2024 CVEs (page 333)
Page 333 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2964 | Medium | 5.4 | 2024-03-29 | The Pocket News Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.0. This is due to missing… |
CVE-2024-2963 | Medium | 4.4 | 2024-03-29 | The Pocket News Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as "Consumer Key" and "Access Token" in all… |
CVE-2024-2476 | Medium | 4.3 | 2024-03-29 | The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane function in all ver… |
CVE-2024-2280 | Medium | 6.4 | 2024-03-29 | The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget link URL values in all versions up to, and includi… |
CVE-2024-2116 | Medium | 6.1 | 2024-03-29 | The Christmas Greetings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the code parameter in all versions up to, and including, 1.2.5… |
CVE-2024-2113 | Medium | 4.3 | 2024-03-29 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2024-2108 | Medium | 4.6 | 2024-03-29 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image titl… |
CVE-2024-1872 | High | 8.8 | 2024-03-29 | The Button plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.27 via deserialization of untrusted input in th… |
CVE-2024-1858 | Medium | 5.4 | 2024-03-29 | The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.9 via de… |
CVE-2024-0956 | Medium | 4.9 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection… |
CVE-2024-0913 | High | 7.2 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection… |
CVE-2024-0609 | High | 7.2 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2024-0608 | Medium | 6.5 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to union-based SQL Injectio… |
CVE-2024-2936 | Medium | 6.4 | 2024-03-29 | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute of widgets in all versions up to, and including, 1.2… |
CVE-2024-2844 | Medium | 4.3 | 2024-03-29 | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointmen… |
CVE-2024-2842 | Medium | 6.4 | 2024-03-29 | The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all versions up to, an… |
CVE-2024-28960 | High | 8.2 | 2024-03-29 | An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory. |
CVE-2024-3077 | Medium | 6.8 | 2024-03-29 | An malicious BLE device can crash BLE victim device by sending malformed gatt packet |
CVE-2024-2841 | Medium | 6.4 | 2024-03-29 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2024-2475 | Medium | 6.4 | 2024-03-29 | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including… |
CVE-2024-1729 | Medium | 5.9 | 2024-03-29 | A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from th… |
CVE-2024-29489 | Medium | 5.5 | 2024-03-28 | Jerryscript 2.4.0 has SEGV at ./jerry-core/ecma/base/ecma-helpers.c:238:58 in ecma_get_object_type. |
CVE-2024-29316 | Medium | 6.3 | 2024-03-28 | NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true. |
CVE-2024-28714 | High | 8.1 | 2024-03-28 | SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter. |
CVE-2024-28456 | Medium | 5.4 | 2024-03-28 | Cross Site Scripting vulnerability in Campcodes Online Marriage Registration System v.1.0 allows a remote attacker to execute arbitrary code via the text field… |
CVE-2024-24407 | Medium | 5.3 | 2024-03-28 | SQL Injection vulnerability in Best Courier management system v.1.0 allows a remote attacker to obtain sensitive information via print_pdets.php component. |
CVE-2024-23727 | High | 8.4 | 2024-03-28 | The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary JavaScript code vi… |
CVE-2024-28091 | Medium | 6.1 | 2024-03-28 | Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via… |
CVE-2024-28090 | Medium | 5.4 | 2024-03-28 | Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via… |
CVE-2024-25506 | Medium | 6.5 | 2024-03-28 | Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control of the pm_sys_sys c… |
CVE-2024-3019 | High | 8.8 | 2024-03-28 | A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the pr… |
CVE-2024-31065 | Medium | 6.1 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the City input field. |
CVE-2024-31064 | Medium | 6.1 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input… |
CVE-2024-31063 | Medium | 6.4 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Email input fiel… |
CVE-2024-31062 | Medium | 6.3 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Street input fie… |
CVE-2024-31061 | Medium | 6.1 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Last Name input… |
CVE-2024-2947 | High | 7.3 | 2024-03-28 | A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in… |
CVE-2024-28713 | Critical | 9.8 | 2024-03-28 | An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature. |
CVE-2024-27719 | Medium | 6.1 | 2024-03-28 | A cross site scripting (XSS) vulnerability in rems FAQ Management System v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload t… |
CVE-2024-25971 | Medium | 5.5 | 2024-03-28 | Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exp… |
CVE-2024-25963 | Medium | 5.9 | 2024-03-28 | Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker cou… |
CVE-2024-25960 | High | 7.3 | 2024-03-28 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability. A local low privileged attacke… |
CVE-2024-25955 | High | 7.2 | 2024-03-28 | Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability lea… |
CVE-2024-25954 | Medium | 5.3 | 2024-03-28 | Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could pote… |
CVE-2024-25953 | Medium | 6.0 | 2024-03-28 | Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could… |
CVE-2024-25952 | Medium | 6.0 | 2024-03-28 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could… |
CVE-2024-25946 | High | 7.2 | 2024-03-28 | Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability lea… |
CVE-2024-25961 | Medium | 6.0 | 2024-03-28 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an improper privilege management vulnerability. A local high privileged attacker could potentia… |
CVE-2024-25959 | High | 7.9 | 2024-03-28 | Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an insertion of sensitive information into log file vulnerability. A low privileged local attac… |
CVE-2024-3042 | Medium | 6.3 | 2024-03-28 | A vulnerability was found in SourceCodester Simple Subscription Website 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-3041 | Medium | 6.3 | 2024-03-28 | A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-3040 | Medium | 6.3 | 2024-03-28 | A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /ad… |
CVE-2024-3039 | Medium | 6.3 | 2024-03-28 | A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/exp… |
CVE-2024-31140 | Medium | 4.1 | 2024-03-28 | In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools |
CVE-2024-31139 | Medium | 5.9 | 2024-03-28 | In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector |
CVE-2024-31138 | Medium | 4.6 | 2024-03-28 | In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings |
CVE-2024-31137 | Medium | 6.8 | 2024-03-28 | In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration |
CVE-2024-31136 | High | 7.4 | 2024-03-28 | In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter |
CVE-2024-31135 | Medium | 6.1 | 2024-03-28 | In JetBrains TeamCity before 2024.03 open redirect was possible on the login page |
CVE-2024-31134 | Medium | 6.5 | 2024-03-28 | In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled |
CVE-2024-30612 | High | 8.1 | 2024-03-28 | Tenda AC10U v15.03.06.48 has a stack overflow vulnerability in the deviceId, limitSpeed, limitSpeedUp parameter from formSetClientState function. |
CVE-2024-30604 | High | 7.5 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the list1 parameter of the fromDhcpListClient function. |
CVE-2024-30603 | Medium | 6.5 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function. |
CVE-2024-30602 | Critical | 9.8 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function. |
CVE-2024-30601 | High | 8.0 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function. |
CVE-2024-30600 | High | 8.0 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function. |
CVE-2024-30599 | High | 8.8 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function. |
CVE-2024-30598 | Medium | 6.5 | 2024-03-28 | Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function. |
CVE-2024-30597 | Medium | 6.5 | 2024-03-28 | Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function. |
CVE-2024-0259 | High | 7.3 | 2024-03-28 | Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the serv… |
CVE-2024-30607 | High | 8.0 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function. |
CVE-2024-30606 | High | 8.0 | 2024-03-28 | Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the page parameter of the fromDhcpListClient function. |
CVE-2024-30592 | High | 8.0 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the page parameter of the fromAddressNat function. |
CVE-2024-30591 | High | 8.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function. |
CVE-2024-30590 | Medium | 6.5 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function. |
CVE-2024-30589 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability in the entrys parameter of the fromAddressNat function. |
CVE-2024-30588 | Medium | 4.3 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function. |
CVE-2024-30587 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function. |
CVE-2024-30586 | Medium | 6.5 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function. |
CVE-2024-30585 | Medium | 6.5 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function. |
CVE-2024-30584 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function. |
CVE-2024-30583 | High | 8.0 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the mitInterface parameter of the fromAddressNat function. |
CVE-2024-29898 | Medium | 4.9 | 2024-03-28 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed… |
CVE-2024-29897 | Medium | 4.9 | 2024-03-28 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) on any wiki in the f… |
CVE-2024-29882 | High | 7.2 | 2024-03-28 | SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callback function name… |
CVE-2024-29200 | Medium | 6.8 | 2024-03-28 | Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus return… |
CVE-2024-28109 | High | 8.1 | 2024-03-28 | veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote… |
CVE-2024-30596 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the formSetDeviceName function. |
CVE-2024-30594 | Medium | 6.5 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function. |
CVE-2024-30593 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability located in the deviceName parameter of the formSetDeviceName function. |
CVE-2024-29896 | High | 7.5 | 2024-03-28 | Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR co… |
CVE-2024-27775 | High | 7.2 | 2024-03-28 | SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash |
CVE-2024-30595 | Critical | 9.8 | 2024-03-28 | Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the addWifiMacFilter function. |
CVE-2024-30422 | Medium | 6.5 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-eleme… |
CVE-2024-30421 | Medium | 4.3 | 2024-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.7.1. |
CVE-2024-2818 | Medium | 4.3 | 2024-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16… |
CVE-2024-2890 | Critical | 9.1 | 2024-03-28 | Unrestricted Upload of File with Dangerous Type vulnerability in Tumult Inc. Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through… |
CVE-2024-29241 | Critical | 9.9 | 2024-03-28 | Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated u… |
CVE-2024-29240 | Medium | 4.3 | 2024-03-28 | Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticat… |
CVE-2024-29239 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi component in Synology Su… |