2024 CVEs (page 314)
Page 314 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-32446 | Medium | 5.4 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in WP Swings Wallet System for WooCommerce.This issue affects Wallet System for WooCommerce: from n/a through 2… |
CVE-2024-32445 | Medium | 5.4 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition.This issue affects WebinarIgnition: from n/a throu… |
CVE-2024-32443 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in IP2Location Download IP2Location Country Blocker.This issue affects Download IP2Location Country Blocker: fr… |
CVE-2024-32442 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7. |
CVE-2024-32441 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.7. |
CVE-2024-32440 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.8.0. |
CVE-2024-32439 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in SwitchWP WP Client Reports.This issue affects WP Client Reports: from n/a through 1.0.22. |
CVE-2024-32438 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in cleverplugins.Com SEO Booster.This issue affects SEO Booster: from n/a through 3.8.9. |
CVE-2024-32431 | Medium | 4.4 | 2024-04-15 | Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2. |
CVE-2024-32430 | Medium | 4.4 | 2024-04-15 | Server-Side Request Forgery (SSRF) vulnerability in ActiveCampaign.This issue affects ActiveCampaign: from n/a through 8.1.14. |
CVE-2024-32139 | High | 8.5 | 2024-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podl… |
CVE-2024-32137 | High | 8.5 | 2024-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin User Activity Log Pro.This issue affects User Acti… |
CVE-2024-32136 | High | 7.6 | 2024-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xenioushk BWL Advanced FAQ Manager.This issue affects BWL… |
CVE-2024-32135 | High | 7.6 | 2024-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPZest Disable Comments | WPZest.This issue affects Disab… |
CVE-2024-32134 | High | 7.6 | 2024-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Forms to Zapier, Integromat, IFTTT, Workato, A… |
CVE-2024-32132 | High | 7.6 | 2024-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codeboxr Team CBX Bookmark & Favorite.This issue affects… |
CVE-2024-32128 | Critical | 9.3 | 2024-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Realtyna Realtyna Organic IDX plugin.This issue affects R… |
CVE-2024-32127 | High | 8.5 | 2024-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Markus Seyer Find Duplicates.This issue affects Find Dupl… |
CVE-2024-32125 | High | 8.5 | 2024-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booking Algorithms BA Book Everything.This issue affects… |
CVE-2024-32098 | High | 7.6 | 2024-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter.This issue… |
CVE-2024-32087 | High | 7.6 | 2024-04-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExportFeed.Com Product Feed on WooCommerce for Google.Thi… |
CVE-2024-32082 | High | 7.1 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Kamlesh Parmar Sync Post With Other Site sync-post-with-other-site allows Cross Site Request Forgery.This is… |
CVE-2024-31093 | High | 7.1 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Kaloyan K. Tsvetkov Broken Images allows Cross-Site Scripting (XSS).This issue affects Broken Images: from n… |
CVE-2024-31086 | High | 7.1 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Change default login logo,url and title allows Cross-Site Scripting (XSS).This issue affects Chang… |
CVE-2024-30545 | High | 7.1 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in Nick Powers Social Author Bio allows Stored XSS.This issue affects Social Author Bio: from n/a through 2.4. |
CVE-2024-32454 | Medium | 4.4 | 2024-04-15 | Server-Side Request Forgery (SSRF) vulnerability in Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment.This issue affects Appointmen… |
CVE-2024-32453 | Medium | 5.9 | 2024-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POEditor allows Stored XSS.This issue affects POEditor: f… |
CVE-2024-32429 | Medium | 5.9 | 2024-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPChill Remove Footer Credit allows Stored XSS.This issue… |
CVE-2024-32428 | Medium | 5.9 | 2024-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moss Web Works MWW Disclaimer Buttons allows Stored XSS.T… |
CVE-2024-32149 | High | 7.1 | 2024-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Jobs for WordPress allows Reflected XSS.This is… |
CVE-2024-32147 | Medium | 6.5 | 2024-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Form Plugin Team - GhozyLab Easy Contact Form Lite allows… |
CVE-2024-32145 | High | 7.1 | 2024-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PineWise WP Google Analytics Events allows Reflected XSS… |
CVE-2024-32140 | Medium | 6.5 | 2024-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in libsyn Libsyn Publisher Hub libsyn-podcasting.This issue… |
CVE-2024-32138 | High | 7.1 | 2024-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Short URL allows Reflected XSS.This issue af… |
CVE-2024-32133 | High | 7.1 | 2024-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Schuppenies EZ Form Calculator allows Reflected X… |
CVE-2024-32079 | Medium | 6.5 | 2024-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This is… |
CVE-2024-3771 | Medium | 6.3 | 2024-04-15 | A vulnerability was found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-32489 | Medium | 6.1 | 2024-04-15 | TCPDF before 6.7.4 mishandles calls that use HTML syntax. |
CVE-2024-32488 | High | 7.8 | 2024-04-15 | In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder… |
CVE-2024-3770 | Medium | 6.3 | 2024-04-15 | A vulnerability has been found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2024-2858 | Medium | 4.8 | 2024-04-15 | The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logged in users perform… |
CVE-2024-2857 | Medium | 6.1 | 2024-04-15 | The Simple Buttons Creator WordPress plugin through 1.04 does not have any authorisation as well as CSRF in its add button function, allowing unauthenticated u… |
CVE-2024-2836 | Medium | 4.8 | 2024-04-15 | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow… |
CVE-2024-2739 | High | 8.7 | 2024-04-15 | The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwant… |
CVE-2024-1849 | Medium | 5.4 | 2024-04-15 | The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URL |
CVE-2024-1846 | Medium | 5.4 | 2024-04-15 | The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2024-1755 | High | 8.8 | 2024-04-15 | The NPS computy WordPress plugin through 2.7.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted a… |
CVE-2024-1754 | Medium | 4.7 | 2024-04-15 | The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-1746 | Medium | 5.4 | 2024-04-15 | The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-1712 | Medium | 4.7 | 2024-04-15 | The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-1660 | Medium | 4.8 | 2024-04-15 | The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-1310 | Medium | 4.9 | 2024-04-15 | The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g… |
CVE-2024-1307 | Medium | 6.5 | 2024-04-15 | The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber… |
CVE-2024-1306 | Medium | 5.4 | 2024-04-15 | The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted… |
CVE-2024-1204 | Medium | 4.3 | 2024-04-15 | The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other use… |
CVE-2024-0902 | Medium | 4.8 | 2024-04-15 | The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-0399 | High | 8.1 | 2024-04-15 | The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to… |
CVE-2024-3778 | High | 7.2 | 2024-04-15 | The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to uploa… |
CVE-2024-3777 | Critical | 9.8 | 2024-04-15 | The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password. |
CVE-2024-3776 | Medium | 6.1 | 2024-04-15 | The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript cod… |
CVE-2024-3775 | Medium | 5.3 | 2024-04-15 | aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitr… |
CVE-2024-3769 | High | 7.3 | 2024-04-15 | A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Affected is an unknown function of the file /login.php… |
CVE-2024-3768 | Medium | 6.3 | 2024-04-15 | A vulnerability, which was classified as critical, has been found in PHPGurukul/itsourcecode News Portal 4.1. This issue affects some unknown processing of the… |
CVE-2024-3767 | Medium | 6.3 | 2024-04-15 | A vulnerability classified as critical was found in PHPGurukul News Portal 4.1. This vulnerability affects unknown code of the file /admin/edit-post.php. The m… |
CVE-2024-1655 | High | 8.8 | 2024-04-15 | Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary system commands by s… |
CVE-2024-3774 | Medium | 5.3 | 2024-04-15 | aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing att… |
CVE-2024-3772 | Medium | 5.9 | 2024-04-15 | Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string. |
CVE-2024-3766 | Low | 2.4 | 2024-04-15 | A vulnerability, which was classified as problematic, has been found in slowlyo OwlAdmin up to 3.5.7. Affected by this issue is some unknown functionality of t… |
CVE-2024-29844 | Critical | 9.8 | 2024-04-15 | Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon i… |
CVE-2024-29843 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing f… |
CVE-2024-29842 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIE… |
CVE-2024-29841 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS… |
CVE-2024-29840 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS… |
CVE-2024-29839 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allow… |
CVE-2024-29838 | High | 7.5 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below does not proper sanitize user input, allowing for an unauthenticated attacker… |
CVE-2024-29837 | High | 8.8 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to acce… |
CVE-2024-29836 | Critical | 9.8 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated att… |
CVE-2024-3765 | Critical | 9.8 | 2024-04-14 | A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R8… |
CVE-2024-3764 | Low | 2.7 | 2024-04-14 | ** DISPUTED ** A vulnerability classified as problematic has been found in Tuya SDK up to 5.0.x. Affected is an unknown function of the component MQTT Packet H… |
CVE-2024-3763 | Low | 2.4 | 2024-04-14 | A vulnerability was found in Emlog Pro 2.2.10. It has been rated as problematic. This issue affects some unknown processing of the file /admin/tag.php of the c… |
CVE-2024-3762 | Low | 2.4 | 2024-04-14 | A vulnerability was found in Emlog Pro 2.2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/twitter.php of t… |
CVE-2024-3740 | Medium | 6.3 | 2024-04-13 | A vulnerability, which was classified as critical, has been found in cym1102 nginxWebUI up to 3.9.9. This issue affects the function exec of the file /adminPag… |
CVE-2024-3739 | Medium | 6.3 | 2024-04-13 | A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload… |
CVE-2024-3738 | High | 7.3 | 2024-04-13 | A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveC… |
CVE-2024-3737 | Medium | 6.3 | 2024-04-13 | A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been rated as critical. Affected by this issue is the function findCountByQuery of the file… |
CVE-2024-32487 | High | 8.6 | 2024-04-13 | less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically… |
CVE-2024-3736 | Medium | 4.3 | 2024-04-13 | A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been declared as problematic. Affected by this vulnerability is the function upload of the… |
CVE-2024-3735 | Low | 3.7 | 2024-04-13 | A vulnerability was found in Smart Office up to 20240405. It has been classified as problematic. Affected is an unknown function of the file Main.aspx. The man… |
CVE-2024-3721 | Medium | 6.3 | 2024-04-13 | A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /devic… |
CVE-2024-3720 | Medium | 6.3 | 2024-04-13 | A vulnerability has been found in Tianwell Fire Intelligent Command Platform 1.1.1.1 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-26817 | Medium | 5.5 | 2024-04-13 | In the Linux kernel, the following vulnerability has been resolved: amdkfd: use calloc instead of kzalloc to avoid integer overflow This uses calloc instead… |
CVE-2024-3719 | Medium | 6.3 | 2024-04-13 | A vulnerability, which was classified as critical, was found in Campcodes House Rental Management System 1.0. This affects an unknown part of the file ajax.php… |
CVE-2024-3662 | Medium | 4.3 | 2024-04-13 | The WPZOOM Social Feed Widget & Block plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpzoom_instagram_clear… |
CVE-2024-2583 | Medium | 5.4 | 2024-04-13 | The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed… |
CVE-2024-3027 | Medium | 6.4 | 2024-04-13 | The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all vers… |
CVE-2024-1957 | Medium | 6.4 | 2024-04-13 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode… |
CVE-2024-32028 | Medium | 4.1 | 2024-04-12 | OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCor… |
CVE-2024-31462 | Medium | 6.3 | 2024-04-12 | stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable to a limited file… |
CVE-2024-28869 | High | 7.5 | 2024-04-12 | Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header… |
CVE-2024-32019 | High | 8.8 | 2024-04-12 | Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to… |