2024 CVEs (page 338)
Page 338 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24719 | Medium | 4.3 | 2024-03-26 | Missing Authorization vulnerability in Uriahs Victor Location Picker at Checkout for WooCommerce.This issue affects Location Picker at Checkout for WooCommerce… |
CVE-2024-24718 | Medium | 4.3 | 2024-03-26 | Missing Authorization vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.6. |
CVE-2024-24711 | Medium | 4.3 | 2024-03-26 | Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11. |
CVE-2024-23520 | Medium | 4.3 | 2024-03-26 | Missing Authorization vulnerability in AccessAlly PopupAlly.This issue affects PopupAlly: from n/a through 2.1.0. |
CVE-2024-2904 | Medium | 4.3 | 2024-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Calliope.This issue affects Calliope: from n/a through 1.0.33. |
CVE-2024-28131 | High | 7.8 | 2024-03-26 | EasyRange Ver 1.41 contains an issue with the executable file search path when displaying an extracted file on Explorer, which may lead to loading an executabl… |
CVE-2024-28126 | Medium | 6.1 | 2024-03-26 | Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00. An arbitrary script may be executed on the web browser of the user accessing the website… |
CVE-2024-28048 | Critical | 9.8 | 2024-03-26 | OS command injection vulnerability exists in ffBull ver.4.11, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the pri… |
CVE-2024-28034 | Medium | 5.4 | 2024-03-26 | Cross-site scripting vulnerability exists in Mini Thread Version 3.33βi. An arbitrary script may be executed on the web browser of the user accessing the websi… |
CVE-2024-28033 | High | 7.3 | 2024-03-26 | OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command wit… |
CVE-2024-26018 | Medium | 6.1 | 2024-03-26 | Cross-site scripting vulnerability exists in TvRock 0.9t8a. An arbitrary script may be executed on the web browser of the user accessing the website that uses… |
CVE-2024-24805 | Medium | 5.3 | 2024-03-26 | Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 3.1.2. |
CVE-2024-2889 | Medium | 5.9 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon.Thi… |
CVE-2024-2888 | Medium | 6.5 | 2024-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag… |
CVE-2024-2303 | Medium | 6.4 | 2024-03-26 | The Easy Textillate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'textillate' shortcode in all versions up to, and includ… |
CVE-2024-2170 | Medium | 6.4 | 2024-03-26 | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all versions up to, and i… |
CVE-2024-1745 | Medium | 4.3 | 2024-03-26 | The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial… |
CVE-2024-29199 | Low | 3.7 | 2024-03-26 | Nautobot is a Network Source of Truth and Network Automation Platform. A number of Nautobot URL endpoints were found to be improperly accessible to unauthentic… |
CVE-2024-29196 | Low | 3.8 | 2024-03-26 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments t… |
CVE-2024-29195 | Medium | 6.0 | 2024-03-26 | The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This library may be used by the Azure IoT C SDK for communicatio… |
CVE-2024-29189 | High | 7.4 | 2024-03-26 | PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_ins… |
CVE-2024-0866 | High | 8.1 | 2024-03-26 | The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce func… |
CVE-2024-2732 | Medium | 5.4 | 2024-03-26 | The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in all versions up to… |
CVE-2024-29303 | Critical | 9.8 | 2024-03-26 | The delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection |
CVE-2024-29302 | High | 7.5 | 2024-03-26 | SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-employee.php. |
CVE-2024-29301 | High | 7.5 | 2024-03-26 | SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-admin.php?admin_id= |
CVE-2024-28421 | Critical | 9.8 | 2024-03-25 | SQL Injection vulnerability in Razor 0.8.0 allows a remote attacker to escalate privileges via the ChannelModel::updateapk method of the channelmodle.php |
CVE-2024-0901 | High | 7.5 | 2024-03-25 | Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the co… |
CVE-2024-2873 | Critical | 9.1 | 2024-03-25 | A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user… |
CVE-2024-21914 | Medium | 5.3 | 2024-03-25 | A vulnerability exists in the affected product that allows a malicious user to restart the Rockwell Automation PanelView™ Plus 7 terminal remotely without sec… |
CVE-2024-1973 | High | 8.5 | 2024-03-25 | By leveraging the vulnerability, lower-privileged users of Content Manager can manipulate Content Manager clients to elevate privileges and perform unauthorize… |
CVE-2024-2427 | High | 7.5 | 2024-03-25 | A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper traffic throttling in the device. If multiple data packets… |
CVE-2024-2426 | High | 7.5 | 2024-03-25 | A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption… |
CVE-2024-2425 | High | 7.5 | 2024-03-25 | A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, the web serve… |
CVE-2024-29179 | Medium | 4.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. An attacker with admin privileges can upload an attachme… |
CVE-2024-29041 | Medium | 6.1 | 2024-03-25 | Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open… |
CVE-2024-29025 | Medium | 5.3 | 2024-03-25 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `Htt… |
CVE-2024-28246 | Medium | 5.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's `trust` option, specifically that provides a function to blacklist cert… |
CVE-2024-28245 | Medium | 6.3 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input usin… |
CVE-2024-28244 | Medium | 6.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input usin… |
CVE-2024-28243 | Medium | 6.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input usin… |
CVE-2024-29666 | Critical | 9.8 | 2024-03-25 | Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a remote attacker to escalate privileges vi… |
CVE-2024-29515 | High | 8.8 | 2024-03-25 | File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file to the save.php… |
CVE-2024-28850 | High | 8.1 | 2024-03-25 | WP Crontrol controls the cron events on WordPress websites. WP Crontrol includes a feature that allows administrative users to create events in the WP-Cron sy… |
CVE-2024-28108 | Medium | 4.7 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` para… |
CVE-2024-28107 | High | 8.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in th… |
CVE-2024-28106 | Medium | 4.3 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an… |
CVE-2024-28105 | High | 7.2 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulner… |
CVE-2024-27300 | Medium | 5.5 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user control panel page… |
CVE-2024-27299 | High | 8.8 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the… |
CVE-2024-30205 | High | 7.1 | 2024-03-25 | In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. |
CVE-2024-30204 | Low | 2.8 | 2024-03-25 | In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. |
CVE-2024-30203 | Medium | 5.5 | 2024-03-25 | In Emacs before 29.3, Gnus treats inline MIME contents as trusted. |
CVE-2024-30202 | High | 7.8 | 2024-03-25 | In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. |
CVE-2024-29650 | Critical | 9.8 | 2024-03-25 | An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components. |
CVE-2024-28183 | Medium | 6.1 | 2024-03-25 | ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulnerability was discov… |
CVE-2024-25175 | Medium | 6.1 | 2024-03-25 | An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack. |
CVE-2024-2865 | Critical | 9.8 | 2024-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Inje… |
CVE-2024-28435 | Medium | 5.4 | 2024-03-25 | The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload. |
CVE-2024-28434 | High | 7.6 | 2024-03-25 | The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0. A crafted svg file can trigger the execution of the java… |
CVE-2024-28393 | Critical | 9.8 | 2024-03-25 | SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate privileges via the ScalapayReturnModuleFrontController::postPr… |
CVE-2024-28387 | High | 7.5 | 2024-03-25 | An issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information via the log.txt component. |
CVE-2024-28386 | Critical | 9.8 | 2024-03-25 | An issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component. |
CVE-2024-25002 | High | 8.8 | 2024-03-25 | Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device. |
CVE-2024-2864 | High | 7.3 | 2024-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaineLabs Youzify - Buddypress Moderation.This issue affe… |
CVE-2024-25964 | Medium | 5.3 | 2024-03-25 | Dell PowerScale OneFS 9.5.0.x through 9.7.0.x contain a covert timing channel vulnerability. A remote unauthenticated attacker could potentially exploit this v… |
CVE-2024-30187 | Medium | 5.3 | 2024-03-25 | Anope before 2.0.15 does not prevent resetting the password of a suspended account. |
CVE-2024-2863 | Medium | 5.3 | 2024-03-25 | This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant. |
CVE-2024-2862 | Critical | 9.1 | 2024-03-25 | This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant. |
CVE-2024-29216 | Medium | 6.1 | 2024-03-25 | Exposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0. By sending a specific IOCTL request, a user without the administ… |
CVE-2024-24899 | High | 7.2 | 2024-03-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injecti… |
CVE-2024-24897 | High | 8.1 | 2024-03-25 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injecti… |
CVE-2024-24892 | High | 8.1 | 2024-03-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-… |
CVE-2024-24890 | High | 7.8 | 2024-03-25 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injec… |
CVE-2024-29009 | Medium | 6.1 | 2024-03-25 | Cross-site request forgery (CSRF) vulnerability in easy-popup-show all versions allows a remote unauthenticated attacker to hijack the authentication of the ad… |
CVE-2024-21865 | Medium | 6.5 | 2024-03-25 | HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via S… |
CVE-2024-21505 | High | 7.5 | 2024-03-25 | Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive… |
CVE-2024-1962 | High | 8.8 | 2024-03-25 | The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit down… |
CVE-2024-1564 | Medium | 4.3 | 2024-03-25 | The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of po… |
CVE-2024-1232 | Medium | 4.8 | 2024-03-25 | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete do… |
CVE-2024-1231 | Medium | 6.8 | 2024-03-25 | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish… |
CVE-2024-29071 | High | 8.8 | 2024-03-25 | HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings. |
CVE-2024-28041 | High | 8.8 | 2024-03-25 | HGW BL1500HM Ver 002.001.013 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary command. |
CVE-2024-29188 | High | 7.9 | 2024-03-24 | WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's `RemoveFolderEx` functiona… |
CVE-2024-29187 | High | 7.3 | 2024-03-24 | WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW… |
CVE-2024-29034 | Medium | 6.8 | 2024-03-24 | CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vuln… |
CVE-2024-29194 | High | 8.3 | 2024-03-24 | OneUptime is a solution for monitoring and managing online services. The vulnerability lies in the improper validation of client-side stored data within the we… |
CVE-2024-2856 | High | 8.8 | 2024-03-24 | A vulnerability, which was classified as critical, has been found in Tenda AC10 16.03.10.13/16.03.10.20. Affected by this issue is the function fromSetSysTime… |
CVE-2024-2855 | High | 8.8 | 2024-03-24 | A vulnerability classified as critical was found in Tenda AC15 15.03.05.18/15.03.05.19/15.03.20. Affected by this vulnerability is the function fromSetSysTime… |
CVE-2024-2854 | Medium | 6.3 | 2024-03-24 | A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetSambaConf of the file /goform/setsambacfg. The… |
CVE-2024-2853 | Medium | 6.3 | 2024-03-24 | A vulnerability was found in Tenda AC10U 15.03.06.48/15.03.06.49. It has been rated as critical. This issue affects the function formSetSambaConf of the file /… |
CVE-2024-2852 | High | 8.8 | 2024-03-24 | A vulnerability was found in Tenda AC15 15.03.20_multi. It has been declared as critical. This vulnerability affects the function saveParentControlInfo of the… |
CVE-2024-2851 | Medium | 6.3 | 2024-03-24 | A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formSetSambaConf of the file… |
CVE-2024-2850 | High | 8.8 | 2024-03-24 | A vulnerability was found in Tenda AC15 15.03.05.18 and classified as critical. Affected by this issue is the function saveParentControlInfo of the file /gofor… |
CVE-2024-30161 | Medium | 6.5 | 2024-03-24 | In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are… |
CVE-2024-30156 | High | 7.5 | 2024-03-24 | Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 co… |
CVE-2024-24725 | High | 8.8 | 2024-03-23 | Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin… |
CVE-2024-23755 | High | 8.8 | 2024-03-23 | ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. There is inadequate protection against code inject… |
CVE-2024-1603 | High | 7.5 | 2024-03-23 | paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file. |
CVE-2024-2849 | Medium | 6.3 | 2024-03-23 | A vulnerability classified as critical was found in SourceCodester Simple File Manager 1.0. This vulnerability affects unknown code. The manipulation of the ar… |