2024 CVEs (page 332)
Page 332 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-29893 | Medium | 6.5 | 2024-03-29 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server com… |
CVE-2024-29890 | High | 8.8 | 2024-03-29 | DataLens is a business intelligence and data visualization system. A specifically crafted request allowed the creation of a special chart type with the ability… |
CVE-2024-29202 | Critical | 9.9 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerabili… |
CVE-2024-29201 | Critical | 9.9 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpSe… |
CVE-2024-29024 | Medium | 4.6 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object… |
CVE-2024-29020 | Medium | 4.6 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information conta… |
CVE-2024-28867 | Medium | 5.9 | 2024-03-29 | Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string… |
CVE-2024-28405 | High | 7.2 | 2024-03-29 | SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin is a valid user in the admin page becau… |
CVE-2024-27619 | High | 7.3 | 2024-03-29 | Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer Overflow. Any user having read/write access to ftp server can write directly to ram causing buffer… |
CVE-2024-23539 | High | 8.3 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8… |
CVE-2024-23538 | Critical | 9.9 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8… |
CVE-2024-23537 | High | 8.4 | 2024-03-29 | Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.9.0… |
CVE-2024-30639 | Medium | 6.5 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability in the page parameter of fromAddressNat function. |
CVE-2024-30638 | Medium | 4.3 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the entrys parameter in the fromAddressNat function. |
CVE-2024-30637 | High | 8.8 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a command injection vulnerablility in the formWriteFacMac function in the mac parameter. |
CVE-2024-30636 | Medium | 6.5 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the PPPOEPassword parameter in the formQuickIndex function. |
CVE-2024-30635 | Critical | 9.8 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability located in the funcpara1 parameter in the formSetCfm function. |
CVE-2024-30634 | High | 8.0 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the mitInterface parameter in the fromAddressNat function. |
CVE-2024-30510 | Critical | 10.0 | 2024-03-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a th… |
CVE-2024-30501 | High | 7.6 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Moni… |
CVE-2024-30500 | Critical | 9.9 | 2024-03-29 | Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dy… |
CVE-2024-30499 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Fo… |
CVE-2024-30498 | Critical | 9.3 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Fo… |
CVE-2024-30497 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal ver… |
CVE-2024-30496 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BdThemes Element Pack Elementor Addons.This issue affects… |
CVE-2024-30495 | High | 7.6 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Faboba Falang multilanguage.This issue affects Falang mul… |
CVE-2024-30494 | High | 7.6 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 沈唁 OSS Aliyun.This issue affects OSS Aliyun: from n/a thr… |
CVE-2024-30493 | Medium | 4.3 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.7. |
CVE-2024-30491 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : fr… |
CVE-2024-30490 | Critical | 9.3 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : fr… |
CVE-2024-30488 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from… |
CVE-2024-30487 | High | 7.6 | 2024-03-29 | Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio… |
CVE-2024-30486 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Max Foundry Media Library Folders.This issue affects Medi… |
CVE-2024-30478 | High | 7.6 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bulletin WordPress Announcement & Notification Banner Plu… |
CVE-2024-30430 | Medium | 5.9 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Email Newsletter Team - FluentCRM Fluent CRM allows St… |
CVE-2024-30429 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hans Matzen allows Stored XSS.This issue affects wp-forec… |
CVE-2024-30428 | High | 7.1 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Galle… |
CVE-2024-30427 | Medium | 5.4 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Reflected XSS.This… |
CVE-2024-30426 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Hash Elements allows Stored XSS.This issue aff… |
CVE-2024-30425 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version… |
CVE-2024-30423 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BetterAddons Better Elementor Addons allows Stored XSS.Th… |
CVE-2024-3078 | Medium | 5.5 | 2024-03-29 | A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the file lib/collection/s… |
CVE-2024-30633 | Medium | 6.5 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security parameter from the formWifiBasicSet function. |
CVE-2024-30632 | Medium | 6.5 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security_5g parameter from formWifiBasicSet function. |
CVE-2024-30631 | Medium | 4.3 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the schedStartTime parameter from setSchedWifi function. |
CVE-2024-30630 | Critical | 9.8 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the time parameter from saveParentControlInfo function. |
CVE-2024-30629 | Medium | 5.7 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the list1 parameter from fromDhcpListClient function. |
CVE-2024-30628 | Critical | 9.8 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the page parameter from fromAddressNat function. |
CVE-2024-30627 | High | 8.8 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the deviceId parameter from saveParentControlInfo function. |
CVE-2024-30626 | High | 8.0 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the schedEndTime parameter from setSchedWifi function. |
CVE-2024-30625 | High | 8.0 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the entrys parameter from fromAddressNat function. |
CVE-2024-30624 | High | 8.8 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the urls parameter from saveParentControlInfo function. |
CVE-2024-30623 | Medium | 6.5 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the page parameter from fromDhcpListClient function. |
CVE-2024-30622 | Critical | 9.8 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the mitInterface parameter from fromAddressNat function. |
CVE-2024-30613 | Medium | 4.3 | 2024-03-29 | Tenda AC15 v15.03.05.18 has a stack overflow vulnerability in the time parameter from the setSmartPowerManagement function. |
CVE-2024-30520 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labib Ahmed Carousel Anything For WPBakery Page Builder a… |
CVE-2024-30519 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lordicon Lordicon Animated Icons allows Stored XSS.This i… |
CVE-2024-30503 | High | 7.1 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.This issue affects Mailster… |
CVE-2024-30483 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Sponsorships Sponsors allows Stored XSS.This issue… |
CVE-2024-30458 | Medium | 4.3 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOOCS – WooCommerce Currency Switcher.This issue affects WOOCS – WooCommerce Currency Switcher: f… |
CVE-2024-30457 | Medium | 4.3 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxon… |
CVE-2024-30456 | Medium | 4.3 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WPCS.This issue affects WPCS: from n/a through 1.2.0.1. |
CVE-2024-23449 | Medium | 4.3 | 2024-03-29 | An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasti… |
CVE-2024-2848 | High | 7.5 | 2024-03-29 | The Responsive theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_footer_text_callback functi… |
CVE-2024-3061 | High | 7.2 | 2024-03-29 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5… |
CVE-2024-2411 | Critical | 9.8 | 2024-03-29 | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This make… |
CVE-2024-2409 | Critical | 9.8 | 2024-03-29 | The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validat… |
CVE-2024-2250 | Medium | 6.4 | 2024-03-29 | The 130+ Widgets | Best Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions… |
CVE-2024-2970 | Medium | 4.3 | 2024-03-29 | The News Wall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect… |
CVE-2024-2969 | Medium | 5.4 | 2024-03-29 | The WP-Eggdrop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect… |
CVE-2024-2968 | Medium | 4.4 | 2024-03-29 | The WP-Eggdrop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.1 due to insufficie… |
CVE-2024-2964 | Medium | 5.4 | 2024-03-29 | The Pocket News Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.0. This is due to missing… |
CVE-2024-2963 | Medium | 4.4 | 2024-03-29 | The Pocket News Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as "Consumer Key" and "Access Token" in all… |
CVE-2024-2476 | Medium | 4.3 | 2024-03-29 | The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane function in all ver… |
CVE-2024-2280 | Medium | 6.4 | 2024-03-29 | The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget link URL values in all versions up to, and includi… |
CVE-2024-2116 | Medium | 6.1 | 2024-03-29 | The Christmas Greetings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the code parameter in all versions up to, and including, 1.2.5… |
CVE-2024-2113 | Medium | 4.3 | 2024-03-29 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2024-2108 | Medium | 4.6 | 2024-03-29 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image titl… |
CVE-2024-1872 | High | 8.8 | 2024-03-29 | The Button plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.27 via deserialization of untrusted input in th… |
CVE-2024-1858 | Medium | 5.4 | 2024-03-29 | The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.9 via de… |
CVE-2024-0956 | Medium | 4.9 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection… |
CVE-2024-0913 | High | 7.2 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection… |
CVE-2024-0609 | High | 7.2 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2024-0608 | Medium | 6.5 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to union-based SQL Injectio… |
CVE-2024-2936 | Medium | 6.4 | 2024-03-29 | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute of widgets in all versions up to, and including, 1.2… |
CVE-2024-2844 | Medium | 4.3 | 2024-03-29 | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointmen… |
CVE-2024-2842 | Medium | 6.4 | 2024-03-29 | The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all versions up to, an… |
CVE-2024-28960 | High | 8.2 | 2024-03-29 | An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory. |
CVE-2024-3077 | Medium | 6.8 | 2024-03-29 | An malicious BLE device can crash BLE victim device by sending malformed gatt packet |
CVE-2024-2841 | Medium | 6.4 | 2024-03-29 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2024-2475 | Medium | 6.4 | 2024-03-29 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including… |
CVE-2024-1729 | Medium | 5.9 | 2024-03-29 | A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from th… |
CVE-2024-29489 | Medium | 5.5 | 2024-03-28 | Jerryscript 2.4.0 has SEGV at ./jerry-core/ecma/base/ecma-helpers.c:238:58 in ecma_get_object_type. |
CVE-2024-29316 | Medium | 6.3 | 2024-03-28 | NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true. |
CVE-2024-28714 | High | 8.1 | 2024-03-28 | SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter. |
CVE-2024-28456 | Medium | 5.4 | 2024-03-28 | Cross Site Scripting vulnerability in Campcodes Online Marriage Registration System v.1.0 allows a remote attacker to execute arbitrary code via the text field… |
CVE-2024-24407 | Medium | 5.3 | 2024-03-28 | SQL Injection vulnerability in Best Courier management system v.1.0 allows a remote attacker to obtain sensitive information via print_pdets.php component. |
CVE-2024-23727 | High | 8.4 | 2024-03-28 | The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary JavaScript code vi… |
CVE-2024-28091 | Medium | 6.1 | 2024-03-28 | Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via… |
CVE-2024-28090 | Medium | 5.4 | 2024-03-28 | Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via… |