2024 CVEs (page 302)
Page 302 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4236 | High | 8.8 | 2024-04-26 | A vulnerability, which was classified as critical, has been found in Tenda AX1803 1.0.0.1. This issue affects the function formSetSysToolDDNS of the file /gofo… |
CVE-2024-4235 | Low | 2.7 | 2024-04-26 | A vulnerability classified as problematic was found in Netgear DG834Gv5 1.6.01.34. This vulnerability affects unknown code of the component Web Management Inte… |
CVE-2024-33344 | Critical | 9.8 | 2024-04-26 | D-Link DIR-822+ V1.0.5 was found to contain a command injection in ftext function of upload_firmware.cgi, which allows remote attackers to execute arbitrary co… |
CVE-2024-33343 | High | 8.8 | 2024-04-26 | D-Link DIR-822+ V1.0.5 was found to contain a command injection in ChgSambaUserSettings function of prog.cgi, which allows remote attackers to execute arbitrar… |
CVE-2024-33342 | High | 7.5 | 2024-04-26 | D-Link DIR-822+ V1.0.5 was found to contain a command injection in SetPlcNetworkpwd function of prog.cgi, which allows remote attackers to execute arbitrary co… |
CVE-2024-32884 | Medium | 6.4 | 2024-04-26 | gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpr… |
CVE-2024-32880 | Critical | 9.1 | 2024-04-26 | pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the spe… |
CVE-2024-33260 | Medium | 5.1 | 2024-04-26 | Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component parser_parse_class at jerry-core/parser/js/js-parser-expr.c |
CVE-2024-33259 | Medium | 5.5 | 2024-04-26 | Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component scanner_seek at jerry-core/parser/js/js-scanner-util.c. |
CVE-2024-33258 | High | 7.1 | 2024-04-26 | Jerryscript commit ff9ff8f was discovered to contain a segmentation violation via the component vm_loop at jerry-core/vm/vm.c. |
CVE-2024-33255 | Medium | 6.2 | 2024-04-26 | Jerryscript commit cefd391 was discovered to contain an Assertion Failure via ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p) in ecma_free_string_list. |
CVE-2024-32766 | Critical | 10.0 | 2024-04-26 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2024-32764 | Critical | 9.9 | 2024-04-26 | A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users wi… |
CVE-2024-28328 | Medium | 5.4 | 2024-04-26 | CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which c… |
CVE-2024-27124 | High | 7.5 | 2024-04-26 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2024-21905 | Medium | 6.5 | 2024-04-26 | An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow… |
CVE-2024-3076 | Low | 3.8 | 2024-04-26 | The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow a… |
CVE-2024-4234 | Medium | 5.9 | 2024-04-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayful Islam Filterable Portfolio allows Stored XSS.This… |
CVE-2024-33697 | Medium | 5.9 | 2024-04-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rimes Gold CF7 File Download – File Download for CF7 allo… |
CVE-2024-33696 | Medium | 5.9 | 2024-04-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet XPRESS WordPress Ad Widget allows Stored XSS… |
CVE-2024-33695 | Medium | 5.9 | 2024-04-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode Fan Page Widget by ThemeNcode allows Stored XS… |
CVE-2024-33694 | Medium | 5.9 | 2024-04-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks ThemeForest Smart Widget allows Stored XSS.This… |
CVE-2024-33693 | Medium | 5.9 | 2024-04-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Smart Social Widget allows Stored XSS.This issu… |
CVE-2024-33692 | Medium | 5.9 | 2024-04-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Satrya Smart Recent Posts Widget allows Stored XSS.This i… |
CVE-2024-33691 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in OptinMonster Popup Builder Team OptinMonster.This issue affects OptinMonster: from n/a through 2.15.3. |
CVE-2024-33690 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Jegstudio Financio.This issue affects Financio: from n/a through 1.1.3. |
CVE-2024-33689 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station radio-station.This issue affects Radio Station: from n/a through <= 2.5.7. |
CVE-2024-33688 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Teluro.This issue affects Teluro: from n/a through 1.0.31. |
CVE-2024-32822 | Medium | 4.3 | 2024-04-26 | Missing Authorization vulnerability in impleCode Reviews Plus.This issue affects Reviews Plus: from n/a through 1.3.4. |
CVE-2024-33683 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in WP Republic Hide Dashboard Notifications.This issue affects Hide Dashboard Notifications: from n/a through 1… |
CVE-2024-33682 | Medium | 5.4 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Cookie Information A/S WP GDPR Compliance.This issue affects WP GDPR Compliance: from n/a through 2.0.23. |
CVE-2024-33680 | Medium | 5.4 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in MainWP MainWP Child Reports.This issue affects MainWP Child Reports: from n/a through 2.1.1. |
CVE-2024-33679 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in FameThemes FameTheme Demo Importer.This issue affects FameTheme Demo Importer: from n/a through 1.1.5. |
CVE-2024-33678 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection.This issue affects ClickCease Cli… |
CVE-2024-33677 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchi… |
CVE-2024-32957 | Medium | 4.7 | 2024-04-26 | Missing Authorization vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.38. |
CVE-2024-32829 | Medium | 4.3 | 2024-04-26 | Missing Authorization vulnerability in Supsystic Data Tables Generator by Supsystic.This issue affects Data Tables Generator by Supsystic: from n/a through 1.1… |
CVE-2024-32828 | Medium | 4.3 | 2024-04-26 | Missing Authorization vulnerability in Octolize Flexible Shipping.This issue affects Flexible Shipping: from n/a through 4.24.15. |
CVE-2024-32826 | Medium | 5.3 | 2024-04-26 | Missing Authorization vulnerability in Vektor,Inc. VK Block Patterns.This issue affects VK Block Patterns: from n/a through 1.31.0. |
CVE-2024-3682 | Medium | 5.3 | 2024-04-26 | The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions… |
CVE-2024-0740 | Critical | 9.8 | 2024-04-26 | Eclipse Target Management: Terminal and Remote System Explorer (RSE) version <= 4.5.400 has a remote code execution vulnerability that does not require authent… |
CVE-2024-4198 | Low | 2.7 | 2024-04-26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin… |
CVE-2024-4195 | Low | 2.7 | 2024-04-26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team ad… |
CVE-2024-4183 | Medium | 4.3 | 2024-04-26 | Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows a… |
CVE-2024-4182 | Medium | 4.3 | 2024-04-26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which al… |
CVE-2024-3962 | Critical | 9.8 | 2024-04-26 | The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload… |
CVE-2024-32046 | Medium | 4.3 | 2024-04-26 | Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the devel… |
CVE-2024-22091 | Low | 3.1 | 2024-04-26 | Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs whic… |
CVE-2024-1789 | High | 7.2 | 2024-04-26 | The WP SMTP plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in versions 1.2 to 1.2.6 due to insufficient escaping on the user su… |
CVE-2024-3890 | Medium | 6.4 | 2024-04-26 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Calendly widget in all versions up to, and including… |
CVE-2024-3678 | Medium | 5.3 | 2024-04-26 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-33651 | Medium | 5.4 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Matthew Fries MF Gig Calendar.This issue affects MF Gig Calendar : from n/a through 1.2.1. |
CVE-2024-33650 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Cryout Creations Serious Slider.This issue affects Serious Slider: from n/a through 1.2.4. |
CVE-2024-33642 | Medium | 5.9 | 2024-04-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EkoJR Advanced Post List allows Stored XSS.This issue aff… |
CVE-2024-33639 | Medium | 5.9 | 2024-04-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue affects… |
CVE-2024-33638 | Medium | 5.4 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Brijesh Kothari Smart Maintenance Mode.This issue affects Smart Maintenance Mode: from n/a through 1.4.4. |
CVE-2024-33598 | Medium | 5.9 | 2024-04-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annual Archive allows Stored XSS.This issue… |
CVE-2024-2920 | Medium | 5.3 | 2024-04-26 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin upl… |
CVE-2024-4056 | High | 7.5 | 2024-04-26 | Denial of service condition in M-Files Server in versions before 24.4.13592.4 and after 23.11 (excluding 24.2 LTS) allows unauthenticated user to consume compu… |
CVE-2024-3188 | Medium | 6.3 | 2024-04-26 | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting th… |
CVE-2024-3075 | High | 8.1 | 2024-04-26 | The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2024-3060 | Medium | 4.5 | 2024-04-26 | The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL i… |
CVE-2024-3059 | Medium | 5.7 | 2024-04-26 | The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitra… |
CVE-2024-3058 | Medium | 5.4 | 2024-04-26 | The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow a… |
CVE-2024-3048 | Medium | 5.5 | 2024-04-26 | The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting whi… |
CVE-2024-2908 | Medium | 4.3 | 2024-04-26 | The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-2837 | Medium | 5.4 | 2024-04-26 | The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perfo… |
CVE-2024-2603 | Medium | 6.3 | 2024-04-26 | The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-2439 | Medium | 4.8 | 2024-04-26 | The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Edito… |
CVE-2024-2429 | Medium | 4.3 | 2024-04-26 | The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2024-2310 | Medium | 5.9 | 2024-04-26 | The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-2159 | Medium | 4.7 | 2024-04-26 | The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2024-0905 | Medium | 6.3 | 2024-04-26 | The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-3154 | High | 7.2 | 2024-04-26 | A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation… |
CVE-2024-32406 | High | 7.5 | 2024-04-26 | Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload… |
CVE-2024-32404 | Medium | 6.0 | 2024-04-26 | Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1, allows remote attackers to execute arbitrary code via a crafted payload… |
CVE-2024-22633 | Critical | 9.8 | 2024-04-26 | Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability via the hprinter par… |
CVE-2024-22632 | Critical | 9.8 | 2024-04-26 | Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability via the hmsg paramet… |
CVE-2024-4163 | High | 8.0 | 2024-04-26 | The Skylab IGX IIoT Gateway allowed users to connect to it via a limited shell terminal (IGX). However, it was discovered that the process was running under ro… |
CVE-2024-31755 | High | 7.6 | 2024-04-26 | cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSON_SetValuestring at cJSON.c. |
CVE-2024-33673 | High | 7.8 | 2024-04-26 | An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access controls allow for DLL Hijacking in the Windows DLL Search path. |
CVE-2024-33672 | High | 7.7 | 2024-04-26 | An issue was discovered in Veritas NetBackup before 10.4. The Multi-Threaded Agent used in NetBackup can be leveraged to perform arbitrary file deletion on pro… |
CVE-2024-33671 | High | 7.7 | 2024-04-26 | An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perf… |
CVE-2024-33670 | Medium | 4.3 | 2024-04-26 | Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although th… |
CVE-2024-33669 | Medium | 6.1 | 2024-04-26 | An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which resu… |
CVE-2024-33668 | Critical | 9.1 | 2024-04-26 | An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try t… |
CVE-2024-33667 | Medium | 6.5 | 2024-04-26 | An issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack by calling an endpoint that accepts a ge… |
CVE-2024-33666 | High | 8.6 | 2024-04-26 | An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API… |
CVE-2024-33665 | Medium | 6.1 | 2024-04-26 | angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. NOTE: the vendor indicates that there is no documentatio… |
CVE-2024-33664 | Medium | 5.3 | 2024-04-26 | python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token wi… |
CVE-2024-33663 | Medium | 6.5 | 2024-04-26 | python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217. |
CVE-2024-33661 | Critical | 9.1 | 2024-04-26 | Portainer before 2.20.0 allows redirects when the target is not index.yaml. |
CVE-2024-32868 | Medium | 6.5 | 2024-04-26 | ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already give… |
CVE-2024-32651 | Critical | 10.0 | 2024-04-26 | changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Inje… |
CVE-2024-0916 | Critical | 10.0 | 2024-04-25 | Unauthenticated file upload allows remote code execution. This issue affects UvDesk Community: from 1.0.0 through 1.1.3. |
CVE-2024-3265 | Medium | 4.7 | 2024-04-25 | The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administ… |
CVE-2024-31610 | Medium | 6.3 | 2024-04-25 | File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management System v1.0 allows attackers to run arbitra… |
CVE-2024-31609 | High | 7.1 | 2024-04-25 | Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configurati… |
CVE-2024-32324 | High | 7.8 | 2024-04-25 | Buffer Overflow vulnerability in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v.3.2 allows a local attacker to execute arbitrary code via the vpn_client_… |
CVE-2024-31615 | Critical | 9.8 | 2024-04-25 | ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php. |