2024 CVEs (page 300)
Page 300 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2378 | High | 8.0 | 2024-04-30 | A vulnerability exists in the web-authentication component of the SDM600. If exploited an attacker could escalate privileges on af-fected installations. |
CVE-2024-2377 | High | 7.6 | 2024-04-30 | A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry… |
CVE-2024-4337 | High | 7.6 | 2024-04-30 | Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/a… |
CVE-2024-4336 | High | 7.6 | 2024-04-30 | Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/a… |
CVE-2024-22405 | Medium | 5.5 | 2024-04-30 | XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply qu… |
CVE-2024-4185 | High | 8.1 | 2024-04-30 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and i… |
CVE-2024-3072 | Medium | 4.3 | 2024-04-30 | The ACF Front End Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_texts() functi… |
CVE-2024-2663 | High | 8.3 | 2024-04-30 | The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $_GET['image']… |
CVE-2024-1895 | High | 7.5 | 2024-04-30 | The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc… |
CVE-2024-4225 | High | 7.6 | 2024-04-30 | Multiple security vulnerabilities has been discovered in web interface of NetGuardian DIN Remote Telemetry Unit (RTU), by DPS Telecom. Attackers can exploit th… |
CVE-2024-31837 | High | 8.4 | 2024-04-30 | DMitry (Deepmagic Information Gathering Tool) 1.3a has a format-string vulnerability, with a threat model similar to CVE-2017-7938. |
CVE-2024-1371 | Medium | 6.5 | 2024-04-30 | The LeadConnector plugin for WordPress is vulnerable to unauthorized modification & loss of data due to a missing capability check on the lc_public_api_proxy()… |
CVE-2024-4226 | Low | 3.5 | 2024-04-30 | It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This fu… |
CVE-2024-0216 | Medium | 6.4 | 2024-04-30 | The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. Th… |
CVE-2024-4327 | Low | 3.5 | 2024-04-30 | A vulnerability was found in Apryse WebViewer up to 10.8.0. It has been classified as problematic. This affects an unknown part of the component PDF Document H… |
CVE-2024-34050 | High | 7.5 | 2024-04-30 | Open Networking Foundation SD-RAN Rimedo rimedo-ts 0.1.1 has a slice bounds out-of-range panic in "return uint64(b[2])<<16 | uint64(b[1])<<8 | uint64(b[0])" in… |
CVE-2024-34049 | High | 7.5 | 2024-04-30 | Open Networking Foundation SD-RAN Rimedo rimedo-ts 0.1.1 has a slice bounds out-of-range panic in "return plmnIdString[0:3], plmnIdString[3:]" in reader.go. |
CVE-2024-34048 | Critical | 9.8 | 2024-04-30 | O-RAN RIC I-Release e2mgr lacks array size checks in E2nodeConfigUpdateNotificationHandler. |
CVE-2024-34047 | Medium | 4.3 | 2024-04-30 | O-RAN RIC I-Release e2mgr lacks array size checks in RicServiceUpdateHandler. |
CVE-2024-34046 | High | 7.5 | 2024-04-30 | The O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->sctpParams->e2tCounters[IN_SUCC][MSG_COUNTER][Pr… |
CVE-2024-34045 | High | 7.5 | 2024-04-30 | The O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->counters[IN_INITI][MSG_COUNTER][ProcedureCode_id… |
CVE-2024-34044 | Medium | 5.3 | 2024-04-30 | The O-RAN E2T I-Release buildPrometheusList function can have a NULL pointer dereference because peerInfo can be NULL. |
CVE-2024-34043 | Medium | 5.3 | 2024-04-30 | O-RAN RICAPP kpimon-go I-Release has a segmentation violation via a certain E2AP-PDU message. |
CVE-2024-33522 | Medium | 6.7 | 2024-04-29 | In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attac… |
CVE-2024-33401 | Medium | 4.4 | 2024-04-29 | Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to run arbitrary code via the mnum parameter. |
CVE-2024-33350 | Critical | 9.8 | 2024-04-29 | Directory Traversal vulnerability in TaoCMS v.3.0.2 allows a remote attacker to execute arbitrary code and obtain sensitive information via the include/model/f… |
CVE-2024-28294 | Medium | 6.5 | 2024-04-29 | Limbas up to v5.2.14 was discovered to contain a SQL injection vulnerability via the ftid parameter. |
CVE-2024-27518 | High | 7.8 | 2024-04-29 | An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a crafted DLL file int… |
CVE-2024-33435 | Critical | 9.8 | 2024-04-29 | Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-… |
CVE-2024-33276 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a remote attacker to run arbitrary SQL commands via the PreorderMode… |
CVE-2024-33272 | Medium | 6.8 | 2024-04-29 | SQL injection vulnerability in KnowBand for PrestaShop autosuggest before 2.0.0 allows an attacker to run arbitrary SQL commands via the AutosuggestSearchModul… |
CVE-2024-33271 | High | 7.5 | 2024-04-29 | An issue in FME Modules eventsmanager before 4.4.0 allows an attacker to obtain sensitive information from the ps_customer component. |
CVE-2024-33269 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in Prestaddons flashsales 1.9.7 and before allows an attacker to run arbitrary SQL commands via the FsModel::getFlashSales method. |
CVE-2024-33268 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in Digincube mdgiftproduct before 1.4.1 allows an attacker to run arbitrary SQL commands via the MdGiftRule::addGiftToCart method. |
CVE-2024-33266 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in Helloshop deliveryorderautoupdate v.2.8.1 and before allows an attacker to run arbitrary SQL commands via the Deliveryorderautou… |
CVE-2024-31801 | High | 7.5 | 2024-04-29 | Directory Traversal vulnerability in NEXSYS-ONE before v.Rev.15320 allows a remote attacker to obtain sensitive information via a crafted request. |
CVE-2024-31747 | Low | 2.1 | 2024-04-29 | An issue in Yealink VP59 Microsoft Teams Phone firmware 91.15.0.118 (fixed in 122.15.0.142) allows a physically proximate attacker to disable the phone lock vi… |
CVE-2024-0840 | High | 8.8 | 2024-04-29 | The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and auth… |
CVE-2024-33443 | High | 7.1 | 2024-04-29 | An issue in onethink v.1.1 allows a remote attacker to execute arbitrary code via a crafted script to the AddonsController.class.php component. |
CVE-2024-33438 | High | 8.0 | 2024-04-29 | File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file. |
CVE-2024-33345 | Medium | 6.5 | 2024-04-29 | D-Link DIR-823G A1V1.0.2B05 was found to contain a Null-pointer dereference in the main function of upload_firmware.cgi, which allows remote attackers to cause… |
CVE-2024-33338 | High | 7.3 | 2024-04-29 | Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request. |
CVE-2024-31823 | Critical | 9.8 | 2024-04-29 | An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the remov… |
CVE-2024-31822 | Critical | 9.8 | 2024-04-29 | An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the saveL… |
CVE-2024-31821 | High | 8.0 | 2024-04-29 | SQL Injection vulnerability in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary… |
CVE-2024-31820 | Critical | 9.8 | 2024-04-29 | An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the getLa… |
CVE-2024-31705 | Critical | 9.8 | 2024-04-29 | An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input. |
CVE-2024-28320 | High | 7.6 | 2024-04-29 | Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to manipulate user parameters for unauthorized access… |
CVE-2024-33449 | Critical | 9.8 | 2024-04-29 | An SSRF issue in the PDFMyURL service allows a remote attacker to obtain sensitive information and execute arbitrary code via a POST request in the url paramet… |
CVE-2024-33445 | Critical | 9.8 | 2024-04-29 | An issue in hisiphp v2.0.111 allows a remote attacker to execute arbitrary code via a crafted script to the SystemPlugins::mkInfo parameter in the SystemPlugin… |
CVE-2024-33444 | Critical | 9.8 | 2024-04-29 | SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component. |
CVE-2024-32493 | High | 8.8 | 2024-04-29 | An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able to inject SQL in the draft form ID para… |
CVE-2024-32492 | High | 7.1 | 2024-04-29 | An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript. |
CVE-2024-32491 | Critical | 9.8 | 2024-04-29 | An issue was discovered in Znuny and Znuny LTS 6.0.31 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in user can upload a file (via a manipulated… |
CVE-2024-32269 | High | 7.5 | 2024-04-29 | An issue in Yonganda YAD-LOJ V3.0.561 allows a remote attacker to cause a denial of service via a crafted packet. |
CVE-2024-31621 | High | 7.6 | 2024-04-29 | An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component. |
CVE-2024-34020 | Medium | 6.5 | 2024-04-29 | A stack-based buffer overflow was found in the putSDN() function of mail.c in hcode through 2.1. |
CVE-2024-34011 | Medium | 6.8 | 2024-04-29 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 37… |
CVE-2024-34010 | High | 8.2 | 2024-04-29 | Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before b… |
CVE-2024-32268 | Low | 3.3 | 2024-04-29 | An issue in Tuya Smart camera U6N v.3.2.5 allows a remote attacker to cause a denial of service via a crafted packet to the network connection component. |
CVE-2024-23995 | Medium | 6.1 | 2024-04-29 | Cross Site Scripting (XSS) in Beekeeper Studio 4.1.13 and earlier allows remote attackers to execute arbitrary code in the column name of a database table in t… |
CVE-2024-1969 | High | 8.2 | 2024-04-29 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.Thi… |
CVE-2024-1579 | High | 8.1 | 2024-04-29 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue… |
CVE-2024-4310 | Medium | 6.3 | 2024-04-29 | Cross-site Scripting (XSS) vulnerability in HubBank affecting version 1.0.2. This vulnerability allows an attacker to send a specially crafted JavaScript paylo… |
CVE-2024-4309 | High | 8.1 | 2024-04-29 | SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the databas… |
CVE-2024-4308 | High | 8.1 | 2024-04-29 | SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the databas… |
CVE-2024-4307 | High | 8.1 | 2024-04-29 | SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the databas… |
CVE-2024-33588 | Medium | 5.4 | 2024-04-29 | Missing Authorization vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki… |
CVE-2024-33587 | Medium | 5.3 | 2024-04-29 | Missing Authorization vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking.This issue affects Secure Copy Content P… |
CVE-2024-33586 | Medium | 5.3 | 2024-04-29 | Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.20. |
CVE-2024-33585 | Medium | 4.3 | 2024-04-29 | Missing Authorization vulnerability in Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce.This issue affects Payment Gateway Based Fees a… |
CVE-2024-27322 | High | 8.8 | 2024-04-29 | Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling… |
CVE-2024-4306 | Critical | 9.9 | 2024-04-29 | Critical unrestricted file upload vulnerability in HubBank affecting version 1.0.2. This vulnerability allows a registered user to upload malicious PHP files v… |
CVE-2024-4304 | Medium | 5.4 | 2024-04-29 | A Cross-Site Scripting XSS vulnerability has been detected on GT3 Soluciones SWAL. This vulnerability consists in a reflected XSS in the Titular parameter ins… |
CVE-2024-33590 | Medium | 5.0 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documen… |
CVE-2024-33589 | Medium | 6.5 | 2024-04-29 | Missing Authorization vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.6.0. |
CVE-2024-33595 | Medium | 4.3 | 2024-04-29 | Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1. |
CVE-2024-33594 | High | 7.5 | 2024-04-29 | Missing Authorization vulnerability in Leaky Paywall.This issue affects Leaky Paywall: from n/a through 4.20.8. |
CVE-2024-33593 | Medium | 4.3 | 2024-04-29 | Missing Authorization vulnerability in RedNao Smart Forms.This issue affects Smart Forms: from n/a through 2.6.91. |
CVE-2024-33591 | High | 7.5 | 2024-04-29 | Missing Authorization vulnerability in Tips and Tricks HQ Easy Accept Payments.This issue affects Easy Accept Payments: from n/a through 4.9.10. |
CVE-2024-3375 | Critical | 9.4 | 2024-04-29 | Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs. … |
CVE-2024-33684 | Medium | 6.5 | 2024-04-29 | Missing Authorization vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a th… |
CVE-2024-33636 | Medium | 5.4 | 2024-04-29 | Missing Authorization vulnerability in Mahesh Vora WP Page Post Widget Clone.This issue affects WP Page Post Widget Clone: from n/a through 1.0.1. |
CVE-2024-33635 | High | 7.5 | 2024-04-29 | Missing Authorization vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17. |
CVE-2024-33597 | High | 7.5 | 2024-04-29 | Missing Authorization vulnerability in ProFaceOff SSU.This issue affects SSU: from n/a through 1.5.0. |
CVE-2024-33596 | Medium | 5.3 | 2024-04-29 | Missing Authorization vulnerability in Five Star Plugins Five Star Restaurant Reservations.This issue affects Five Star Restaurant Reservations: from n/a throu… |
CVE-2024-33558 | Medium | 6.5 | 2024-04-29 | Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5. |
CVE-2024-28961 | Medium | 6.3 | 2024-04-29 | Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged malicious user could po… |
CVE-2024-33652 | Medium | 5.3 | 2024-04-29 | Missing Authorization vulnerability in Real Big Plugins Client Dash.This issue affects Client Dash: from n/a through 2.2.1. |
CVE-2024-33641 | Medium | 5.4 | 2024-04-29 | Deserialization of Untrusted Data vulnerability in Team Yoast Custom field finder.This issue affects Custom field finder: from n/a through 0.3. |
CVE-2024-33637 | High | 7.5 | 2024-04-29 | Insertion of Sensitive Information into Log File vulnerability in Solid Plugins Solid Affiliate.This issue affects Solid Affiliate: from n/a through 1.9.1. |
CVE-2024-33634 | Medium | 5.4 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a thro… |
CVE-2024-33629 | Medium | 4.4 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail).This issue affects Auto Featured Image (Auto Post… |
CVE-2024-33627 | Medium | 4.4 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in Cusmin Absolutely Glamorous Custom Admin.This issue affects Absolutely Glamorous Custom Admin: from n/a thr… |
CVE-2024-33584 | Medium | 4.7 | 2024-04-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Deepen Bajracharya Video Conferencing with Zoom.This issue affects Video Conferencing with… |
CVE-2024-33575 | Medium | 5.3 | 2024-04-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0. |
CVE-2024-33566 | Critical | 10.0 | 2024-04-29 | Missing Authorization vulnerability in N-Media OrderConvo allows OS Command Injection.This issue affects OrderConvo: from n/a through 12.4. |
CVE-2024-33553 | Critical | 9.0 | 2024-04-29 | Deserialization of Untrusted Data vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5. |
CVE-2024-33538 | Medium | 5.3 | 2024-04-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Fastline Media LLC Assistant – Every Day Productivity Apps.This issue affects Assis… |
CVE-2024-3196 | Medium | 6.7 | 2024-04-29 | A vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Services_silentDu… |