2024 CVEs (page 332)
Page 332 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-30447 | High | 7.1 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Solutions Creative Image Slider – Responsive Sli… |
CVE-2024-30446 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms allows Stored XSS.This issue af… |
CVE-2024-30445 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab, Inc. Web Icons allows Stored XSS.This issue aff… |
CVE-2024-30444 | Medium | 5.9 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zionbuilder.Io WordPress Page Builder – Zion Builder allo… |
CVE-2024-29640 | Critical | 9.8 | 2024-03-29 | An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_q… |
CVE-2024-25944 | Medium | 5.7 | 2024-03-29 | Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. An unauthenticated remote attacker could potentially exploit this vulner… |
CVE-2024-30645 | High | 8.0 | 2024-03-29 | Tenda AC15V1.0 V15.03.20_multi has a command injection vulnerability via the deviceName parameter. |
CVE-2024-30521 | Medium | 5.4 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in Landingi Landingi Landing Pages.This issue affects Landingi Landing Pages: from n/a through 3.1.1. |
CVE-2024-30518 | Medium | 4.3 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Field… |
CVE-2024-30514 | Medium | 5.3 | 2024-03-29 | Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Payfast Gateway Add On.This issue affects Paid Me… |
CVE-2024-30513 | Medium | 6.5 | 2024-03-29 | Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2. |
CVE-2024-30511 | Medium | 5.3 | 2024-03-29 | Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce.This issue affects FG PrestaShop to WooCommerce… |
CVE-2024-30492 | Medium | 4.3 | 2024-03-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Impo… |
CVE-2024-30482 | Medium | 4.3 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in Brice CAPOBIANCO Simple Revisions Delete.This issue affects Simple Revisions Delete: from n/a through 1.5.3. |
CVE-2024-30477 | Medium | 5.3 | 2024-03-29 | Missing Authorization vulnerability in Klarna Klarna Payments for WooCommerce.This issue affects Klarna Payments for WooCommerce: from n/a through 3.2.4. |
CVE-2024-30469 | Medium | 5.3 | 2024-03-29 | Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0. |
CVE-2024-30247 | Critical | 10.0 | 2024-03-29 | NextcloudPi is a ready to use image for Virtual Machines, Raspberry Pi, Odroid HC1, Rock64 and other boards. A command injection vulnerability in NextCloudPi a… |
CVE-2024-30246 | High | 7.6 | 2024-03-29 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete… |
CVE-2024-29904 | High | 7.5 | 2024-03-29 | CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by… |
CVE-2024-29901 | Medium | 4.8 | 2024-03-29 | The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired ses… |
CVE-2024-29900 | High | 7.5 | 2024-03-29 | Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A… |
CVE-2024-29686 | High | 7.2 | 2024-03-29 | Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS P… |
CVE-2024-3081 | Low | 3.5 | 2024-03-29 | A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete o… |
CVE-2024-30508 | Medium | 6.5 | 2024-03-29 | Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2. |
CVE-2024-30507 | Low | 2.7 | 2024-03-29 | Authorization Bypass Through User-Controlled Key vulnerability in Molongui.This issue affects Molongui: from n/a through 4.7.7. |
CVE-2024-30506 | High | 7.1 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Stored XSS.T… |
CVE-2024-30505 | Medium | 6.5 | 2024-03-29 | Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18. |
CVE-2024-30504 | High | 7.6 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: fro… |
CVE-2024-30502 | Critical | 9.3 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: fro… |
CVE-2024-29893 | Medium | 6.5 | 2024-03-29 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server com… |
CVE-2024-29890 | High | 8.8 | 2024-03-29 | DataLens is a business intelligence and data visualization system. A specifically crafted request allowed the creation of a special chart type with the ability… |
CVE-2024-29202 | Critical | 9.9 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerabili… |
CVE-2024-29201 | Critical | 9.9 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpSe… |
CVE-2024-29024 | Medium | 4.6 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object… |
CVE-2024-29020 | Medium | 4.6 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information conta… |
CVE-2024-28867 | Medium | 5.9 | 2024-03-29 | Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string… |
CVE-2024-28405 | High | 7.2 | 2024-03-29 | SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin is a valid user in the admin page becau… |
CVE-2024-27619 | High | 7.3 | 2024-03-29 | Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer Overflow. Any user having read/write access to ftp server can write directly to ram causing buffer… |
CVE-2024-23539 | High | 8.3 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8… |
CVE-2024-23538 | Critical | 9.9 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8… |
CVE-2024-23537 | High | 8.4 | 2024-03-29 | Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.9.0… |
CVE-2024-30639 | Medium | 6.5 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability in the page parameter of fromAddressNat function. |
CVE-2024-30638 | Medium | 4.3 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the entrys parameter in the fromAddressNat function. |
CVE-2024-30637 | High | 8.8 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a command injection vulnerablility in the formWriteFacMac function in the mac parameter. |
CVE-2024-30636 | Medium | 6.5 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the PPPOEPassword parameter in the formQuickIndex function. |
CVE-2024-30635 | Critical | 9.8 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability located in the funcpara1 parameter in the formSetCfm function. |
CVE-2024-30634 | High | 8.0 | 2024-03-29 | Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the mitInterface parameter in the fromAddressNat function. |
CVE-2024-30510 | Critical | 10.0 | 2024-03-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a th… |
CVE-2024-30501 | High | 7.6 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Moni… |
CVE-2024-30500 | Critical | 9.9 | 2024-03-29 | Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dy… |
CVE-2024-30499 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Fo… |
CVE-2024-30498 | Critical | 9.3 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Fo… |
CVE-2024-30497 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal ver… |
CVE-2024-30496 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BdThemes Element Pack Elementor Addons.This issue affects… |
CVE-2024-30495 | High | 7.6 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Faboba Falang multilanguage.This issue affects Falang mul… |
CVE-2024-30494 | High | 7.6 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 沈唁 OSS Aliyun.This issue affects OSS Aliyun: from n/a thr… |
CVE-2024-30493 | Medium | 4.3 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.7. |
CVE-2024-30491 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : fr… |
CVE-2024-30490 | Critical | 9.3 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : fr… |
CVE-2024-30488 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from… |
CVE-2024-30487 | High | 7.6 | 2024-03-29 | Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio… |
CVE-2024-30486 | High | 8.5 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Max Foundry Media Library Folders.This issue affects Medi… |
CVE-2024-30478 | High | 7.6 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bulletin WordPress Announcement & Notification Banner Plu… |
CVE-2024-30430 | Medium | 5.9 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Email Newsletter Team - FluentCRM Fluent CRM allows St… |
CVE-2024-30429 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hans Matzen allows Stored XSS.This issue affects wp-forec… |
CVE-2024-30428 | High | 7.1 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Galle… |
CVE-2024-30427 | Medium | 5.4 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Reflected XSS.This… |
CVE-2024-30426 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Hash Elements allows Stored XSS.This issue aff… |
CVE-2024-30425 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version… |
CVE-2024-30423 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BetterAddons Better Elementor Addons allows Stored XSS.Th… |
CVE-2024-3078 | Medium | 5.5 | 2024-03-29 | A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the file lib/collection/s… |
CVE-2024-30633 | Medium | 6.5 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security parameter from the formWifiBasicSet function. |
CVE-2024-30632 | Medium | 6.5 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security_5g parameter from formWifiBasicSet function. |
CVE-2024-30631 | Medium | 4.3 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the schedStartTime parameter from setSchedWifi function. |
CVE-2024-30630 | Critical | 9.8 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the time parameter from saveParentControlInfo function. |
CVE-2024-30629 | Medium | 5.7 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the list1 parameter from fromDhcpListClient function. |
CVE-2024-30628 | Critical | 9.8 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the page parameter from fromAddressNat function. |
CVE-2024-30627 | High | 8.8 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the deviceId parameter from saveParentControlInfo function. |
CVE-2024-30626 | High | 8.0 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the schedEndTime parameter from setSchedWifi function. |
CVE-2024-30625 | High | 8.0 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the entrys parameter from fromAddressNat function. |
CVE-2024-30624 | High | 8.8 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the urls parameter from saveParentControlInfo function. |
CVE-2024-30623 | Medium | 6.5 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the page parameter from fromDhcpListClient function. |
CVE-2024-30622 | Critical | 9.8 | 2024-03-29 | Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the mitInterface parameter from fromAddressNat function. |
CVE-2024-30613 | Medium | 4.3 | 2024-03-29 | Tenda AC15 v15.03.05.18 has a stack overflow vulnerability in the time parameter from the setSmartPowerManagement function. |
CVE-2024-30520 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labib Ahmed Carousel Anything For WPBakery Page Builder a… |
CVE-2024-30519 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lordicon Lordicon Animated Icons allows Stored XSS.This i… |
CVE-2024-30503 | High | 7.1 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.This issue affects Mailster… |
CVE-2024-30483 | Medium | 6.5 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Sponsorships Sponsors allows Stored XSS.This issue… |
CVE-2024-30458 | Medium | 4.3 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOOCS – WooCommerce Currency Switcher.This issue affects WOOCS – WooCommerce Currency Switcher: f… |
CVE-2024-30457 | Medium | 4.3 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxon… |
CVE-2024-30456 | Medium | 4.3 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WPCS.This issue affects WPCS: from n/a through 1.2.0.1. |
CVE-2024-23449 | Medium | 4.3 | 2024-03-29 | An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasti… |
CVE-2024-2848 | High | 7.5 | 2024-03-29 | The Responsive theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_footer_text_callback functi… |
CVE-2024-3061 | High | 7.2 | 2024-03-29 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5… |
CVE-2024-2411 | Critical | 9.8 | 2024-03-29 | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This make… |
CVE-2024-2409 | Critical | 9.8 | 2024-03-29 | The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validat… |
CVE-2024-2250 | Medium | 6.4 | 2024-03-29 | The 130+ Widgets | Best Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions… |
CVE-2024-2970 | Medium | 4.3 | 2024-03-29 | The News Wall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect… |
CVE-2024-2969 | Medium | 5.4 | 2024-03-29 | The WP-Eggdrop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect… |
CVE-2024-2968 | Medium | 4.4 | 2024-03-29 | The WP-Eggdrop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.1 due to insufficie… |