2024 CVEs (page 31)
Page 31 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13540 | Medium | 5.3 | 2025-02-18 | The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and in… |
CVE-2024-13538 | Medium | 5.3 | 2025-02-18 | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.0. This… |
CVE-2024-13535 | Medium | 5.3 | 2025-02-18 | The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is due the composer-s… |
CVE-2024-13522 | Medium | 6.1 | 2025-02-18 | The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missin… |
CVE-2024-13501 | Medium | 6.4 | 2025-02-18 | The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and incl… |
CVE-2024-13464 | Medium | 6.4 | 2025-02-18 | The Library Bookshelves plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bookshelf' shortcode in all versions up to, and inc… |
CVE-2024-12813 | Medium | 6.4 | 2025-02-18 | The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-status' shortcode i… |
CVE-2024-12525 | Medium | 6.4 | 2025-02-18 | The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' shortcode in all v… |
CVE-2024-12314 | High | 7.2 | 2025-02-18 | The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin storing HTTP headers i… |
CVE-2024-13740 | Medium | 4.3 | 2025-02-18 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu… |
CVE-2024-13741 | Medium | 5.4 | 2025-02-18 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and in… |
CVE-2024-25066 | Medium | 4.3 | 2025-02-17 | RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlled files being sto… |
CVE-2024-13879 | Medium | 5.5 | 2025-02-17 | The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the… |
CVE-2024-47935 | Medium | 6.7 | 2025-02-17 | Improper Validation of Integrity Check Value vulnerability in TXOne Networks StellarProtect (Legacy Mode), StellarEnforce, and Safe Lock allows an attacker to… |
CVE-2024-13726 | High | 8.6 | 2025-02-17 | The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to… |
CVE-2024-13627 | Medium | 4.7 | 2025-02-17 | The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cro… |
CVE-2024-13626 | High | 7.1 | 2025-02-17 | The VR-Frases (collect & share quotes) WordPress plugin through 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t… |
CVE-2024-13625 | High | 7.1 | 2025-02-17 | The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-13608 | Medium | 4.7 | 2025-02-17 | The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injec… |
CVE-2024-13603 | Medium | 6.1 | 2025-02-17 | The Wise Forms WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cros… |
CVE-2024-44044 | High | 7.1 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandexponents Oshine Modules oshine-modules allows Refle… |
CVE-2024-57971 | Critical | 9.1 | 2025-02-16 | DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning… |
CVE-2024-57970 | Medium | 4.0 | 2025-02-16 | libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles… |
CVE-2024-13834 | Medium | 5.4 | 2025-02-15 | The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Reque… |
CVE-2024-13500 | Medium | 6.5 | 2025-02-15 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL… |
CVE-2024-13488 | High | 7.5 | 2025-02-15 | The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions… |
CVE-2024-13439 | Medium | 4.3 | 2025-02-15 | The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function… |
CVE-2024-10581 | Medium | 4.3 | 2025-02-15 | The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missin… |
CVE-2024-13752 | Medium | 6.5 | 2025-02-15 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized l… |
CVE-2024-12562 | Critical | 9.8 | 2025-02-15 | The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input… |
CVE-2024-13563 | Medium | 6.4 | 2025-02-15 | The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all versions up to, and inc… |
CVE-2024-13525 | Medium | 6.5 | 2025-02-15 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9… |
CVE-2024-13513 | Critical | 9.8 | 2025-02-15 | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2… |
CVE-2024-13306 | Medium | 4.3 | 2025-02-15 | The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privil… |
CVE-2024-13208 | Medium | 4.3 | 2025-02-15 | The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privil… |
CVE-2024-5462 | High | 7.5 | 2025-02-15 | If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be e… |
CVE-2024-5461 | High | 8.0 | 2025-02-15 | Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to… |
CVE-2024-4282 | Critical | 9.8 | 2025-02-15 | Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22. |
CVE-2024-10405 | Medium | 5.3 | 2025-02-15 | Brocade SANnav before SANnav 2.3.1b enables weak TLS ciphers on ports 443 and 18082. In case of a successful exploit, an attacker can read Brocade SANnav dat… |
CVE-2024-31144 | Low | 3.8 | 2025-02-14 | For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.html#object-model-overview Xapi contains functionality to b… |
CVE-2024-8893 | High | 7.3 | 2025-02-14 | Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to fully access the we… |
CVE-2024-57790 | Medium | 5.4 | 2025-02-14 | IXON B.V. IXrouter IX2400 (Industrial Edge Gateway) v3.0 was discovered to contain hardcoded root credentials stored in the non-volatile flash memory. This vul… |
CVE-2024-56463 | Medium | 4.8 | 2025-02-14 | IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2024-3220 | | 2025-02-14 | There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users… | |
CVE-2024-57778 | High | 8.8 | 2025-02-14 | An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to st… |
CVE-2024-57725 | Medium | 6.5 | 2025-02-14 | An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication, causing an interne… |
CVE-2024-56973 | Critical | 9.8 | 2025-02-14 | Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the sourc… |
CVE-2024-56477 | Medium | 6.5 | 2025-02-14 | IBM Power Hardware Management Console V10.3.1050.0 could allow an authenticated user to traverse directories on the system. An attacker could send a specially… |
CVE-2024-52895 | Medium | 6.5 | 2025-02-14 | IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A privileged bad actor… |
CVE-2024-56180 | Critical | 9.8 | 2025-02-14 | CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\m… |
CVE-2024-12651 | High | 8.5 | 2025-02-14 | Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App… |
CVE-2024-52500 | High | 7.2 | 2025-02-14 | Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2024-13152 | Critical | 10.0 | 2025-02-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BSS Software Mobuy Online Machinery Monitoring Panel allo… |
CVE-2024-13791 | Medium | 4.9 | 2025-02-14 | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes… |
CVE-2024-52577 | Critical | 9.0 | 2025-02-14 | In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could b… |
CVE-2024-13735 | Medium | 6.4 | 2025-02-14 | The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all v… |
CVE-2024-9601 | Medium | 6.5 | 2025-02-14 | The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versi… |
CVE-2024-57969 | Medium | 4.3 | 2025-02-14 | app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. |
CVE-2024-7052 | Medium | 4.8 | 2025-02-14 | The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to… |
CVE-2024-13692 | Medium | 5.4 | 2025-02-14 | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to… |
CVE-2024-13641 | Medium | 5.9 | 2025-02-14 | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to… |
CVE-2024-13493 | Medium | 4.8 | 2025-02-14 | The Sensly Online Presence WordPress plugin through 0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-2240 | High | 7.2 | 2025-02-14 | Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various at… |
CVE-2024-55904 | High | 7.2 | 2025-02-14 | IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 / IBM UrbanCode Deploy 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 thr… |
CVE-2024-10404 | Medium | 5.5 | 2025-02-14 | CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker… |
CVE-2024-57782 | Medium | 6.8 | 2025-02-13 | An issue in Docker-proxy v18.09.0 allows attackers to cause a denial of service. |
CVE-2024-56908 | Medium | 6.8 | 2025-02-13 | In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input… |
CVE-2024-54951 | Medium | 5.4 | 2025-02-13 | Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS). A malicious user can create a malformed contact and use that contact in the "HOW YOU MET" customizati… |
CVE-2024-53311 | Medium | 5.5 | 2025-02-13 | A Stack buffer overflow in the arguments parameter in Immunity Inc. Immunity Debugger v1.85 allows attackers to execute arbitrary code via a crafted input that… |
CVE-2024-53310 | Medium | 5.5 | 2025-02-13 | A Structured Exception Handler based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when a specially craft… |
CVE-2024-53309 | Medium | 5.5 | 2025-02-13 | A stack-based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when an overly long string is passed to the "… |
CVE-2024-37603 | Medium | 4.6 | 2025-02-13 | An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible type confusion exists in the user data import/export function of NTG 6 h… |
CVE-2024-37602 | Medium | 4.6 | 2025-02-13 | An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. A possible NULL pointer dereference in the Apple Car Play function aff… |
CVE-2024-37601 | Medium | 4.6 | 2025-02-13 | An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible heap buffer overflow exists in the user data import/export function of N… |
CVE-2024-37600 | Medium | 6.8 | 2025-02-13 | An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. A possible stack buffer overflow in the Service Broker service affects… |
CVE-2024-12054 | Medium | 5.4 | 2025-02-13 | ZF Roll Stability Support Plus (RSSPlus) is vulnerable to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds… |
CVE-2024-57378 | High | 7.3 | 2025-02-13 | Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability. This issue allows the unauthorized creation of internal users without assigning… |
CVE-2024-11347 | High | 7.3 | 2025-02-13 | Integer Overflow or Wraparound vulnerability in Lexmark International CX, XC, CS, et. Al. (Postscript interpreter modules) allows Forced Integer Overflow.The v… |
CVE-2024-11346 | High | 7.3 | 2025-02-13 | : Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Lexmark International CX, XC, CS, et. Al. (Postscript interpreter modules) all… |
CVE-2024-11345 | High | 7.3 | 2025-02-13 | A heap-based memory vulnerability has been identified in the Postscript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attack… |
CVE-2024-11344 | High | 7.3 | 2025-02-13 | A type confusion vulnerability has been identified in the Postscript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker… |
CVE-2024-12013 | High | 7.6 | 2025-02-13 | A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server wit… |
CVE-2024-12012 | Medium | 5.7 | 2025-02-13 | A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. Both the… |
CVE-2024-12011 | High | 7.6 | 2025-02-13 | A CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The information disclosure can be triggered by… |
CVE-2024-13182 | Critical | 9.8 | 2025-02-13 | The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect aut… |
CVE-2024-13867 | Medium | 6.1 | 2025-02-13 | The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, a… |
CVE-2024-13606 | High | 7.5 | 2025-02-13 | The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl… |
CVE-2024-46910 | High | 7.1 | 2025-02-13 | An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recomme… |
CVE-2024-3303 | Medium | 6.4 | 2025-02-13 | An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prio… |
CVE-2024-13639 | Medium | 4.3 | 2025-02-13 | The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteD… |
CVE-2024-47266 | Low | 2.7 | 2025-02-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Active Backup for Bus… |
CVE-2024-47265 | Medium | 6.5 | 2025-02-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup… |
CVE-2024-47264 | Medium | 4.9 | 2025-02-13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Active Backup for Busin… |
CVE-2024-13346 | High | 7.3 | 2025-02-13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including… |
CVE-2024-13345 | High | 7.3 | 2025-02-13 | The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is due to the softwar… |
CVE-2024-13125 | Low | 3.5 | 2025-02-13 | The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-13121 | Low | 3.5 | 2025-02-13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise a… |
CVE-2024-13120 | Medium | 4.8 | 2025-02-13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise a… |
CVE-2024-13119 | Medium | 4.8 | 2025-02-13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise a… |
CVE-2024-12586 | Medium | 6.1 | 2025-02-13 | The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle… |