2024 CVEs (page 300)
Page 300 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27518 | High | 7.8 | 2024-04-29 | An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a crafted DLL file int… |
CVE-2024-33435 | Critical | 9.8 | 2024-04-29 | Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-… |
CVE-2024-33276 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a remote attacker to run arbitrary SQL commands via the PreorderMode… |
CVE-2024-33272 | Medium | 6.8 | 2024-04-29 | SQL injection vulnerability in KnowBand for PrestaShop autosuggest before 2.0.0 allows an attacker to run arbitrary SQL commands via the AutosuggestSearchModul… |
CVE-2024-33271 | High | 7.5 | 2024-04-29 | An issue in FME Modules eventsmanager before 4.4.0 allows an attacker to obtain sensitive information from the ps_customer component. |
CVE-2024-33269 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in Prestaddons flashsales 1.9.7 and before allows an attacker to run arbitrary SQL commands via the FsModel::getFlashSales method. |
CVE-2024-33268 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in Digincube mdgiftproduct before 1.4.1 allows an attacker to run arbitrary SQL commands via the MdGiftRule::addGiftToCart method. |
CVE-2024-33266 | Critical | 9.8 | 2024-04-29 | SQL Injection vulnerability in Helloshop deliveryorderautoupdate v.2.8.1 and before allows an attacker to run arbitrary SQL commands via the Deliveryorderautou… |
CVE-2024-31801 | High | 7.5 | 2024-04-29 | Directory Traversal vulnerability in NEXSYS-ONE before v.Rev.15320 allows a remote attacker to obtain sensitive information via a crafted request. |
CVE-2024-31747 | Low | 2.1 | 2024-04-29 | An issue in Yealink VP59 Microsoft Teams Phone firmware 91.15.0.118 (fixed in 122.15.0.142) allows a physically proximate attacker to disable the phone lock vi… |
CVE-2024-0840 | High | 8.8 | 2024-04-29 | The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and auth… |
CVE-2024-33443 | High | 7.1 | 2024-04-29 | An issue in onethink v.1.1 allows a remote attacker to execute arbitrary code via a crafted script to the AddonsController.class.php component. |
CVE-2024-33438 | High | 8.0 | 2024-04-29 | File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file. |
CVE-2024-33345 | Medium | 6.5 | 2024-04-29 | D-Link DIR-823G A1V1.0.2B05 was found to contain a Null-pointer dereference in the main function of upload_firmware.cgi, which allows remote attackers to cause… |
CVE-2024-33338 | High | 7.3 | 2024-04-29 | Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request. |
CVE-2024-31823 | High | 8.8 | 2024-04-29 | An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the remov… |
CVE-2024-31822 | Critical | 9.8 | 2024-04-29 | An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the saveL… |
CVE-2024-31821 | High | 8.0 | 2024-04-29 | SQL Injection vulnerability in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary… |
CVE-2024-31820 | Critical | 9.8 | 2024-04-29 | An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the getLa… |
CVE-2024-31705 | Critical | 9.8 | 2024-04-29 | An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input. |
CVE-2024-28320 | High | 7.6 | 2024-04-29 | Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to manipulate user parameters for unauthorized access… |
CVE-2024-33449 | Critical | 9.8 | 2024-04-29 | An SSRF issue in the PDFMyURL service allows a remote attacker to obtain sensitive information and execute arbitrary code via a POST request in the url paramet… |
CVE-2024-33445 | Critical | 9.8 | 2024-04-29 | An issue in hisiphp v2.0.111 allows a remote attacker to execute arbitrary code via a crafted script to the SystemPlugins::mkInfo parameter in the SystemPlugin… |
CVE-2024-33444 | Critical | 9.8 | 2024-04-29 | SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component. |
CVE-2024-32493 | High | 8.8 | 2024-04-29 | An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able to inject SQL in the draft form ID para… |
CVE-2024-32492 | High | 7.1 | 2024-04-29 | An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript. |
CVE-2024-32491 | Critical | 9.8 | 2024-04-29 | An issue was discovered in Znuny and Znuny LTS 6.0.31 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in user can upload a file (via a manipulated… |
CVE-2024-32269 | High | 7.5 | 2024-04-29 | An issue in Yonganda YAD-LOJ V3.0.561 allows a remote attacker to cause a denial of service via a crafted packet. |
CVE-2024-31621 | High | 7.6 | 2024-04-29 | An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component. |
CVE-2024-34020 | Medium | 6.5 | 2024-04-29 | A stack-based buffer overflow was found in the putSDN() function of mail.c in hcode through 2.1. |
CVE-2024-34011 | Medium | 6.8 | 2024-04-29 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 37… |
CVE-2024-34010 | High | 8.2 | 2024-04-29 | Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before b… |
CVE-2024-32268 | Low | 3.3 | 2024-04-29 | An issue in Tuya Smart camera U6N v.3.2.5 allows a remote attacker to cause a denial of service via a crafted packet to the network connection component. |
CVE-2024-23995 | Medium | 6.1 | 2024-04-29 | Cross Site Scripting (XSS) in Beekeeper Studio 4.1.13 and earlier allows remote attackers to execute arbitrary code in the column name of a database table in t… |
CVE-2024-1969 | High | 8.2 | 2024-04-29 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.Thi… |
CVE-2024-1579 | High | 8.1 | 2024-04-29 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue… |
CVE-2024-4310 | Medium | 6.3 | 2024-04-29 | Cross-site Scripting (XSS) vulnerability in HubBank affecting version 1.0.2. This vulnerability allows an attacker to send a specially crafted JavaScript paylo… |
CVE-2024-4309 | High | 8.1 | 2024-04-29 | SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the databas… |
CVE-2024-4308 | High | 8.1 | 2024-04-29 | SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the databas… |
CVE-2024-4307 | High | 8.1 | 2024-04-29 | SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the databas… |
CVE-2024-33588 | Medium | 5.4 | 2024-04-29 | Missing Authorization vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki… |
CVE-2024-33587 | Medium | 5.3 | 2024-04-29 | Missing Authorization vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking.This issue affects Secure Copy Content P… |
CVE-2024-33586 | Medium | 5.3 | 2024-04-29 | Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.20. |
CVE-2024-33585 | Medium | 4.3 | 2024-04-29 | Missing Authorization vulnerability in Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce.This issue affects Payment Gateway Based Fees a… |
CVE-2024-27322 | High | 8.8 | 2024-04-29 | Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling… |
CVE-2024-4306 | Critical | 9.9 | 2024-04-29 | Critical unrestricted file upload vulnerability in HubBank affecting version 1.0.2. This vulnerability allows a registered user to upload malicious PHP files v… |
CVE-2024-4304 | Medium | 5.4 | 2024-04-29 | A Cross-Site Scripting XSS vulnerability has been detected on GT3 Soluciones SWAL. This vulnerability consists in a reflected XSS in the Titular parameter ins… |
CVE-2024-33590 | Medium | 5.0 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documen… |
CVE-2024-33589 | Medium | 6.5 | 2024-04-29 | Missing Authorization vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.6.0. |
CVE-2024-33595 | Medium | 4.3 | 2024-04-29 | Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1. |
CVE-2024-33594 | High | 7.5 | 2024-04-29 | Missing Authorization vulnerability in Leaky Paywall.This issue affects Leaky Paywall: from n/a through 4.20.8. |
CVE-2024-33593 | Medium | 4.3 | 2024-04-29 | Missing Authorization vulnerability in RedNao Smart Forms.This issue affects Smart Forms: from n/a through 2.6.91. |
CVE-2024-33591 | High | 7.5 | 2024-04-29 | Missing Authorization vulnerability in Tips and Tricks HQ Easy Accept Payments.This issue affects Easy Accept Payments: from n/a through 4.9.10. |
CVE-2024-3375 | Critical | 9.4 | 2024-04-29 | Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs. … |
CVE-2024-33684 | Medium | 6.5 | 2024-04-29 | Missing Authorization vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a th… |
CVE-2024-33636 | Medium | 5.4 | 2024-04-29 | Missing Authorization vulnerability in Mahesh Vora WP Page Post Widget Clone.This issue affects WP Page Post Widget Clone: from n/a through 1.0.1. |
CVE-2024-33635 | High | 7.5 | 2024-04-29 | Missing Authorization vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17. |
CVE-2024-33597 | High | 7.5 | 2024-04-29 | Missing Authorization vulnerability in ProFaceOff SSU.This issue affects SSU: from n/a through 1.5.0. |
CVE-2024-33596 | Medium | 5.3 | 2024-04-29 | Missing Authorization vulnerability in Five Star Plugins Five Star Restaurant Reservations.This issue affects Five Star Restaurant Reservations: from n/a throu… |
CVE-2024-33558 | Medium | 6.5 | 2024-04-29 | Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5. |
CVE-2024-28961 | Medium | 6.3 | 2024-04-29 | Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged malicious user could po… |
CVE-2024-33652 | Medium | 5.3 | 2024-04-29 | Missing Authorization vulnerability in Real Big Plugins Client Dash.This issue affects Client Dash: from n/a through 2.2.1. |
CVE-2024-33641 | Medium | 5.4 | 2024-04-29 | Deserialization of Untrusted Data vulnerability in Team Yoast Custom field finder.This issue affects Custom field finder: from n/a through 0.3. |
CVE-2024-33637 | High | 7.5 | 2024-04-29 | Insertion of Sensitive Information into Log File vulnerability in Solid Plugins Solid Affiliate.This issue affects Solid Affiliate: from n/a through 1.9.1. |
CVE-2024-33634 | Medium | 5.4 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a thro… |
CVE-2024-33629 | Medium | 4.4 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail).This issue affects Auto Featured Image (Auto Post… |
CVE-2024-33627 | Medium | 4.4 | 2024-04-29 | Server-Side Request Forgery (SSRF) vulnerability in Cusmin Absolutely Glamorous Custom Admin.This issue affects Absolutely Glamorous Custom Admin: from n/a thr… |
CVE-2024-33584 | Medium | 4.7 | 2024-04-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Deepen Bajracharya Video Conferencing with Zoom.This issue affects Video Conferencing with… |
CVE-2024-33575 | Medium | 5.3 | 2024-04-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0. |
CVE-2024-33566 | Critical | 10.0 | 2024-04-29 | Missing Authorization vulnerability in N-Media OrderConvo allows OS Command Injection.This issue affects OrderConvo: from n/a through 12.4. |
CVE-2024-33553 | Critical | 9.0 | 2024-04-29 | Deserialization of Untrusted Data vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5. |
CVE-2024-33538 | Medium | 5.3 | 2024-04-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Fastline Media LLC Assistant – Every Day Productivity Apps.This issue affects Assis… |
CVE-2024-3196 | Medium | 6.7 | 2024-04-29 | A vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Services_silentDu… |
CVE-2024-3195 | Medium | 4.7 | 2024-04-29 | A vulnerability was found in MailCleaner up to 2023.03.14. It has been classified as critical. This affects an unknown part of the component Admin Endpoints. T… |
CVE-2024-3194 | Medium | 4.3 | 2024-04-29 | A vulnerability was found in MailCleaner up to 2023.03.14 and classified as problematic. Affected by this issue is some unknown functionality of the component… |
CVE-2024-3193 | High | 8.8 | 2024-04-29 | A vulnerability has been found in MailCleaner up to 2023.03.14 and classified as critical. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2024-3192 | Medium | 4.3 | 2024-04-29 | A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interfa… |
CVE-2024-3191 | Critical | 9.8 | 2024-04-29 | A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component… |
CVE-2024-33546 | Critical | 9.6 | 2024-04-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone allows SQL Injection.This issue affects WZo… |
CVE-2024-33544 | Critical | 9.3 | 2024-04-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone allows SQL Injection.This issue affects WZo… |
CVE-2024-4303 | High | 8.8 | 2024-04-29 | ArmorX Android APP's multi-factor authentication (MFA) for the login function is not properly implemented. Remote attackers who obtain user credentials can byp… |
CVE-2024-4302 | Medium | 6.1 | 2024-04-29 | Super 8 Live Chat online customer service platform fails to properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code int… |
CVE-2024-33905 | Medium | 4.6 | 2024-04-29 | In Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type. |
CVE-2024-33904 | High | 7.0 | 2024-04-29 | In plugins/HookSystem.cpp in Hyprland through 0.39.1 (before 28c8561), through a race condition, a local attacker can cause execution of arbitrary assembly cod… |
CVE-2024-33686 | Medium | 4.3 | 2024-04-29 | Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Ex… |
CVE-2024-33681 | High | 7.1 | 2024-04-29 | Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Regenerate post permalink allows Cross-Site Scripting (XSS).This issue affects Regenerate post… |
CVE-2024-33632 | Medium | 5.4 | 2024-04-29 | Cross-Site Request Forgery (CSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a throu… |
CVE-2024-33631 | Medium | 6.5 | 2024-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor Pro allows Stored XS… |
CVE-2024-33630 | Medium | 6.5 | 2024-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor allows Stored XSS.Th… |
CVE-2024-33571 | High | 7.1 | 2024-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak.This iss… |
CVE-2024-33562 | High | 7.1 | 2024-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore allows Reflected XSS.This issue affects XSt… |
CVE-2024-33559 | Critical | 9.3 | 2024-04-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XSt… |
CVE-2024-33554 | High | 7.1 | 2024-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core allows Reflected XSS.This issue affect… |
CVE-2024-33551 | Critical | 9.3 | 2024-04-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore Core allows SQL Injection.This issue affect… |
CVE-2024-33548 | High | 7.1 | 2024-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team WZone allows Reflected XSS.This issue affects WZo… |
CVE-2024-33542 | Medium | 4.3 | 2024-04-29 | Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5. |
CVE-2024-33540 | Medium | 6.5 | 2024-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill ColorNews allows Stored XSS.This issue affects… |
CVE-2024-33539 | Medium | 6.5 | 2024-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor (Templates, Widgets) a… |
CVE-2024-33537 | Medium | 6.5 | 2024-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Horse WP Portfolio allows Stored XSS.This issue aff… |
CVE-2024-2505 | High | 8.1 | 2024-04-29 | The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate req… |