2024 CVEs (page 318)
Page 318 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1625 | Medium | 6.5 | 2024-04-10 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organi… |
CVE-2024-1602 | Medium | 6.1 | 2024-04-10 | parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting (XSS) that leads to Remote Code Execution (RCE). The vulnerability arises due to inadequate… |
CVE-2024-1600 | Critical | 9.3 | 2024-04-10 | A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exp… |
CVE-2024-1520 | Critical | 9.8 | 2024-04-10 | An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-s… |
CVE-2024-1511 | Critical | 9.8 | 2024-04-10 | The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allow… |
CVE-2024-3566 | Critical | 9.8 | 2024-04-10 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function whe… |
CVE-2024-31874 | Medium | 6.2 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 uses uninitialized variables when deploying that could allow a local user to cause a denial of servi… |
CVE-2024-31873 | High | 7.5 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication that could be obtai… |
CVE-2024-31872 | High | 7.5 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Open Source scrip… |
CVE-2024-31871 | High | 7.5 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Python scripts du… |
CVE-2024-31358 | High | 7.5 | 2024-04-10 | Missing Authorization vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a… |
CVE-2024-31353 | Medium | 5.3 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8. |
CVE-2024-31302 | Medium | 5.3 | 2024-04-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a throu… |
CVE-2024-31298 | Medium | 5.3 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0. |
CVE-2024-31297 | High | 7.5 | 2024-04-10 | Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0. |
CVE-2024-31287 | Medium | 6.5 | 2024-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Libr… |
CVE-2024-31282 | Medium | 4.7 | 2024-04-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Appcheap.Io App Builder.This issue affects App Builder: from n/a through 3.8.7. |
CVE-2024-31278 | Medium | 4.3 | 2024-04-10 | Insertion of Sensitive Information Into Sent Data vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium… |
CVE-2024-31259 | High | 7.5 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in Searchiq SearchIQ.This issue affects SearchIQ: from n/a through 4.5. |
CVE-2024-31254 | Low | 3.7 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from… |
CVE-2024-31253 | Medium | 4.7 | 2024-04-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP OAuth Server OAuth Server.This issue affects OAuth Server: from n/a through 4.3.3. |
CVE-2024-31249 | Medium | 5.3 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from… |
CVE-2024-31247 | Medium | 5.3 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a th… |
CVE-2024-31245 | Medium | 5.3 | 2024-04-10 | Insertion of Sensitive Information into Log File vulnerability in ConvertKit.This issue affects ConvertKit: from n/a through 2.4.5. |
CVE-2024-31240 | High | 7.7 | 2024-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in InfoTheme WP Poll Maker.This issue affects WP Poll Maker: from… |
CVE-2024-23735 | Medium | 6.1 | 2024-04-10 | Cross Site Scripting (XSS) vulnerability in in the S/MIME certificate upload functionality of the User Profile pages in savignano S/Notify before 4.0.0 for Con… |
CVE-2024-23734 | Medium | 5.2 | 2024-04-10 | Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for Bitbucket allow attack… |
CVE-2024-0218 | High | 7.5 | 2024-04-10 | A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian, caused by improper input validation in certain fields used in the Radius parsing functiona… |
CVE-2024-3567 | Medium | 5.5 | 2024-04-10 | A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum… |
CVE-2024-29296 | Medium | 5.3 | 2024-04-10 | A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time co… |
CVE-2024-27477 | Medium | 6.1 | 2024-04-10 | In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject maliciou… |
CVE-2024-27476 | Medium | 4.7 | 2024-04-10 | Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. |
CVE-2024-27474 | High | 8.8 | 2024-04-10 | Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of auth… |
CVE-2024-24809 | High | 8.5 | 2024-04-10 | Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Sinc… |
CVE-2024-3448 | Medium | 5.0 | 2024-04-10 | Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailabilit… |
CVE-2024-2731 | Medium | 5.4 | 2024-04-10 | Users with low privileges (all permissions deselected in the administrator permissions settings) can view certain pages that expose sensitive information such… |
CVE-2024-2730 | Medium | 5.3 | 2024-04-10 | Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public preview URLs which coul… |
CVE-2024-26816 | Medium | 5.5 | 2024-04-10 | In the Linux kernel, the following vulnerability has been resolved: x86, relocs: Ignore relocations in .notes section When building with CONFIG_XEN_PV=y, .te… |
CVE-2024-23083 | Medium | 5.3 | 2024-04-10 | Time4J Base v5.9.3 was discovered to contain a NullPointerException via the component net.time4j.format.internal.FormatUtils::useDefaultWeekmodel(Locale). NOTE… |
CVE-2024-31924 | Medium | 4.3 | 2024-04-10 | Cross-Site Request Forgery (CSRF) vulnerability in nosilver4u EWWW Image Optimizer ewww-image-optimizer.This issue affects EWWW Image Optimizer: from n/a throu… |
CVE-2024-31492 | High | 8.2 | 2024-04-10 | An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a loca… |
CVE-2024-23080 | Critical | 9.1 | 2024-04-10 | Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NOTE: this is disput… |
CVE-2024-20772 | High | 7.8 | 2024-04-10 | Media Encoder versions 24.2.1, 23.6.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2024-20770 | Medium | 5.5 | 2024-04-10 | Photoshop Desktop versions 24.7.2, 25.3.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An… |
CVE-2024-20766 | Medium | 5.5 | 2024-04-10 | InDesign Desktop versions 18.5.1, 19.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An at… |
CVE-2024-31309 | High | 7.5 | 2024-04-10 | HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9… |
CVE-2024-23076 | High | 7.5 | 2024-04-10 | JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multipl… |
CVE-2024-20759 | High | 8.1 | 2024-04-10 | Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be a… |
CVE-2024-20758 | Critical | 9.0 | 2024-04-10 | Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in a… |
CVE-2024-2243 | High | 7.6 | 2024-04-10 | A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the con… |
CVE-2024-26815 | High | 7.8 | 2024-04-10 | In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check taprio_parse_tc_entry() is not… |
CVE-2024-26122 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26098 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26097 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26087 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26084 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26079 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26076 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26047 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-26046 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-20780 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-20779 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-20778 | Medium | 5.4 | 2024-04-10 | Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to i… |
CVE-2024-20737 | Medium | 5.5 | 2024-04-10 | After Effects versions 24.1, 23.6.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2024-22448 | Medium | 4.7 | 2024-04-10 | Dell BIOS contains an Out-of-Bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerabilit… |
CVE-2024-1780 | Medium | 6.1 | 2024-04-10 | The BizCalendar Web plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.1.0.25… |
CVE-2024-22450 | High | 7.4 | 2024-04-10 | Dell Alienware Command Center, versions prior to 6.2.7.0, contain an uncontrolled search path element vulnerability. A local malicious user could potentially i… |
CVE-2024-0159 | Medium | 6.7 | 2024-04-10 | Dell Alienware Command Center, versions 5.5.52.0 and prior, contain improper access control vulnerability, leading to Denial of Service on local system. |
CVE-2024-3542 | Low | 3.5 | 2024-04-10 | A vulnerability classified as problematic was found in Campcodes Church Management System 1.0. This vulnerability affects unknown code of the file /admin/add_v… |
CVE-2024-3541 | Low | 3.5 | 2024-04-10 | A vulnerability classified as problematic has been found in Campcodes Church Management System 1.0. This affects an unknown part of the file /admin/admin_user… |
CVE-2024-3210 | Medium | 6.4 | 2024-04-10 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-2655 | Medium | 6.4 | 2024-04-10 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post widgets in all versions up to, and inc… |
CVE-2024-2539 | Medium | 6.4 | 2024-04-10 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget '_id' attributes in all versions up to, and inclu… |
CVE-2024-3540 | Medium | 6.3 | 2024-04-10 | A vulnerability was found in Campcodes Church Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-3539 | Medium | 6.3 | 2024-04-10 | A vulnerability was found in Campcodes Church Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2024-3538 | Medium | 6.3 | 2024-04-10 | A vulnerability was found in Campcodes Church Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/add… |
CVE-2024-3235 | Medium | 5.3 | 2024-04-10 | The Essential Grid Gallery WordPress Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 vi… |
CVE-2024-3020 | High | 7.2 | 2024-04-10 | The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the '… |
CVE-2024-2736 | Medium | 6.4 | 2024-04-10 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up to, and including, 4.8.8 due to insuff… |
CVE-2024-2735 | Medium | 6.4 | 2024-04-10 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Price List' element in all versions up to, and including, 4.8… |
CVE-2024-2734 | Medium | 6.4 | 2024-04-10 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's AI features all versions up to, and including, 4.8.8 d… |
CVE-2024-2428 | Medium | 4.7 | 2024-04-10 | The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allow… |
CVE-2024-21509 | Medium | 6.5 | 2024-04-10 | Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization… |
CVE-2024-21507 | Medium | 6.5 | 2024-04-10 | Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An at… |
CVE-2024-1042 | Medium | 6.4 | 2024-04-10 | The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2024-1041 | Medium | 6.4 | 2024-04-10 | The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's setti… |
CVE-2024-3537 | Medium | 6.3 | 2024-04-10 | A vulnerability was found in Campcodes Church Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/a… |
CVE-2024-3536 | Medium | 6.3 | 2024-04-10 | A vulnerability has been found in Campcodes Church Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin… |
CVE-2024-2733 | Medium | 5.4 | 2024-04-10 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "Separator" element in all versions up to, and includi… |
CVE-2024-2666 | Medium | 5.4 | 2024-04-10 | The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Bullet List Widget in all version… |
CVE-2024-2665 | Medium | 6.4 | 2024-04-10 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button in all versions up to, and including… |
CVE-2024-2664 | Medium | 6.4 | 2024-04-10 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Widget in all versions up to, and… |
CVE-2024-3535 | High | 7.3 | 2024-04-10 | A vulnerability, which was classified as critical, was found in Campcodes Church Management System 1.0. This affects an unknown part of the file /admin/index.p… |
CVE-2024-3534 | High | 7.3 | 2024-04-10 | A vulnerability, which was classified as critical, has been found in Campcodes Church Management System 1.0. Affected by this issue is some unknown functionali… |
CVE-2024-3533 | Low | 3.5 | 2024-04-10 | A vulnerability classified as problematic was found in Campcodes Complete Online Student Management System 1.0. Affected by this vulnerability is an unknown fu… |
CVE-2024-3532 | Low | 3.5 | 2024-04-10 | A vulnerability classified as problematic has been found in Campcodes Complete Online Student Management System 1.0. Affected is an unknown function of the fil… |
CVE-2024-3531 | Low | 3.5 | 2024-04-10 | A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been rated as problematic. This issue affects some unknown process… |
CVE-2024-3530 | Low | 3.5 | 2024-04-10 | A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been declared as problematic. This vulnerability affects unknown c… |
CVE-2024-3529 | Low | 3.5 | 2024-04-10 | A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been classified as problematic. This affects an unknown part of th… |
CVE-2024-3528 | Low | 3.5 | 2024-04-10 | A vulnerability was found in Campcodes Complete Online Student Management System 1.0 and classified as problematic. Affected by this issue is some unknown func… |