2024 CVEs (page 334)
Page 334 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-29238 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component in Synology Surveill… |
CVE-2024-29237 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in Synology Surveillan… |
CVE-2024-29236 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delete webapi component in Synology Surveill… |
CVE-2024-29235 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog webapi component in Synology Surveillanc… |
CVE-2024-29234 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi component in Synology Surveillance Stat… |
CVE-2024-29233 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi component in Synology Surveillance Sta… |
CVE-2024-29232 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi component in Synology Surveillance Stat… |
CVE-2024-29231 | Medium | 5.4 | 2024-03-28 | Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allo… |
CVE-2024-29230 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByCategory webapi component in Synology Sur… |
CVE-2024-29229 | High | 7.7 | 2024-03-28 | Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authen… |
CVE-2024-29228 | High | 7.7 | 2024-03-28 | Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenti… |
CVE-2024-29227 | Medium | 5.4 | 2024-03-28 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in Synology Surveillan… |
CVE-2024-28002 | High | 7.1 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Archetyped Cornerstone allows Reflected XSS.This issue af… |
CVE-2024-28001 | High | 7.1 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Archetyped Favicon Rotator allows Reflected XSS.This issu… |
CVE-2024-27999 | High | 7.1 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digamber Pradhan Preview E-mails for WooCommerce allows R… |
CVE-2024-25924 | High | 7.6 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trustindex.Io WP Testimonials.This issue affects WP Testi… |
CVE-2024-25923 | Medium | 5.3 | 2024-03-28 | Insertion of Sensitive Information into Log File vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.2.7.0. |
CVE-2024-25599 | High | 7.1 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple… |
CVE-2024-22138 | Medium | 5.3 | 2024-03-28 | Insertion of Sensitive Information into Log File vulnerability in Seraphinite Solutions Seraphinite Accelerator.This issue affects Seraphinite Accelerator: fro… |
CVE-2024-30221 | Medium | 5.4 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a t… |
CVE-2024-30200 | High | 7.1 | 2024-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR allows Reflected XSS.This issue affects B… |
CVE-2024-29100 | Critical | 9.1 | 2024-03-28 | Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a… |
CVE-2024-29090 | Medium | 6.8 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4. |
CVE-2024-28004 | Medium | 5.4 | 2024-03-28 | Missing Authorization vulnerability in ExtendThemes Colibri Page Builder.This issue affects Colibri Page Builder: from n/a through 1.0.248. |
CVE-2024-28003 | Medium | 5.4 | 2024-03-28 | Missing Authorization vulnerability in Megamenu Max Mega Menu.This issue affects Max Mega Menu: from n/a through 3.3. |
CVE-2024-23500 | High | 7.7 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence… |
CVE-2024-30245 | High | 7.6 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pierre Lannoy DecaLog decalog.This issue affects DecaLog… |
CVE-2024-30244 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin.This issue affects C… |
CVE-2024-30243 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tomas WordPress Tooltips.This issue affects WordPress Too… |
CVE-2024-30242 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions Contact Form to Any API.This issue affe… |
CVE-2024-30241 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : fr… |
CVE-2024-30240 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Typps Calendarista.This issue affects Calendarista: from… |
CVE-2024-30239 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/… |
CVE-2024-30237 | High | 7.6 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Supsystic Slider by Supsystic.This issue affects Slider b… |
CVE-2024-30236 | High | 8.5 | 2024-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Galle… |
CVE-2024-30230 | High | 8.2 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce.This issue affects PDF Invoices and Packing Slips For… |
CVE-2024-30229 | High | 8.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.4.2. |
CVE-2024-30228 | Critical | 9.9 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in Hercules Design Hercules Core.This issue affects Hercules Core : from n/a through 6.4. |
CVE-2024-30227 | Critical | 9.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in INFINITUM FORM Geo Controller.This issue affects Geo Controller: from n/a through 8.6.4. |
CVE-2024-30226 | Critical | 9.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in WPDeveloper BetterDocs.This issue affects BetterDocs: from n/a through 3.3.3. |
CVE-2024-30225 | Critical | 10.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in WPENGINE, INC. WP Migrate.This issue affects WP Migrate: from n/a through 2.6.10. |
CVE-2024-30224 | Critical | 10.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.2. |
CVE-2024-30223 | Critical | 9.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26. |
CVE-2024-30222 | High | 8.5 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26. |
CVE-2024-0677 | Medium | 5.1 | 2024-03-28 | The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege… |
CVE-2024-0673 | Medium | 6.1 | 2024-03-28 | The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-0672 | High | 7.1 | 2024-03-28 | The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2024-2091 | Medium | 5.4 | 2024-03-28 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1… |
CVE-2024-3024 | Medium | 5.3 | 2024-03-28 | A vulnerability was found in appneta tcpreplay up to 4.4.4. It has been classified as problematic. This affects the function get_layer4_v6 of the file /tcprepl… |
CVE-2024-3015 | Medium | 6.3 | 2024-03-28 | A vulnerability classified as critical was found in SourceCodester Simple Subscription Website 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2024-2111 | Medium | 6.4 | 2024-03-28 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value i… |
CVE-2024-2110 | Medium | 4.3 | 2024-03-28 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-1770 | High | 8.8 | 2024-03-28 | The Meta Tag Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.2 via deserialization of untrusted in… |
CVE-2024-3014 | Medium | 6.3 | 2024-03-28 | A vulnerability classified as critical has been found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file Actions.ph… |
CVE-2024-3013 | Medium | 6.3 | 2024-03-28 | A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the… |
CVE-2024-28016 | Medium | 6.0 | 2024-03-28 | Improper Access Controlvulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-M… |
CVE-2024-28015 | Critical | 9.8 | 2024-03-28 | Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3… |
CVE-2024-28014 | Critical | 9.8 | 2024-03-28 | Stack-based Buffer Overflow vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200… |
CVE-2024-28013 | Medium | 5.3 | 2024-03-28 | Use of Insufficiently Random Values vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP… |
CVE-2024-28012 | Critical | 9.8 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2024-28011 | Critical | 9.8 | 2024-03-28 | Hidden Functionality vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS)… |
CVE-2024-28010 | Critical | 9.8 | 2024-03-28 | Use of Hard-coded Password in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200… |
CVE-2024-28009 | Critical | 9.8 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2024-28008 | Critical | 9.8 | 2024-03-28 | Active Debug Code in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG120… |
CVE-2024-28007 | Critical | 9.8 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2024-28006 | Medium | 5.3 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2024-28005 | Medium | 4.7 | 2024-03-28 | Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165… |
CVE-2024-3012 | High | 8.8 | 2024-03-28 | A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been declared as critical. This vulnerability affects the function GetParentControlInfo of the f… |
CVE-2024-3011 | High | 8.8 | 2024-03-28 | A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been classified as critical. This affects the function formQuickIndex of the file /goform/QuickI… |
CVE-2024-3010 | High | 8.8 | 2024-03-28 | A vulnerability was found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this issue is the function formSetCfm of the file /goform/setcfm… |
CVE-2024-3009 | Medium | 6.3 | 2024-03-28 | A vulnerability has been found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the f… |
CVE-2024-0980 | High | 7.1 | 2024-03-28 | The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code. |
CVE-2024-3008 | High | 8.8 | 2024-03-27 | A vulnerability, which was classified as critical, was found in Tenda FH1205 2.0.0.7(775). Affected is the function formexeCommand of the file /goform/execComm… |
CVE-2024-3007 | High | 8.8 | 2024-03-27 | A vulnerability, which was classified as critical, has been found in Tenda FH1205 2.0.0.7(775). This issue affects the function fromNatStaticSetting of the fil… |
CVE-2024-3006 | High | 8.8 | 2024-03-27 | A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromSetRouteStatic of the file /goform/f… |
CVE-2024-3004 | Low | 3.5 | 2024-03-27 | A vulnerability was found in code-projects Online Book System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the fi… |
CVE-2024-3003 | Medium | 6.3 | 2024-03-27 | A vulnerability has been found in code-projects Online Book System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-3002 | Medium | 6.3 | 2024-03-27 | A vulnerability, which was classified as critical, was found in code-projects Online Book System 1.0. Affected is an unknown function of the file /description… |
CVE-2024-3001 | Medium | 6.3 | 2024-03-27 | A vulnerability, which was classified as critical, has been found in code-projects Online Book System 1.0. This issue affects some unknown processing of the fi… |
CVE-2024-3000 | High | 7.3 | 2024-03-27 | A vulnerability classified as critical was found in code-projects Online Book System 1.0. This vulnerability affects unknown code of the file /index.php. The m… |
CVE-2024-25354 | High | 7.5 | 2024-03-27 | RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function. |
CVE-2024-0079 | Medium | 6.5 | 2024-03-27 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user in a guest VM can cause a NULL-pointer derefere… |
CVE-2024-0078 | Medium | 6.5 | 2024-03-27 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user in a guest can cause a NULL-pointer dereference… |
CVE-2024-0077 | High | 7.8 | 2024-03-27 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, where it allows a guest OS to allocate resources for which the guest OS is not authoriz… |
CVE-2024-0075 | Medium | 6.1 | 2024-03-27 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user may cause a NULL-pointer dereference by accessing passed parameters the v… |
CVE-2024-0074 | High | 7.1 | 2024-03-27 | NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after the end of the buffer. A successful exploit o… |
CVE-2024-0073 | High | 7.8 | 2024-03-27 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer when the driver is performing an operation at a privilege level that is… |
CVE-2024-0071 | High | 7.8 | 2024-03-27 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds write. A s… |
CVE-2024-2999 | Medium | 6.3 | 2024-03-27 | A vulnerability classified as critical has been found in Campcodes Online Art Gallery Management System 1.0. This affects an unknown part of the file /admin/ad… |
CVE-2024-2998 | Low | 2.4 | 2024-03-27 | A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been rated as problematic. Affected by this issue is some un… |
CVE-2024-2997 | Low | 2.4 | 2024-03-27 | A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been declared as problematic. Affected by this vulnerability… |
CVE-2024-2996 | Low | 2.4 | 2024-03-27 | A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been classified as problematic. Affected is an unknown funct… |
CVE-2024-2995 | Medium | 5.4 | 2024-03-27 | A vulnerability was found in NUUO Camera up to 20240319 and classified as problematic. This issue affects some unknown processing of the file /deletefile.php… |
CVE-2024-2994 | High | 8.8 | 2024-03-27 | A vulnerability was found in Tenda FH1203 2.0.1.6. It has been declared as critical. Affected by this vulnerability is the function GetParentControlInfo of the… |
CVE-2024-2993 | High | 8.8 | 2024-03-27 | A vulnerability was found in Tenda FH1203 2.0.1.6. It has been classified as critical. Affected is the function formQuickIndex of the file /goform/QuickIndex… |
CVE-2024-29892 | Medium | 6.1 | 2024-03-27 | ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved cla… |
CVE-2024-29891 | High | 8.7 | 2024-03-27 | ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an… |
CVE-2024-2992 | High | 8.8 | 2024-03-27 | A vulnerability was found in Tenda FH1203 2.0.1.6 and classified as critical. This issue affects the function formSetCfm of the file /goform/setcfm. The manipu… |
CVE-2024-2991 | Medium | 6.3 | 2024-03-27 | A vulnerability has been found in Tenda FH1203 2.0.1.6 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/… |
CVE-2024-2990 | High | 8.8 | 2024-03-27 | A vulnerability, which was classified as critical, was found in Tenda FH1203 2.0.1.6. This affects the function formexeCommand of the file /goform/execCommand… |