up to, and includ… |
CVE-2024-11582 | High | 7.2 | 2025-02-19 | The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ip parameter in all versions u… |
CVE-2024-57262 | High | 7.1 | 2025-02-19 | In barebox before 2025.01.0, ext4fs_read_symlink has an integer overflow for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inod… |
CVE-2024-57261 | High | 7.1 | 2025-02-19 | In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE-2024-57258. |
CVE-2024-13508 | Medium | 6.1 | 2025-02-19 | The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72… |
CVE-2024-57259 | High | 7.1 | 2025-02-18 | sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the p… |
CVE-2024-57258 | High | 7.1 | 2025-02-18 | Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_… |
CVE-2024-57257 | Low | 2.0 | 2025-02-18 | A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting. |
CVE-2024-57256 | High | 7.1 | 2025-02-18 | An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem wi… |
CVE-2024-57255 | High | 7.1 | 2025-02-18 | An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulti… |
CVE-2024-57254 | High | 7.1 | 2025-02-18 | An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem. |
CVE-2024-13743 | Medium | 6.4 | 2025-02-18 | The Wonder Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wonderplugin_video shortcode in all versions up to, a… |
CVE-2024-56171 | High | 7.8 | 2025-02-18 | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit… |
CVE-2024-56000 | Critical | 9.8 | 2025-02-18 | Incorrect Privilege Assignment vulnerability in SeventhQueen K Elements k-elements allows Privilege Escalation.This issue affects K Elements: from n/a through… |
CVE-2024-45783 | Medium | 4.4 | 2025-02-18 | A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL… |
CVE-2024-45781 | Medium | 6.7 | 2025-02-18 | A flaw was found in grub2. When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string length taken as an input. The lack of… |
CVE-2024-45776 | Medium | 6.7 | 2025-02-18 | When reading the language .mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may… |
CVE-2024-45775 | Medium | 5.2 | 2025-02-18 | A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the grub's argument list. However, it… |
CVE-2024-57056 | Medium | 5.4 | 2025-02-18 | Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could be used by a malicio… |
CVE-2024-57055 | Medium | 5.0 | 2025-02-18 | Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentially call certain services without the ne… |
CVE-2024-45774 | Medium | 6.7 | 2025-02-18 | A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of its internal buffers, resulting… |
CVE-2024-56883 | High | 8.1 | 2025-02-18 | Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. L… |
CVE-2024-56882 | Medium | 5.4 | 2025-02-18 | Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permanently store JavaScri… |
CVE-2024-51505 | High | 8.0 | 2025-02-18 | An issue was discovered in Atos Eviden IDRA before 2.7.1. A highly trusted role (Config Admin) could leverage a race condition to escalate privileges. |
CVE-2024-50609 | High | 7.5 | 2025-02-18 | An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with… |
CVE-2024-50608 | High | 7.5 | 2025-02-18 | An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a p… |
CVE-2024-4028 | Low | 3.8 | 2025-02-18 | A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource a… |
CVE-2024-49589 | Medium | 6.5 | 2025-02-18 | Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based on an user supplied argument (size). |
CVE-2024-39328 | Medium | 6.8 | 2025-02-18 | Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0. A highly trusted role (Config Admin) could exceed their configuration privileges in a multi-par… |
CVE-2024-55460 | Critical | 9.8 | 2025-02-18 | A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allows attackers to exec… |
CVE-2024-39327 | Critical | 9.9 | 2025-02-18 | Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate way. |
CVE-2024-57046 | High | 8.8 | 2025-02-18 | A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When a… |
CVE-2024-57045 | Critical | 9.8 | 2025-02-18 | A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attack… |
CVE-2024-13689 | Medium | 6.3 | 2025-02-18 | The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software… |
CVE-2024-13797 | High | 7.3 | 2025-02-18 | The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and incl… |
CVE-2024-13783 | Medium | 4.3 | 2025-02-18 | The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to… |
CVE-2024-13691 | Medium | 6.5 | 2025-02-18 | The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_recordMedia' function in all versions u… |
CVE-2024-13681 | High | 7.5 | 2025-02-18 | The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_admin_get_oembed' function in all versi… |
CVE-2024-13667 | Medium | 5.4 | 2025-02-18 | The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all versions up to, and including, 2.9.1.6 d… |
CVE-2024-13369 | Medium | 6.5 | 2025-02-18 | The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter in all versions up t… |
CVE-2024-13718 | Medium | 4.3 | 2025-02-18 | The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2024-13395 | Medium | 6.4 | 2025-02-18 | The Threepress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'threepress' shortcode in all versions up to, and including… |
CVE-2024-13316 | Medium | 5.3 | 2025-02-18 | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unautho… |
CVE-2024-12860 | Critical | 9.8 | 2025-02-18 | The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and i… |
CVE-2024-13795 | Medium | 4.3 | 2025-02-18 | The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.27… |
CVE-2024-13704 | High | 7.2 | 2025-02-18 | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions up to, and including… |
CVE-2024-13575 | Medium | 6.4 | 2025-02-18 | The Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'web_stories_enhancer'… |
CVE-2024-13465 | Medium | 6.4 | 2025-02-18 | The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Table Of Content" Block, specifically in th… |
CVE-2024-11895 | Medium | 6.4 | 2025-02-18 | The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in al… |
CVE-2024-11376 | Medium | 6.1 | 2025-02-18 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflect… |
CVE-2024-57964 | High | 7.3 | 2025-02-18 | Insecure Loading of Dynamic Link Libraries have been discovered in HVAC Energy Saving Program, which could allow local attackers to potentially disclose inform… |
CVE-2024-57963 | High | 7.3 | 2025-02-18 | Insecure Loading of Dynamic Link Libraries have been discovered in USB-CONVERTERCABLE DRIVER, which could allow local attackers to potentially disclose informa… |
CVE-2024-13523 | Medium | 6.1 | 2025-02-18 | The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorre… |
CVE-2024-45320 | Medium | 6.5 | 2025-02-18 | Out-of-bounds write vulnerability exists in DocuPrint CP225w 01.22.01 and earlier, DocuPrint CP228w 01.22.01 and earlier, DocuPrint CM225fw 01.10.01 and earlie… |
CVE-2024-13556 | High | 8.1 | 2025-02-18 | The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, a… |
CVE-2024-13438 | Medium | 4.3 | 2025-02-18 | The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is… |
CVE-2024-13315 | High | 8.8 | 2025-02-18 | The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-13852 | High | 8.8 | 2025-02-18 | The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the plugin_page()… |
CVE-2024-13848 | Medium | 5.5 | 2025-02-18 | The Reaction Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.6 due to in… |
CVE-2024-13725 | Critical | 9.8 | 2025-02-18 | The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter… |
CVE-2024-13687 | Medium | 4.3 | 2025-02-18 | The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_team_bui… |
CVE-2024-13684 | High | 8.1 | 2025-02-18 | The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce… |
CVE-2024-13677 | High | 8.8 | 2025-02-18 | The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all v… |
CVE-2024-13622 | High | 7.5 | 2025-02-18 | The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the… |
CVE-2024-13609 | Medium | 5.9 | 2025-02-18 | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t… |
CVE-2024-13595 | Medium | 6.5 | 2025-02-18 | The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including… |
CVE-2024-13588 | Medium | 6.4 | 2025-02-18 | The Simplebooklet PDF Viewer and Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplebooklet' shortcode in all v… |
CVE-2024-13587 | Medium | 6.4 | 2025-02-18 | The Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_fv… |
CVE-2024-13582 | Medium | 6.4 | 2025-02-18 | The Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin'… |
CVE-2024-13581 | Medium | 6.4 | 2025-02-18 | The Simple Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simple_chart' shortcode in all versions up to, and includ… |
CVE-2024-13579 | Medium | 6.4 | 2025-02-18 | The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'polls_popup' shortcode in all versions up to, and includin… |
CVE-2024-13578 | Medium | 6.4 | 2025-02-18 | The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0… |
CVE-2024-13577 | Medium | 6.4 | 2025-02-18 | The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions up to, and includi… |
CVE-2024-13576 | Medium | 6.4 | 2025-02-18 | The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gumlet' shortcode in all versions up to, and including, 1… |
CVE-2024-13573 | Medium | 6.4 | 2025-02-18 | The Zigaform – Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_rfvar' shortcode in all versions up t… |
CVE-2024-13565 | Medium | 6.4 | 2025-02-18 | The Simple Map No Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.9 due… |
CVE-2024-13555 | Medium | 5.3 | 2025-02-18 | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a… |