2024 CVEs (page 323)
Page 323 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-31806 | Medium | 6.5 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which can reboot the syste… |
CVE-2024-31805 | Medium | 6.5 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in the setTelnetCfg f… |
CVE-2024-2834 | High | 8.7 | 2024-04-08 | A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be… |
CVE-2024-28066 | High | 8.8 | 2024-04-08 | In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password). |
CVE-2024-3439 | High | 7.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /Acco… |
CVE-2024-26574 | High | 7.8 | 2024-04-08 | Insecure Permissions vulnerability in Wondershare Filmora v.13.0.51 allows a local attacker to execute arbitrary code via a crafted script to the WSNativePushS… |
CVE-2024-3438 | High | 7.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /Ad… |
CVE-2024-27897 | High | 7.5 | 2024-04-08 | Input verification vulnerability in the call module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-27896 | High | 7.5 | 2024-04-08 | Input verification vulnerability in the log module. Impact: Successful exploitation of this vulnerability can affect integrity. |
CVE-2024-27895 | High | 7.5 | 2024-04-08 | Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2024-26811 | Critical | 9.8 | 2024-04-08 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate payload size in ipc response If installing malicious ksmbd-tools, ksmbd.m… |
CVE-2024-31375 | Medium | 5.4 | 2024-04-08 | Missing Authorization vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads.This issue affects WP2LEADS: from n/a through <= 3.2.7. |
CVE-2024-31357 | Medium | 6.5 | 2024-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Store… |
CVE-2024-23192 | Medium | 6.1 | 2024-04-08 | RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or succes… |
CVE-2024-23191 | Medium | 5.4 | 2024-04-08 | Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attack… |
CVE-2024-23190 | Medium | 5.4 | 2024-04-08 | Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would… |
CVE-2024-23189 | Medium | 5.4 | 2024-04-08 | Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker… |
CVE-2024-31022 | Critical | 9.8 | 2024-04-08 | An issue was discovered in CandyCMS version 1.0.0, allows remote attackers to execute arbitrary code via the install.php component. |
CVE-2024-27488 | Critical | 9.8 | 2024-04-08 | Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information… |
CVE-2024-1958 | Medium | 4.8 | 2024-04-08 | The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-1956 | Medium | 6.1 | 2024-04-08 | The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated reque… |
CVE-2024-1752 | Medium | 6.1 | 2024-04-08 | The Font Farsi WordPress plugin through 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-1589 | Medium | 6.1 | 2024-04-08 | The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-1588 | Medium | 6.8 | 2024-04-08 | The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-1292 | Medium | 4.7 | 2024-04-08 | The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cros… |
CVE-2024-23658 | Medium | 4.4 | 2024-04-08 | In camera driver, there is a possible use after free due to a logic error. This could lead to local denial of service with System execution privileges needed |
CVE-2024-28744 | High | 8.8 | 2024-04-08 | The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthentica… |
CVE-2024-3437 | High | 7.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2024-3436 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2024-3434 | Medium | 5.4 | 2024-04-08 | A vulnerability classified as critical was found in CP Plus Wi-Fi Camera up to 20240401. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2024-3433 | Low | 3.5 | 2024-04-07 | A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0. Affected is an unknown function of the file /backend/register… |
CVE-2024-3432 | Medium | 5.5 | 2024-04-07 | A vulnerability was found in PuneethReddyHC Event Management 1.0. It has been rated as critical. This issue affects some unknown processing of the file /backen… |
CVE-2024-3431 | Medium | 4.7 | 2024-04-07 | A vulnerability was found in EyouCMS 1.6.5. It has been declared as critical. This vulnerability affects unknown code of the file /login.php?m=admin&c=Field&a=… |
CVE-2024-3430 | Low | 2.4 | 2024-04-07 | A vulnerability was found in QKSMS up to 3.9.4 on Android. It has been classified as problematic. This affects an unknown part of the file androidmanifest.xml… |
CVE-2024-31951 | Medium | 6.5 | 2024-04-07 | In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA p… |
CVE-2024-31950 | Medium | 6.5 | 2024-04-07 | In FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets during an attempt to read Segment Rout… |
CVE-2024-31949 | Medium | 6.5 | 2024-04-07 | In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointe… |
CVE-2024-31948 | Medium | 6.5 | 2024-04-07 | In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash. |
CVE-2024-3428 | Low | 3.5 | 2024-04-07 | A vulnerability has been found in SourceCodester Online Courseware 1.0 and classified as problematic. This vulnerability affects unknown code of the file edit… |
CVE-2024-31349 | Medium | 6.5 | 2024-04-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailMunch – Grow your Email List allows Stored… |
CVE-2024-31348 | Medium | 6.5 | 2024-04-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Testimonials allows Stored XSS.This issue aff… |
CVE-2024-31346 | Medium | 6.5 | 2024-04-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blocksmarket Gradient Text Widget for Elementor allows St… |
CVE-2024-31345 | Critical | 9.1 | 2024-04-07 | Unrestricted Upload of File with Dangerous Type vulnerability in Sukhchain Singh Auto Poster.This issue affects Auto Poster: from n/a through 1.2. |
CVE-2024-31344 | Medium | 5.9 | 2024-04-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phpbits Creative Studio Easy Login Styler – White Label A… |
CVE-2024-31308 | Medium | 4.4 | 2024-04-07 | Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26. |
CVE-2024-31306 | Medium | 6.5 | 2024-04-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Stored… |
CVE-2024-31296 | Medium | 4.3 | 2024-04-07 | Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81. |
CVE-2024-31292 | High | 7.2 | 2024-04-07 | Unrestricted Upload of File with Dangerous Type vulnerability in Moove Agency Import XML and RSS Feeds.This issue affects Import XML and RSS Feeds: from n/a th… |
CVE-2024-31291 | Medium | 4.3 | 2024-04-07 | Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.6. |
CVE-2024-31288 | High | 7.2 | 2024-04-07 | Server-Side Request Forgery (SSRF) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize.This issue affects RapidLoad Power-Up for Autoptimize: from n/… |
CVE-2024-31286 | Critical | 9.9 | 2024-04-07 | Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from… |
CVE-2024-31280 | Critical | 9.9 | 2024-04-07 | Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1… |
CVE-2024-31277 | High | 8.7 | 2024-04-07 | Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer: from n/a through 1.0.32. |
CVE-2024-31260 | High | 7.6 | 2024-04-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WisdmLabs Edwiser Bridge.This issue affects Edwiser Bridg… |
CVE-2024-31258 | Medium | 6.5 | 2024-04-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.Company Form to Chat App allows Stored XSS.This iss… |
CVE-2024-31257 | Medium | 6.5 | 2024-04-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formsite Formsite | Embed online forms to collect orders… |
CVE-2024-31256 | High | 7.1 | 2024-04-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebinarPress allows Reflected XSS.This issue affects Webi… |
CVE-2024-31255 | High | 7.1 | 2024-04-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discoun… |
CVE-2024-31241 | High | 7.6 | 2024-04-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress LearnPress Export Import.This issue affects Lea… |
CVE-2024-31236 | Medium | 6.5 | 2024-04-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS.This is… |
CVE-2024-31234 | High | 8.5 | 2024-04-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sizam REHub Framework.This issue affects REHub Framework… |
CVE-2024-31233 | High | 8.5 | 2024-04-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sizam Rehub.This issue affects Rehub: from n/a through 19… |
CVE-2024-22155 | Medium | 4.3 | 2024-04-07 | Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.5.2. |
CVE-2024-3427 | Low | 3.5 | 2024-04-07 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Courseware 1.0. This affects an unknown part of the file addq.php. The… |
CVE-2024-3426 | Low | 3.5 | 2024-04-07 | A vulnerability, which was classified as problematic, has been found in SourceCodester Online Courseware 1.0. Affected by this issue is some unknown functional… |
CVE-2024-3425 | Medium | 6.3 | 2024-04-07 | A vulnerability classified as critical was found in SourceCodester Online Courseware 1.0. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2024-3424 | Medium | 6.3 | 2024-04-07 | A vulnerability classified as critical has been found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file admin/listscore.php… |
CVE-2024-3423 | Medium | 6.3 | 2024-04-07 | A vulnerability was found in SourceCodester Online Courseware 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/… |
CVE-2024-3422 | Medium | 6.3 | 2024-04-07 | A vulnerability was found in SourceCodester Online Courseware 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/… |
CVE-2024-3421 | Medium | 6.3 | 2024-04-07 | A vulnerability was found in SourceCodester Online Courseware 1.0. It has been classified as critical. This affects an unknown part of the file admin/deactivat… |
CVE-2024-3420 | Medium | 6.3 | 2024-04-07 | A vulnerability was found in SourceCodester Online Courseware 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-3419 | Medium | 6.3 | 2024-04-07 | A vulnerability has been found in SourceCodester Online Courseware 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-3418 | Medium | 6.3 | 2024-04-07 | A vulnerability, which was classified as critical, was found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file admin/deactiv… |
CVE-2024-30418 | High | 7.5 | 2024-04-07 | Vulnerability of insufficient permission verification in the app management module. Impact: Successful exploitation of this vulnerability will affect availabil… |
CVE-2024-30417 | High | 7.5 | 2024-04-07 | Path traversal vulnerability in the Bluetooth-based sharing module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-30416 | High | 7.5 | 2024-04-07 | Use After Free (UAF) vulnerability in the underlying driver module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-30415 | Critical | 9.1 | 2024-04-07 | Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-30414 | High | 7.5 | 2024-04-07 | Command injection vulnerability in the AccountManager module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-30413 | High | 7.5 | 2024-04-07 | Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-3417 | Medium | 6.3 | 2024-04-07 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Courseware 1.0. This issue affects some unknown processing of the fi… |
CVE-2024-3416 | Medium | 6.3 | 2024-04-07 | A vulnerability classified as critical was found in SourceCodester Online Courseware 1.0. This vulnerability affects unknown code of the file admin/editt.php… |
CVE-2024-3415 | Low | 3.5 | 2024-04-06 | A vulnerability was found in SourceCodester Human Resource Information System 1.0. It has been classified as problematic. Affected is an unknown function of th… |
CVE-2024-3414 | Low | 3.5 | 2024-04-06 | A vulnerability was found in SourceCodester Human Resource Information System 1.0 and classified as problematic. This issue affects some unknown processing of… |
CVE-2024-3413 | High | 7.3 | 2024-04-06 | A vulnerability has been found in SourceCodester Human Resource Information System 1.0 and classified as critical. This vulnerability affects unknown code of t… |
CVE-2024-28741 | High | 8.8 | 2024-04-06 | Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component. |
CVE-2024-27620 | High | 7.5 | 2024-04-06 | An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request to the API. |
CVE-2024-0406 | Medium | 6.1 | 2024-04-06 | A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow acces… |
CVE-2024-3159 | High | 8.8 | 2024-04-06 | Out of bounds memory access in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (… |
CVE-2024-3158 | High | 8.8 | 2024-04-06 | Use after free in Bookmarks in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-3156 | High | 8.8 | 2024-04-06 | Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2024-3378 | Medium | 4.3 | 2024-04-06 | A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2024-3377 | Medium | 4.3 | 2024-04-06 | A vulnerability classified as problematic was found in SourceCodester Computer Laboratory Management System 1.0. This vulnerability affects unknown code of the… |
CVE-2024-3376 | High | 7.3 | 2024-04-06 | A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file con… |
CVE-2024-25029 | Critical | 9.0 | 2024-04-06 | IBM Personal Communications 14.0.6 through 15.0.1 includes a Windows service that is vulnerable to remote code execution (RCE) and local privilege escalation (… |
CVE-2024-24746 | High | 7.5 | 2024-04-06 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. Specially crafted GATT operation can cause infinite loop in GATT serve… |
CVE-2024-22328 | High | 7.5 | 2024-04-06 | IBM Maximo Application Suite 8.10 and 8.11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL… |
CVE-2024-3369 | Medium | 6.3 | 2024-04-06 | A vulnerability, which was classified as critical, has been found in code-projects Car Rental 1.0. Affected by this issue is some unknown functionality of the… |
CVE-2024-3366 | Low | 3.5 | 2024-04-06 | A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job… |
CVE-2024-3365 | Low | 3.5 | 2024-04-06 | A vulnerability was found in SourceCodester Online Library System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file… |
CVE-2024-3364 | Low | 3.5 | 2024-04-06 | A vulnerability was found in SourceCodester Online Library System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file… |