2024 CVEs (page 339)
Page 339 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24840 | Medium | 4.3 | 2024-03-23 | Missing Authorization vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.4.11. |
CVE-2024-24835 | Medium | 4.3 | 2024-03-23 | Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4. |
CVE-2024-24832 | High | 8.2 | 2024-03-23 | Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9. |
CVE-2024-2832 | Low | 3.5 | 2024-03-23 | A vulnerability classified as problematic was found in Campcodes Online Shopping System 1.0. This vulnerability affects unknown code of the file /offersmail.ph… |
CVE-2024-2326 | Medium | 4.3 | 2024-03-23 | The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all ver… |
CVE-2024-1049 | Medium | 6.4 | 2024-03-23 | The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Widget's in all versions u… |
CVE-2024-2688 | Medium | 5.4 | 2024-03-23 | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress… |
CVE-2024-2468 | Medium | 6.4 | 2024-03-23 | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress… |
CVE-2024-2202 | Medium | 6.4 | 2024-03-23 | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions up to, and includi… |
CVE-2024-2131 | Medium | 6.4 | 2024-03-23 | The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's infobox and button widget in all versions up t… |
CVE-2024-2025 | High | 8.8 | 2024-03-23 | The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions… |
CVE-2024-1697 | Medium | 6.4 | 2024-03-23 | The Custom WooCommerce Checkout Fields Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the save_wcfe_options function in all versi… |
CVE-2024-29059 | High | 7.5 | 2024-03-23 | .NET Framework Information Disclosure Vulnerability |
CVE-2024-29190 | High | 7.5 | 2024-03-22 | Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In ve… |
CVE-2024-29057 | Medium | 4.3 | 2024-03-22 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-26247 | Medium | 4.7 | 2024-03-22 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2024-2828 | Medium | 6.3 | 2024-03-22 | A vulnerability, which was classified as critical, was found in lakernote EasyAdmin up to 20240315. Affected is the function thumbnail of the file src/main/jav… |
CVE-2024-2827 | Medium | 6.3 | 2024-03-22 | A vulnerability, which was classified as critical, has been found in lakernote EasyAdmin up to 20240315. This issue affects some unknown processing of the file… |
CVE-2024-2826 | Medium | 6.3 | 2024-03-22 | A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designe… |
CVE-2024-2825 | Medium | 6.3 | 2024-03-22 | A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /ureport/designer/saveRep… |
CVE-2024-2824 | Medium | 6.3 | 2024-03-22 | A vulnerability was found in Matthias-Wandel jhead 3.08 and classified as critical. This issue affects the function PrintFormatNumber of the file exif.c. The m… |
CVE-2024-2823 | Medium | 4.3 | 2024-03-22 | A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/mda_main.php. The ma… |
CVE-2024-2822 | Medium | 4.3 | 2024-03-22 | A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/vote_edit.php. The manipulat… |
CVE-2024-29499 | High | 7.4 | 2024-03-22 | Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2. |
CVE-2024-29385 | Critical | 9.0 | 2024-03-22 | DIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function. |
CVE-2024-29366 | High | 8.8 | 2024-03-22 | A command injection vulnerability exists in the cgibin binary in DIR-845L router firmware <= v1.01KRb03. |
CVE-2024-29338 | Low | 2.4 | 2024-03-22 | Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2. |
CVE-2024-29186 | Medium | 5.3 | 2024-03-22 | Bref is an open-source project that helps users go serverless on Amazon Web Services with PHP. When Bref prior to version 2.1.17 is used with the Event-Driven… |
CVE-2024-29185 | Critical | 9.0 | 2024-03-22 | FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file… |
CVE-2024-29184 | High | 8.0 | 2024-03-22 | FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting (XSS) vulnerability has been identified within the Signature Input Field… |
CVE-2024-29042 | Medium | 5.3 | 2024-03-22 | Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacker controlling the… |
CVE-2024-28861 | Critical | 9.8 | 2024-03-22 | Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Sym… |
CVE-2024-2821 | Medium | 4.3 | 2024-03-22 | A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. Affected by this issue is some unknown functionality of the file /src/dede… |
CVE-2024-2820 | Medium | 4.3 | 2024-03-22 | A vulnerability classified as problematic was found in DedeCMS 5.7. Affected by this vulnerability is an unknown functionality of the file /src/dede/baidunews… |
CVE-2024-2228 | High | 7.1 | 2024-03-22 | This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Popul… |
CVE-2024-2227 | Critical | 10.0 | 2024-03-22 | This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.2… |
CVE-2024-29865 | Medium | 5.4 | 2024-03-22 | Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form. |
CVE-2024-28593 | Medium | 5.4 | 2024-03-22 | The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance d… |
CVE-2024-2728 | Medium | 4.1 | 2024-03-22 | Information exposure vulnerability in the CIGESv2 system. This vulnerability could allow a local attacker to intercept traffic due to the lack of proper implem… |
CVE-2024-2727 | Medium | 6.1 | 2024-03-22 | HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confi… |
CVE-2024-2726 | Medium | 6.1 | 2024-03-22 | Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the… |
CVE-2024-2725 | High | 7.5 | 2024-03-22 | Information exposure vulnerability in the CIGESv2 system. A remote attacker might be able to access /vendor/composer/installed.json and retrieve all installed… |
CVE-2024-2724 | Critical | 9.8 | 2024-03-22 | SQL injection vulnerability in the CIGESv2 system, through /ajaxServiciosAtencion.php, in the 'idServicio' parameter. The exploitation of this vulnerability co… |
CVE-2024-2723 | Critical | 9.8 | 2024-03-22 | SQL injection vulnerability in the CIGESv2 system, through /ajaxSubServicios.php, in the 'idServicio' parameter. The exploitation of this vulnerability could a… |
CVE-2024-2722 | Critical | 9.8 | 2024-03-22 | SQL injection vulnerability in the CIGESv2 system, through /ajaxConfigTotem.php, in the 'id' parameter. The exploitation of this vulnerability could allow a re… |
CVE-2024-2449 | High | 7.5 | 2024-03-22 | A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostn… |
CVE-2024-2448 | High | 8.4 | 2024-03-22 | An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands… |
CVE-2024-29944 | High | 8.4 | 2024-03-22 | An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vuln… |
CVE-2024-29943 | Critical | 9.8 | 2024-03-22 | An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This vulnerability affec… |
CVE-2024-28560 | Medium | 5.4 | 2024-03-22 | SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea() function of the Address.php comp… |
CVE-2024-28559 | High | 8.8 | 2024-03-22 | SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the setPrice() function of the Goodsbatchset.php… |
CVE-2024-25168 | Medium | 6.3 | 2024-03-22 | SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the system/role/list interfa… |
CVE-2024-28824 | High | 8.8 | 2024-03-22 | Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0… |
CVE-2024-1848 | High | 7.8 | 2024-03-22 | Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Us… |
CVE-2024-1742 | Low | 3.8 | 2024-03-22 | Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24… |
CVE-2024-0638 | High | 8.2 | 2024-03-22 | Least privilege violation in the Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0… |
CVE-2024-2817 | Medium | 4.3 | 2024-03-22 | A vulnerability, which was classified as problematic, has been found in Tenda AC15 15.03.05.18. Affected by this issue is the function fromSysToolRestoreSet of… |
CVE-2024-2816 | Medium | 4.3 | 2024-03-22 | A vulnerability classified as problematic was found in Tenda AC15 15.03.05.18. Affected by this vulnerability is the function fromSysToolReboot of the file /go… |
CVE-2024-2815 | High | 8.8 | 2024-03-22 | A vulnerability classified as critical has been found in Tenda AC15 15.03.20_multi. Affected is the function R7WebsSecurityHandler of the file /goform/execComm… |
CVE-2024-2814 | High | 8.8 | 2024-03-22 | A vulnerability was found in Tenda AC15 15.03.20_multi. It has been rated as critical. This issue affects the function fromDhcpListClient of the file /goform/D… |
CVE-2024-2813 | High | 8.8 | 2024-03-22 | A vulnerability was found in Tenda AC15 15.03.20_multi. It has been declared as critical. This vulnerability affects the function form_fast_setting_wifi_set of… |
CVE-2024-2812 | Medium | 6.3 | 2024-03-22 | A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formWriteFacMac of the file /… |
CVE-2024-2811 | High | 8.8 | 2024-03-22 | A vulnerability was found in Tenda AC15 15.03.20_multi and classified as critical. Affected by this issue is the function formWifiWpsStart of the file /goform/… |
CVE-2024-2810 | High | 8.8 | 2024-03-22 | A vulnerability has been found in Tenda AC15 15.03.05.18/15.03.20_multi and classified as critical. Affected by this vulnerability is the function formWifiWpsO… |
CVE-2024-2809 | High | 8.8 | 2024-03-22 | A vulnerability, which was classified as critical, was found in Tenda AC15 15.03.05.18/15.03.20_multi. Affected is the function formSetFirewallCfg of the file… |
CVE-2024-2808 | High | 8.8 | 2024-03-22 | A vulnerability, which was classified as critical, has been found in Tenda AC15 15.03.05.18/15.03.20_multi. This issue affects the function formQuickIndex of t… |
CVE-2024-2807 | High | 8.8 | 2024-03-22 | A vulnerability classified as critical was found in Tenda AC15 15.03.05.18/15.03.20_multi. This vulnerability affects the function formExpandDlnaFile of the fi… |
CVE-2024-2806 | High | 8.8 | 2024-03-22 | A vulnerability classified as critical has been found in Tenda AC15 15.03.05.18/15.03.20_multi. This affects the function addWifiMacFilter of the file /goform/… |
CVE-2024-29275 | Critical | 9.8 | 2024-03-22 | SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the… |
CVE-2024-29273 | Medium | 6.1 | 2024-03-22 | There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document. |
CVE-2024-29272 | Medium | 6.5 | 2024-03-22 | Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive inf… |
CVE-2024-29271 | Medium | 6.1 | 2024-03-22 | Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obtain sensitive info… |
CVE-2024-25808 | High | 8.3 | 2024-03-22 | Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function. |
CVE-2024-2805 | High | 8.8 | 2024-03-22 | A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been rated as critical. Affected by this issue is the function formSetSpeedWan of th… |
CVE-2024-26557 | Medium | 5.4 | 2024-03-22 | Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter. |
CVE-2024-25807 | Medium | 6.1 | 2024-03-22 | Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title para… |
CVE-2024-2780 | Low | 3.5 | 2024-03-22 | A vulnerability was found in Campcodes Online Marriage Registration System 1.0. It has been declared as problematic. This vulnerability affects unknown code of… |
CVE-2024-2500 | Medium | 6.4 | 2024-03-22 | The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insu… |
CVE-2024-2392 | Medium | 6.4 | 2024-03-22 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including… |
CVE-2024-2080 | Medium | 4.3 | 2024-03-22 | The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu… |
CVE-2024-28441 | Critical | 9.8 | 2024-03-22 | File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of… |
CVE-2024-0957 | Medium | 6.1 | 2024-03-22 | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custo… |
CVE-2024-2779 | Low | 3.5 | 2024-03-22 | A vulnerability was found in Campcodes Online Marriage Registration System 1.0. It has been classified as problematic. This affects an unknown part of the file… |
CVE-2024-2778 | Low | 3.5 | 2024-03-22 | A vulnerability was found in Campcodes Online Marriage Registration System 1.0 and classified as problematic. Affected by this issue is some unknown functional… |
CVE-2024-2777 | Medium | 6.3 | 2024-03-22 | A vulnerability has been found in Campcodes/PHPGurukul Online Marriage Registration System 1.0 and classified as critical. Affected by this vulnerability is an… |
CVE-2024-2776 | Medium | 6.3 | 2024-03-22 | A vulnerability, which was classified as critical, was found in Campcodes Online Marriage Registration System 1.0. Affected is an unknown function of the file… |
CVE-2024-2775 | Low | 3.5 | 2024-03-21 | A vulnerability, which was classified as problematic, has been found in Campcodes Online Marriage Registration System 1.0. This issue affects some unknown proc… |
CVE-2024-2774 | Medium | 6.3 | 2024-03-21 | A vulnerability classified as critical was found in Campcodes Online Marriage Registration System 1.0. This vulnerability affects unknown code of the file /use… |
CVE-2024-2773 | Low | 3.5 | 2024-03-21 | A vulnerability classified as problematic has been found in Campcodes Online Marriage Registration System 1.0. This affects an unknown part of the file /user/s… |
CVE-2024-2770 | Medium | 6.3 | 2024-03-21 | A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been rated as critical. Affected by this issue is some unkno… |
CVE-2024-2453 | Medium | 6.4 | 2024-03-21 | There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the databas… |
CVE-2024-29031 | High | 7.5 | 2024-03-21 | Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vul… |
CVE-2024-28863 | Medium | 6.5 | 2024-03-21 | node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker wh… |
CVE-2024-28171 | High | 8.1 | 2024-03-21 | It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file sys… |
CVE-2024-28045 | Medium | 4.6 | 2024-03-21 | Improper neutralization of input within the affected product could lead to cross-site scripting. |
CVE-2024-28040 | High | 8.8 | 2024-03-21 | SQL injection vulnerability exists in GetDIAE_astListParameters. |
CVE-2024-25567 | High | 8.1 | 2024-03-21 | Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already e… |
CVE-2024-23975 | High | 8.8 | 2024-03-21 | SQL injection vulnerability exists in GetDIAE_slogListParameters. |
CVE-2024-23494 | High | 8.8 | 2024-03-21 | SQL injection vulnerability exists in GetDIAE_unListParameters. |
CVE-2024-2769 | Medium | 6.3 | 2024-03-21 | A vulnerability was detected in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/a… |