2024 CVEs (page 307)
Page 307 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22186 | High | 8.8 | 2024-04-18 | The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to beco… |
CVE-2024-21872 | High | 7.5 | 2024-04-18 | The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to t… |
CVE-2024-21846 | Medium | 5.3 | 2024-04-18 | An unauthenticated attacker can reset the board and stop transmitter operations by sending a specially-crafted GET request to the command.cgi gateway, result… |
CVE-2024-1491 | High | 7.5 | 2024-04-18 | The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module pro… |
CVE-2024-3741 | High | 7.5 | 2024-04-18 | Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except '… |
CVE-2024-32473 | Medium | 4.7 | 2024-04-18 | Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes… |
CVE-2024-30929 | High | 8.0 | 2024-04-18 | Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the 'back' Parameter in playlist.php |
CVE-2024-30928 | High | 8.1 | 2024-04-18 | SQL Injection vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary SQL commands via 'classids' Parameter in ajax/query.slide.next.inc |
CVE-2024-30927 | Medium | 6.3 | 2024-04-18 | Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the racer-results.php component. |
CVE-2024-30926 | Medium | 4.6 | 2024-04-18 | Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component. |
CVE-2024-30925 | Medium | 6.5 | 2024-04-18 | Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the photo-thumbs.php component. |
CVE-2024-30924 | Medium | 4.6 | 2024-04-18 | Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component. |
CVE-2024-22179 | High | 7.5 | 2024-04-18 | The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the a… |
CVE-2024-30923 | Critical | 9.8 | 2024-04-18 | SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering |
CVE-2024-30922 | Critical | 9.8 | 2024-04-18 | SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering. |
CVE-2024-30921 | Medium | 5.4 | 2024-04-18 | Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component. |
CVE-2024-30920 | High | 7.4 | 2024-04-18 | Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component. |
CVE-2024-30107 | Low | 3.5 | 2024-04-18 | HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios. |
CVE-2024-32477 | High | 7.7 | 2024-04-18 | Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between `libc::tcflush(0, libc::TCIFL… |
CVE-2024-32474 | High | 7.3 | 2024-04-18 | Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, th… |
CVE-2024-20380 | High | 7.5 | 2024-04-18 | A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device… |
CVE-2024-29987 | Medium | 6.5 | 2024-04-18 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-29986 | Medium | 5.4 | 2024-04-18 | Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-23557 | Low | 3.5 | 2024-04-18 | HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possi… |
CVE-2024-32462 | High | 8.4 | 2024-04-18 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a m… |
CVE-2024-24910 | High | 7.3 | 2024-04-18 | A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows… |
CVE-2024-32335 | Medium | 5.4 | 2024-04-18 | TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in Access Control under the Wireless Page. |
CVE-2024-32334 | Medium | 6.5 | 2024-04-18 | TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firewall Page. |
CVE-2024-32333 | Medium | 4.3 | 2024-04-18 | TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page. |
CVE-2024-32332 | Medium | 6.1 | 2024-04-18 | TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in WDS Settings under the Wireless Page. |
CVE-2024-32327 | Medium | 5.5 | 2024-04-18 | TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in Port Forwarding under the Firewall Page. |
CVE-2024-32326 | Medium | 6.8 | 2024-04-18 | TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the key parameter in the setWiFiExtenderConfig function. |
CVE-2024-32325 | Low | 2.4 | 2024-04-18 | TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the ssid parameter in the setWiFiExtenderConfig function. |
CVE-2024-32475 | High | 7.5 | 2024-04-18 | Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with `auto_sni` enabled, a request containing a `host`/`:auth… |
CVE-2024-32470 | Medium | 6.5 | 2024-04-18 | Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced i… |
CVE-2024-32466 | Low | 2.7 | 2024-04-18 | Tolgee is an open-source localization platform. For the `/v2/projects/translations` and `/v2/projects/{projectId}/translations` endpoints, translation data was… |
CVE-2024-30564 | Critical | 9.8 | 2024-04-18 | An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updat… |
CVE-2024-30257 | Low | 3.9 | 2024-04-18 | 1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac… |
CVE-2024-2796 | Critical | 9.3 | 2024-04-18 | A server-side request forgery (SSRF) was discovered in the Akana API Platform in versions prior to and including 2022.1.3. Reported by Jakob Antonsson. |
CVE-2024-29021 | Critical | 9.0 | 2024-04-18 | Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Re… |
CVE-2024-28189 | Critical | 10.0 | 2024-04-18 | Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abu… |
CVE-2024-28185 | Critical | 10.0 | 2024-04-18 | Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leverage… |
CVE-2024-27306 | Medium | 6.1 | 2024-04-18 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulner… |
CVE-2024-3948 | Medium | 6.3 | 2024-04-18 | A vulnerability was found in SourceCodester Home Clean Service System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-32689 | Medium | 4.3 | 2024-04-18 | Missing Authorization vulnerability in GenialSouls WP Social Comments.This issue affects WP Social Comments: from n/a through 1.7.3. |
CVE-2024-32686 | Medium | 5.3 | 2024-04-18 | Insertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3. |
CVE-2024-32602 | High | 7.6 | 2024-04-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency.T… |
CVE-2024-32600 | High | 8.3 | 2024-04-18 | Deserialization of Untrusted Data vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.5. |
CVE-2024-32553 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in looks_awesome Superfly Menu superfly-menu.This issue affe… |
CVE-2024-32552 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tagbox Taggbox allows Stored XSS.This issue affects Taggb… |
CVE-2024-32551 | High | 7.6 | 2024-04-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affe… |
CVE-2024-32126 | Medium | 5.9 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Navigation menu as Dropdown Widget navigati… |
CVE-2024-31229 | Medium | 5.5 | 2024-04-18 | Server-Side Request Forgery (SSRF) vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a through 7.2.3. |
CVE-2024-32586 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Munir Kamal Gutenberg Block Editor Toolkit allows Stored… |
CVE-2024-32585 | Medium | 5.9 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendWP Import Content in WordPress & WooCommerce with E… |
CVE-2024-32584 | Medium | 5.9 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StandaloneTech TeraWallet – For WooCommerce allows Stored… |
CVE-2024-32583 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Reflecte… |
CVE-2024-32582 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Debug Log Manager allows Stored XSS.This issue affec… |
CVE-2024-32581 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lenderd Mortgage Calculators WP allows Stored XSS.This is… |
CVE-2024-32580 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider allows Stored XSS.This issue affects… |
CVE-2024-32579 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GloriaFood Restaurant Menu – Food Ordering System – Table… |
CVE-2024-32578 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Slider by 10Web allows Reflected XSS.This issue aff… |
CVE-2024-32577 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeboxr Team CBX Bookmark & Favorite cbxwpbookmark allow… |
CVE-2024-32576 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms BA Book Everything allows Stored XSS.T… |
CVE-2024-32575 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kraftplugins Mega Elements allows Stored XSS.This issue a… |
CVE-2024-32574 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap allows Reflected XSS… |
CVE-2024-32573 | Medium | 5.9 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay.This is… |
CVE-2024-32572 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stored XSS… |
CVE-2024-32571 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 WP Stripe Checkout allows Stored XSS.This issue af… |
CVE-2024-32570 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Archetyped Cornerstone allows Reflected XSS.This issue af… |
CVE-2024-32569 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations Ditty allows Stored XSS.This issue aff… |
CVE-2024-32568 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA wp-2fa.This issue affects WP 2FA: from n… |
CVE-2024-32567 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress allows Reflected XSS.This is… |
CVE-2024-32566 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Club Manager WP Club Manager wp-club-manager.This issu… |
CVE-2024-32565 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Appcheap.Io App Builder allows Stored XSS.This issue affe… |
CVE-2024-32564 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue… |
CVE-2024-32563 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VikBooking Hotel Booking Engine & PMS allows Reflected XS… |
CVE-2024-32562 | High | 8.6 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Stored XSS.This iss… |
CVE-2024-32561 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tagembed allows Stored XSS.This issue affects Tagembed: f… |
CVE-2024-32560 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sharabindu QR Code Composer allows Stored XSS.This issue… |
CVE-2024-32559 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hwk-fr WP 404 Auto Redirect to Similar Post allows Reflec… |
CVE-2024-32558 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog allows Reflected XSS… |
CVE-2024-32556 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabil Lemsieh HurryTimer allows Stored XSS.This issue aff… |
CVE-2024-32554 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Knight Lab Knight Lab Timeline allows Stored XSS.This iss… |
CVE-2024-2833 | Medium | 6.1 | 2024-04-18 | The Jobs for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘job-search’ parameter in all versions up to, and including… |
CVE-2024-29003 | High | 7.5 | 2024-04-18 | The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requires authentication… |
CVE-2024-26921 | High | 7.8 | 2024-04-18 | In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use ip_local_out() and other functio… |
CVE-2024-32604 | Medium | 4.3 | 2024-04-18 | Authorization Bypass Through User-Controlled Key vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.5. |
CVE-2024-32603 | High | 8.5 | 2024-04-18 | Deserialization of Untrusted Data vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.20. |
CVE-2024-32601 | Medium | 5.3 | 2024-04-18 | Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Popup Anything.This issue affects Popup Anything: from n/a through 2.8. |
CVE-2024-32599 | Critical | 10.0 | 2024-04-18 | Improper Control of Generation of Code ('Code Injection') vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator.This issue affect… |
CVE-2024-32598 | Medium | 5.9 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms BA Book Everything allows Stored XSS.T… |
CVE-2024-32597 | Medium | 5.9 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Stored XSS.This is… |
CVE-2024-32596 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric-Oliver Mächler DSGVO Youtube allows Stored XSS.This… |
CVE-2024-32595 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mat Bao Corp WP Helper Premium allows Reflected XSS.This… |
CVE-2024-32594 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AttesaWP Attesa Extra allows Stored XSS.This issue affect… |
CVE-2024-32593 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBits WPBITS Addons For Elementor Page Builder allows St… |
CVE-2024-32592 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VoidCoders, innovs Void Elementor WHMCS Elements For Elem… |
CVE-2024-32591 | Medium | 5.9 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniele De Rosa Backend Designer allows Stored XSS.This i… |
CVE-2024-32590 | Medium | 6.5 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webfood Kattene allows Stored XSS.This issue affects Katt… |