2024 CVEs (page 30)
Page 30 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-57255 | High | 7.1 | 2025-02-18 | An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulti… |
CVE-2024-57254 | High | 7.1 | 2025-02-18 | An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem. |
CVE-2024-13743 | Medium | 6.4 | 2025-02-18 | The Wonder Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wonderplugin_video shortcode in all versions up to, a… |
CVE-2024-56171 | High | 7.8 | 2025-02-18 | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit… |
CVE-2024-56000 | Critical | 9.8 | 2025-02-18 | Incorrect Privilege Assignment vulnerability in SeventhQueen K Elements k-elements allows Privilege Escalation.This issue affects K Elements: from n/a through… |
CVE-2024-45783 | Medium | 4.4 | 2025-02-18 | A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL… |
CVE-2024-45781 | Medium | 6.7 | 2025-02-18 | A flaw was found in grub2. When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string length taken as an input. The lack of… |
CVE-2024-45776 | Medium | 6.7 | 2025-02-18 | When reading the language .mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may… |
CVE-2024-45775 | Medium | 5.2 | 2025-02-18 | A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the grub's argument list. However, it… |
CVE-2024-57056 | Medium | 5.4 | 2025-02-18 | Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could be used by a malicio… |
CVE-2024-57055 | Medium | 5.0 | 2025-02-18 | Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentially call certain services without the ne… |
CVE-2024-45774 | Medium | 6.7 | 2025-02-18 | A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of its internal buffers, resulting… |
CVE-2024-56883 | High | 8.1 | 2025-02-18 | Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. L… |
CVE-2024-56882 | Medium | 5.4 | 2025-02-18 | Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permanently store JavaScri… |
CVE-2024-51505 | High | 8.0 | 2025-02-18 | An issue was discovered in Atos Eviden IDRA before 2.7.1. A highly trusted role (Config Admin) could leverage a race condition to escalate privileges. |
CVE-2024-50609 | High | 7.5 | 2025-02-18 | An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with… |
CVE-2024-50608 | High | 7.5 | 2025-02-18 | An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a p… |
CVE-2024-4028 | Low | 3.8 | 2025-02-18 | A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource a… |
CVE-2024-49589 | Medium | 6.5 | 2025-02-18 | Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based on an user supplied argument (size). |
CVE-2024-39328 | Medium | 6.8 | 2025-02-18 | Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0. A highly trusted role (Config Admin) could exceed their configuration privileges in a multi-par… |
CVE-2024-55460 | Critical | 9.8 | 2025-02-18 | A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allows attackers to exec… |
CVE-2024-39327 | Critical | 9.9 | 2025-02-18 | Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate way. |
CVE-2024-57046 | High | 8.8 | 2025-02-18 | A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When a… |
CVE-2024-57045 | Critical | 9.8 | 2025-02-18 | A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attack… |
CVE-2024-13689 | Medium | 6.3 | 2025-02-18 | The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software… |
CVE-2024-13797 | High | 7.3 | 2025-02-18 | The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and incl… |
CVE-2024-13783 | Medium | 4.3 | 2025-02-18 | The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to… |
CVE-2024-13691 | Medium | 6.5 | 2025-02-18 | The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_recordMedia' function in all versions u… |
CVE-2024-13681 | High | 7.5 | 2025-02-18 | The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_admin_get_oembed' function in all versi… |
CVE-2024-13667 | Medium | 5.4 | 2025-02-18 | The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all versions up to, and including, 2.9.1.6 d… |
CVE-2024-13369 | Medium | 6.5 | 2025-02-18 | The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter in all versions up t… |
CVE-2024-13718 | Medium | 4.3 | 2025-02-18 | The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2024-13395 | Medium | 6.4 | 2025-02-18 | The Threepress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'threepress' shortcode in all versions up to, and including… |
CVE-2024-13316 | Medium | 5.3 | 2025-02-18 | The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unautho… |
CVE-2024-12860 | Critical | 9.8 | 2025-02-18 | The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and i… |
CVE-2024-13795 | Medium | 4.3 | 2025-02-18 | The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.27… |
CVE-2024-13704 | High | 7.2 | 2025-02-18 | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions up to, and including… |
CVE-2024-13575 | Medium | 6.4 | 2025-02-18 | The Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'web_stories_enhancer'… |
CVE-2024-13465 | Medium | 6.4 | 2025-02-18 | The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Table Of Content" Block, specifically in th… |
CVE-2024-11895 | Medium | 6.4 | 2025-02-18 | The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in al… |
CVE-2024-11376 | Medium | 6.1 | 2025-02-18 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflect… |
CVE-2024-57964 | High | 7.3 | 2025-02-18 | Insecure Loading of Dynamic Link Libraries have been discovered in HVAC Energy Saving Program, which could allow local attackers to potentially disclose inform… |
CVE-2024-57963 | High | 7.3 | 2025-02-18 | Insecure Loading of Dynamic Link Libraries have been discovered in USB-CONVERTERCABLE DRIVER, which could allow local attackers to potentially disclose informa… |
CVE-2024-13523 | Medium | 6.1 | 2025-02-18 | The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorre… |
CVE-2024-45320 | Medium | 6.5 | 2025-02-18 | Out-of-bounds write vulnerability exists in DocuPrint CP225w 01.22.01 and earlier, DocuPrint CP228w 01.22.01 and earlier, DocuPrint CM225fw 01.10.01 and earlie… |
CVE-2024-13556 | High | 8.1 | 2025-02-18 | The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, a… |
CVE-2024-13438 | Medium | 4.3 | 2025-02-18 | The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is… |
CVE-2024-13315 | High | 8.8 | 2025-02-18 | The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-13852 | High | 8.8 | 2025-02-18 | The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the plugin_page()… |
CVE-2024-13848 | Medium | 5.5 | 2025-02-18 | The Reaction Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.6 due to in… |
CVE-2024-13725 | Critical | 9.8 | 2025-02-18 | The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter… |
CVE-2024-13687 | Medium | 4.3 | 2025-02-18 | The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_team_bui… |
CVE-2024-13684 | High | 8.1 | 2025-02-18 | The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce… |
CVE-2024-13677 | High | 8.8 | 2025-02-18 | The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all v… |
CVE-2024-13622 | High | 7.5 | 2025-02-18 | The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the… |
CVE-2024-13609 | Medium | 5.9 | 2025-02-18 | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t… |
CVE-2024-13595 | Medium | 6.5 | 2025-02-18 | The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including… |
CVE-2024-13588 | Medium | 6.4 | 2025-02-18 | The Simplebooklet PDF Viewer and Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplebooklet' shortcode in all v… |
CVE-2024-13587 | Medium | 6.4 | 2025-02-18 | The Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_fv… |
CVE-2024-13582 | Medium | 6.4 | 2025-02-18 | The Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin'… |
CVE-2024-13581 | Medium | 6.4 | 2025-02-18 | The Simple Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simple_chart' shortcode in all versions up to, and includ… |
CVE-2024-13579 | Medium | 6.4 | 2025-02-18 | The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'polls_popup' shortcode in all versions up to, and includin… |
CVE-2024-13578 | Medium | 6.4 | 2025-02-18 | The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0… |
CVE-2024-13577 | Medium | 6.4 | 2025-02-18 | The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions up to, and includi… |
CVE-2024-13576 | Medium | 6.4 | 2025-02-18 | The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gumlet' shortcode in all versions up to, and including, 1… |
CVE-2024-13573 | Medium | 6.4 | 2025-02-18 | The Zigaform – Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_rfvar' shortcode in all versions up t… |
CVE-2024-13565 | Medium | 6.4 | 2025-02-18 | The Simple Map No Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.9 due… |
CVE-2024-13555 | Medium | 5.3 | 2025-02-18 | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a… |
CVE-2024-13540 | Medium | 5.3 | 2025-02-18 | The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and in… |
CVE-2024-13538 | Medium | 5.3 | 2025-02-18 | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.0. This… |
CVE-2024-13535 | Medium | 5.3 | 2025-02-18 | The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is due the composer-s… |
CVE-2024-13522 | Medium | 6.1 | 2025-02-18 | The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missin… |
CVE-2024-13501 | Medium | 6.4 | 2025-02-18 | The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and incl… |
CVE-2024-13464 | Medium | 6.4 | 2025-02-18 | The Library Bookshelves plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bookshelf' shortcode in all versions up to, and inc… |
CVE-2024-12813 | Medium | 6.4 | 2025-02-18 | The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-status' shortcode i… |
CVE-2024-12525 | Medium | 6.4 | 2025-02-18 | The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' shortcode in all v… |
CVE-2024-12314 | High | 7.2 | 2025-02-18 | The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin storing HTTP headers i… |
CVE-2024-13740 | Medium | 4.3 | 2025-02-18 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu… |
CVE-2024-13741 | Medium | 5.4 | 2025-02-18 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and in… |
CVE-2024-25066 | Medium | 4.3 | 2025-02-17 | RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlled files being sto… |
CVE-2024-13879 | Medium | 5.5 | 2025-02-17 | The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the… |
CVE-2024-47935 | Medium | 6.7 | 2025-02-17 | Improper Validation of Integrity Check Value vulnerability in TXOne Networks StellarProtect (Legacy Mode), StellarEnforce, and Safe Lock allows an attacker to… |
CVE-2024-13726 | High | 8.6 | 2025-02-17 | The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to… |
CVE-2024-13627 | Medium | 4.7 | 2025-02-17 | The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cro… |
CVE-2024-13626 | High | 7.1 | 2025-02-17 | The VR-Frases (collect & share quotes) WordPress plugin through 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t… |
CVE-2024-13625 | High | 7.1 | 2025-02-17 | The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-13608 | Medium | 4.7 | 2025-02-17 | The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injec… |
CVE-2024-13603 | Medium | 6.1 | 2025-02-17 | The Wise Forms WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cros… |
CVE-2024-44044 | High | 7.1 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandexponents Oshine Modules oshine-modules allows Refle… |
CVE-2024-57971 | Critical | 9.1 | 2025-02-16 | DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning… |
CVE-2024-57970 | Medium | 4.0 | 2025-02-16 | libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles… |
CVE-2024-13834 | Medium | 5.4 | 2025-02-15 | The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Reque… |
CVE-2024-13500 | Medium | 6.5 | 2025-02-15 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL… |
CVE-2024-13488 | High | 7.5 | 2025-02-15 | The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions… |
CVE-2024-13439 | Medium | 4.3 | 2025-02-15 | The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function… |
CVE-2024-10581 | Medium | 4.3 | 2025-02-15 | The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missin… |
CVE-2024-13752 | Medium | 6.5 | 2025-02-15 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized l… |
CVE-2024-12562 | Critical | 9.8 | 2025-02-15 | The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input… |
CVE-2024-13563 | Medium | 6.4 | 2025-02-15 | The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all versions up to, and inc… |
CVE-2024-13525 | Medium | 6.5 | 2025-02-15 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9… |