2024 CVEs (page 304)
Page 304 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-32772 | Medium | 4.3 | 2024-04-24 | Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9. |
CVE-2024-32711 | Medium | 6.5 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from… |
CVE-2024-32707 | Medium | 5.9 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget allows Stored XSS.This issue… |
CVE-2024-32702 | High | 7.1 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARFo… |
CVE-2024-32723 | Medium | 6.5 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Tides Advanced Floating Content allows Stored XSS.Th… |
CVE-2024-32722 | Medium | 5.9 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Coupon & Discount Code Reveal Button allows Stored XSS.Th… |
CVE-2024-32721 | Medium | 6.5 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jegtheme Jeg Elementor Kit allows Stored XSS.This issue a… |
CVE-2024-32956 | Medium | 6.5 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affec… |
CVE-2024-32952 | High | 7.1 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BloomPixel Max Addons Pro for Bricks allows Reflected XSS… |
CVE-2024-32950 | High | 7.1 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeBAAT WP Media Category Management allows Reflected XSS… |
CVE-2024-32834 | Medium | 5.9 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce Shipping Label allows Stored XSS.Th… |
CVE-2024-32833 | Medium | 5.9 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Halsey List Custom Taxonomy Widget allows Stored XSS… |
CVE-2024-32815 | Medium | 5.9 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters All-in-one Like Widget all-in-one-facebook-… |
CVE-2024-32801 | Medium | 5.9 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin Widget Post Slider allows Stored XSS.This is… |
CVE-2024-32791 | Medium | 6.5 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-el… |
CVE-2024-32706 | High | 8.5 | 2024-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARFo… |
CVE-2024-32953 | High | 7.5 | 2024-04-24 | Insertion of Sensitive Information into Log File vulnerability in Newsletters.This issue affects Newsletters: from n/a through 4.9.5. |
CVE-2024-32836 | Critical | 9.1 | 2024-04-24 | Unrestricted Upload of File with Dangerous Type vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay.This issue affects WP-Lister Lite for eBay… |
CVE-2024-32835 | Medium | 5.4 | 2024-04-24 | Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2… |
CVE-2024-32825 | High | 7.5 | 2024-04-24 | Insertion of Sensitive Information Into Sent Data vulnerability in Simply Static Simply Static simply-static.This issue affects Simply Static: from n/a through… |
CVE-2024-32817 | Medium | 4.4 | 2024-04-24 | Deserialization of Untrusted Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Impor… |
CVE-2024-32816 | High | 7.5 | 2024-04-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid.This issue affects Post Grid: from n/a through 2.2.78. |
CVE-2024-32812 | Medium | 5.4 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.11. |
CVE-2024-32803 | Medium | 6.4 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in 2day.Sk, Webikon SuperFaktura WooCommerce.This issue affects SuperFaktura WooCommerce: from n/a through 1.4… |
CVE-2024-32796 | Medium | 4.3 | 2024-04-24 | Insertion of Sensitive Information Into Sent Data vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2024-32788 | Medium | 5.3 | 2024-04-24 | Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Joomla to WordPress.This issue affects FG Joomla to WordPress: from n/a th… |
CVE-2024-32782 | Medium | 4.3 | 2024-04-24 | Insertion of Sensitive Information Into Sent Data vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.4.7. |
CVE-2024-32781 | High | 7.5 | 2024-04-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeHigh Email Customizer for WooCommerce.This issue affects Email Customizer for… |
CVE-2024-32780 | Medium | 5.9 | 2024-04-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in E4J s.R.L. VikRentCar.This issue affects VikRentCar: from n/a through 1.3.2. |
CVE-2024-32775 | Medium | 4.9 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Pavex Embed Google Photos album.This issue affects Embed Google Photos album: from n/a through 2.1.9. |
CVE-2024-32726 | High | 7.5 | 2024-04-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in vinoth06. Frontend Dashboard.This issue affects Frontend Dashboard: from n/a throug… |
CVE-2024-32718 | Medium | 4.9 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Webangon The Pack Elementor.This issue affects The Pack Elementor addons: from n/a through 2.0.8.2. |
CVE-2024-32716 | Medium | 5.3 | 2024-04-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StreamWeasels StreamWeasels Twitch Integration.This issue affects StreamWeasels Twi… |
CVE-2024-32710 | High | 8.5 | 2024-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: fr… |
CVE-2024-32709 | Critical | 9.3 | 2024-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: fr… |
CVE-2024-28977 | Low | 3.3 | 2024-04-24 | Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. A local attacker with low privileges could pote… |
CVE-2024-28976 | High | 8.8 | 2024-04-24 | Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially… |
CVE-2024-28963 | Medium | 6.2 | 2024-04-24 | Telemetry Dashboard v1.0.0.7 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability. An unauthenticated user with local access to the d… |
CVE-2024-32955 | Medium | 4.9 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5… |
CVE-2024-32951 | Medium | 6.5 | 2024-04-24 | Missing Authorization vulnerability in BloomPixel Max Addons Pro for Bricks.This issue affects Max Addons Pro for Bricks: from n/a through 1.6.1. |
CVE-2024-32948 | Critical | 9.1 | 2024-04-24 | Missing Authorization vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.28. |
CVE-2024-32819 | Medium | 4.9 | 2024-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Culqi.This issue affects Culqi: from n/a through 3.0.14. |
CVE-2024-33531 | High | 8.1 | 2024-04-24 | cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM. |
CVE-2024-32051 | Medium | 6.5 | 2024-04-24 | Insertion of sensitive information into log file issue exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a network-adjacent unauthent… |
CVE-2024-31406 | High | 8.8 | 2024-04-24 | Active debug code vulnerability exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a network-adjacent unauthenticated attacker with ac… |
CVE-2024-3261 | Medium | 4.8 | 2024-04-24 | The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post… |
CVE-2024-2972 | Low | 3.8 | 2024-04-24 | The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not… |
CVE-2024-2404 | Medium | 5.4 | 2024-04-24 | The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users such as Subscribers… |
CVE-2024-2402 | Medium | 5.4 | 2024-04-24 | The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-1756 | Medium | 6.5 | 2024-04-24 | The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such a… |
CVE-2024-1743 | Medium | 5.9 | 2024-04-24 | The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attribu… |
CVE-2024-28613 | Critical | 9.8 | 2024-04-24 | SQL Injection vulnerability in PHP Task Management System v.1.0 allows a remote attacker to escalate privileges and obtain sensitive information via the task_i… |
CVE-2024-4093 | Medium | 6.3 | 2024-04-24 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file vie… |
CVE-2024-4075 | Low | 3.5 | 2024-04-23 | A vulnerability classified as problematic has been found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. This affects an unknown part of the file… |
CVE-2024-4074 | Low | 3.5 | 2024-04-23 | A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been rated as problematic. Affected by this issue is some unknow… |
CVE-2024-4073 | Low | 3.5 | 2024-04-23 | A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been declared as problematic. Affected by this vulnerability is… |
CVE-2024-4072 | Low | 3.5 | 2024-04-23 | A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been classified as problematic. Affected is an unknown function… |
CVE-2024-4071 | Medium | 6.3 | 2024-04-23 | A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0 and classified as critical. This issue affects some unknown processing o… |
CVE-2024-4070 | Medium | 6.3 | 2024-04-23 | A vulnerability has been found in Kashipara Online Furniture Shopping Ecommerce Website 1.0 and classified as critical. This vulnerability affects unknown code… |
CVE-2024-4069 | Medium | 6.3 | 2024-04-23 | A vulnerability, which was classified as critical, was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. This affects an unknown part of the… |
CVE-2024-31616 | High | 8.8 | 2024-04-23 | An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2, Release(07150910) allows attack… |
CVE-2024-30886 | Medium | 5.4 | 2024-04-23 | A stored cross-site scripting (XSS) vulnerability in the remotelink function of HadSky v7.6.3 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2024-4066 | High | 8.8 | 2024-04-23 | A vulnerability classified as critical has been found in Tenda AC8 16.03.34.09. Affected is the function fromAdvSetMacMtuWan of the file /goform/AdvSetMacMtuWa… |
CVE-2024-32875 | Medium | 6.1 | 2024-04-23 | Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in inte… |
CVE-2024-32869 | Medium | 5.3 | 2024-04-23 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible… |
CVE-2024-32866 | High | 8.6 | 2024-04-23 | Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this… |
CVE-2024-32662 | High | 7.5 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs… |
CVE-2024-4065 | High | 8.8 | 2024-04-23 | A vulnerability was found in Tenda AC8 16.03.34.09. It has been rated as critical. This issue affects the function formSetRebootTimer of the file /goform/SetRe… |
CVE-2024-4064 | High | 8.8 | 2024-04-23 | A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. This vulnerability affects the function R7WebsSecurityHandler of the file… |
CVE-2024-32661 | High | 7.5 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access and cr… |
CVE-2024-32660 | High | 7.5 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid hug… |
CVE-2024-32659 | Critical | 9.8 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth… |
CVE-2024-4063 | Low | 3.7 | 2024-04-23 | A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build 170628. It has been classified as problematic. This affects an unknown part of the component Davin… |
CVE-2024-4062 | Low | 3.7 | 2024-04-23 | A vulnerability was found in Hualai Xiaofang iSC5 3.2.2_112 and classified as problematic. Affected by this issue is some unknown functionality. The manipulati… |
CVE-2024-32658 | Critical | 9.8 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5… |
CVE-2024-32482 | Low | 2.2 | 2024-04-23 | The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’… |
CVE-2024-31208 | Medium | 6.5 | 2024-04-23 | Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch spe… |
CVE-2024-21979 | Medium | 5.3 | 2024-04-23 | An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed shader to potentia… |
CVE-2024-21972 | Medium | 5.3 | 2024-04-23 | An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed shader to potentia… |
CVE-2024-32258 | High | 8.8 | 2024-04-23 | The network server of fceux 2.7.0 has a path traversal vulnerability, allowing attackers to overwrite any files on the server without authentication by fake RO… |
CVE-2024-33217 | High | 7.5 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter in ip/goform/addressNat. |
CVE-2024-33215 | Critical | 9.8 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/addressNat. |
CVE-2024-33214 | High | 7.5 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter in ip/goform/RouteStatic. |
CVE-2024-33213 | Medium | 6.5 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/RouteStatic. |
CVE-2024-33212 | High | 8.8 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter in ip/goform/setcfm. |
CVE-2024-33211 | High | 7.3 | 2024-04-23 | Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the PPPOEPassword parameter in ip/goform/QuickIndex. |
CVE-2024-32679 | Medium | 5.3 | 2024-04-23 | Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.16. |
CVE-2024-31804 | Medium | 6.7 | 2024-04-23 | An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privileges via the Program.exe component. |
CVE-2024-28130 | High | 7.5 | 2024-04-23 | An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malform… |
CVE-2024-2477 | Medium | 6.4 | 2024-04-23 | The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all versions up to, and… |
CVE-2024-28627 | High | 7.5 | 2024-04-23 | An issue in Flipsnack v.18/03/2024 allows a local attacker to obtain sensitive information via the reader.gz.js file. |
CVE-2024-3911 | Medium | 6.5 | 2024-04-23 | An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames. |
CVE-2024-30800 | Medium | 5.6 | 2024-04-23 | PX4 Autopilot v.1.14 allows an attacker to fly the drone into no-fly zones by breaching the geofence using flaws in the function. |
CVE-2024-26922 | High | 7.8 | 2024-04-23 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate the parameters of bo mapping operations more clearly Verify the para… |
CVE-2024-3491 | Medium | 6.4 | 2024-04-23 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all v… |
CVE-2024-3732 | Medium | 6.4 | 2024-04-23 | The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi… |
CVE-2024-3665 | Medium | 6.4 | 2024-04-23 | The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's HowTo and FAQ widgets in all versions up… |
CVE-2024-3185 | Medium | 6.8 | 2024-04-23 | A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an atta… |
CVE-2024-0900 | Medium | 4.3 | 2024-04-23 | The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! plugin for WordPress… |
CVE-2024-3664 | Medium | 4.3 | 2024-04-23 | The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_thumbnail and de… |