2024 CVEs (page 34)
Page 34 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13570 | Medium | 6.1 | 2025-02-11 | The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-13544 | Medium | 4.8 | 2025-02-11 | The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitr… |
CVE-2024-13543 | Medium | 6.1 | 2025-02-11 | The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-12599 | Medium | 6.4 | 2025-02-11 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions… |
CVE-2024-57178 | Medium | 5.9 | 2025-02-10 | An SQL injection vulnerability exists in Stock-Forecaster <=01-04-2020. By sending a specially crafted 'stock-symbol' parameter to the portofolio() endpoint, i… |
CVE-2024-57177 | High | 7.3 | 2025-02-10 | A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change… |
CVE-2024-8550 | High | 7.5 | 2025-02-10 | A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker… |
CVE-2024-54658 | Medium | 6.5 | 2025-02-10 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1… |
CVE-2024-46437 | Medium | 6.5 | 2025-02-10 | A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unauthenticated remote attacker to retrieve… |
CVE-2024-46436 | High | 8.3 | 2025-02-10 | Hardcoded credentials in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to gain root access to the device over the telnet service. |
CVE-2024-46435 | High | 8.0 | 2025-02-10 | A stack overflow vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an authenticated remote attacker to cause a denial of service or… |
CVE-2024-46434 | High | 8.8 | 2025-02-10 | Tenda W18E V16.01.0.8(1625) suffers from authentication bypass in the web management portal allowing an unauthorized remote attacker to gain administrative acc… |
CVE-2024-46433 | High | 8.8 | 2025-02-10 | A default credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using the defaul… |
CVE-2024-46432 | High | 8.8 | 2025-02-10 | Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. An attacker can send a specially crafted HTTP POST request to the setQuickCfgWifiAndLogi… |
CVE-2024-46431 | High | 8.0 | 2025-02-10 | Tenda W18E V16.01.0.8(1625) is vulnerable to Buffer Overflow. An attacker with access to the web management portal can exploit this vulnerability by sending sp… |
CVE-2024-46430 | Medium | 6.5 | 2025-02-10 | Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. Unauthorized password change via the web management portal allows an unauthenticated rem… |
CVE-2024-46429 | High | 8.8 | 2025-02-10 | A hardcoded credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using a defaul… |
CVE-2024-42513 | Medium | 5.3 | 2025-02-10 | Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoi… |
CVE-2024-42512 | High | 8.6 | 2025-02-10 | Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Bas… |
CVE-2024-27859 | High | 8.8 | 2025-02-10 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10… |
CVE-2024-13059 | High | 7.2 | 2025-02-10 | A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer li… |
CVE-2024-13011 | Critical | 9.8 | 2025-02-10 | The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'upload_publisher_profile_image'… |
CVE-2024-13010 | Medium | 6.1 | 2025-02-10 | The WP Foodbakery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.8 due to insufficient input sanitiza… |
CVE-2024-10649 | Medium | 6.1 | 2025-02-10 | wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpoints allow file uploads and downloads f… |
CVE-2024-57409 | Medium | 4.8 | 2025-02-10 | A stored cross-site scripting (XSS) vulnerability in the Parameter List module of cool-admin-java v1.0 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2024-57408 | High | 7.2 | 2025-02-10 | An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2024-57407 | High | 7.3 | 2025-02-10 | An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2024-54954 | High | 8.0 | 2025-02-10 | OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department. |
CVE-2024-48170 | Medium | 5.4 | 2025-02-10 | PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload injected into the name in the profile.php. |
CVE-2024-57950 | Medium | 5.5 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Initialize denominator defaults to 1 [WHAT & HOW] Variables, used as den… |
CVE-2024-12243 | Medium | 5.3 | 2025-02-10 | A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certi… |
CVE-2024-12133 | Medium | 5.3 | 2025-02-10 | A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much l… |
CVE-2024-11831 | Medium | 5.4 | 2025-02-10 | A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such… |
CVE-2024-10334 | High | 7.3 | 2025-02-10 | A vulnerability exists in the VideONet product included in the listed System 800xA versions, where VideONet is used. An attacker who successfully exploited t… |
CVE-2024-11621 | High | 8.8 | 2025-02-10 | Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communi… |
CVE-2024-8685 | Medium | 4.3 | 2025-02-10 | Path-Traversal vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to lis… |
CVE-2024-8684 | High | 8.3 | 2025-02-10 | OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker… |
CVE-2024-57949 | Medium | 5.5 | 2025-02-09 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity() The following… |
CVE-2024-13440 | High | 8.2 | 2025-02-09 | The Super Store Finder plugin for WordPress is vulnerable to SQL Injection via the ‘ssf_wp_user_name’ parameter in all versions up to, and including, 7.0 due t… |
CVE-2024-54176 | Medium | 4.3 | 2025-02-08 | IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and… |
CVE-2024-13850 | Medium | 5.5 | 2025-02-08 | The Simple add pages or posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.0 due to insufficient… |
CVE-2024-55630 | Low | 3.3 | 2025-02-07 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer all… |
CVE-2024-57606 | High | 7.5 | 2025-02-07 | SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker to obtain sensitive information via the… |
CVE-2024-57357 | High | 8.0 | 2025-02-07 | An issue in TPLINK TL-WPA 8630 TL-WPA8630(US)_V2_2.0.4 Build 20230427 allows a remote attacker to execute arbitrary code via function sub_4256CC, which allows… |
CVE-2024-57279 | Medium | 5.4 | 2025-02-07 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the LDAP User Manager <= ce92321, specifically in the /setup/index.php endpoint via… |
CVE-2024-57278 | Medium | 5.4 | 2025-02-07 | A reflected Cross-Site Scripting (XSS) vulnerability exists in /webscan/sqlmap/index.html in QingScan <=v1.8.0. The vulnerability is caused by improper input s… |
CVE-2024-55272 | High | 7.5 | 2025-02-07 | An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function. |
CVE-2024-55215 | Critical | 9.8 | 2025-02-07 | An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register. |
CVE-2024-7425 | Medium | 6.8 | 2025-02-07 | The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input… |
CVE-2024-9664 | High | 7.2 | 2025-02-07 | The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted i… |
CVE-2024-9661 | Medium | 4.3 | 2025-02-07 | The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonc… |
CVE-2024-7419 | High | 8.3 | 2025-02-07 | The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. Thi… |
CVE-2024-57707 | Critical | 9.8 | 2025-02-07 | An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components. |
CVE-2024-57249 | Medium | 6.5 | 2025-02-07 | Incorrect Access Control in the Preview Function of Gleamtech FileVista 9.2.0.0 allows remote attackers to gain unauthorized access via exploiting a vulnerabil… |
CVE-2024-57248 | Medium | 6.3 | 2025-02-07 | Directory Traversal in File Upload in Gleamtech FileVista 9.2.0.0 allows remote attackers to achieve Code Execution, Information Disclosure, and Escalation of… |
CVE-2024-55214 | Medium | 6.5 | 2025-02-07 | Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality. |
CVE-2024-55213 | Medium | 6.5 | 2025-02-07 | Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the File Listing function. |
CVE-2024-52884 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. Due to the use of weak password obfuscation/encryption, an… |
CVE-2024-52883 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to a path traversal vulnerability, sensitive data can be read with… |
CVE-2024-52882 | Medium | 6.1 | 2025-02-07 | An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to improper neutralization of input via the devices API, an attack… |
CVE-2024-52881 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sen… |
CVE-2024-48091 | High | 7.8 | 2025-02-07 | Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to exe… |
CVE-2024-35106 | Medium | 4.6 | 2025-02-07 | NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS. This vulnerability allows attackers to cause a Denial of Serv… |
CVE-2024-10383 | High | 8.7 | 2025-02-07 | An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343an… |
CVE-2024-13841 | Medium | 4.3 | 2025-02-07 | The Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time plugin for WordPress is vulnerable to Information Exposure in all versions up t… |
CVE-2024-13492 | Medium | 6.1 | 2025-02-07 | The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2024-13352 | High | 7.1 | 2025-02-07 | The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scr… |
CVE-2024-57609 | High | 8.6 | 2025-02-06 | An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via the redirect_path p… |
CVE-2024-57392 | High | 7.5 | 2025-02-06 | Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP… |
CVE-2024-56889 | High | 7.5 | 2025-02-06 | Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to arbitrarily delete… |
CVE-2024-55241 | High | 8.8 | 2025-02-06 | An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py component. |
CVE-2024-54909 | High | 8.1 | 2025-02-06 | A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipula… |
CVE-2024-53586 | Medium | 5.3 | 2025-02-06 | An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a crafted HTTP request. By injecting travers… |
CVE-2024-48589 | Medium | 6.3 | 2025-02-06 | Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code via the rol parameter in index.php |
CVE-2024-25883 | Medium | 5.3 | 2025-02-06 | The mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors. |
CVE-2024-56467 | Low | 3.3 | 2025-02-06 | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used… |
CVE-2024-54171 | High | 7.1 | 2025-02-06 | IBM EntireX 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerab… |
CVE-2024-57673 | Medium | 5.5 | 2025-02-06 | An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module and Linkdiscovery module |
CVE-2024-57672 | Medium | 5.5 | 2025-02-06 | An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topologylnstance module, Routing module. |
CVE-2024-57426 | High | 7.3 | 2025-02-06 | NetMod VPN Client 5.3.1 is vulnerable to DLL injection, allowing an attacker to execute arbitrary code by placing a malicious DLL in a directory where the appl… |
CVE-2024-52892 | Medium | 6.1 | 2025-02-06 | IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed ar… |
CVE-2024-47258 | High | 8.1 | 2025-02-06 | 2N Access Commander version 2.1 and prior is vulnerable in default settings to Man In The Middle attack due to not verifying certificates of 2N edge devices. … |
CVE-2024-47256 | Medium | 6.0 | 2025-02-06 | Successful exploitation of this vulnerability could allow an attacker (who needs to have Admin access privileges) to read hardcoded AES passphrase, which may b… |
CVE-2024-13417 | Medium | 4.6 | 2025-02-06 | Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully working state. 2… |
CVE-2024-57668 | High | 8.8 | 2025-02-06 | In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability. |
CVE-2024-57523 | Medium | 4.5 | 2025-02-06 | Cross Site Request Forgery (CSRF) in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attackers to create unauthorized admin account… |
CVE-2024-13416 | Medium | 4.3 | 2025-02-06 | Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log. 2N has released an updated ve… |
CVE-2024-57610 | High | 7.5 | 2025-02-06 | A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk… |
CVE-2024-36558 | High | 7.5 | 2025-02-06 | Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Information due to lack of en… |
CVE-2024-36557 | Medium | 6.6 | 2025-02-06 | The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW60 R36CW_YD… |
CVE-2024-36556 | Critical | 9.1 | 2025-02-06 | Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49… |
CVE-2024-36555 | Critical | 9.8 | 2025-02-06 | Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36… |
CVE-2024-36554 | Critical | 9.8 | 2025-02-06 | Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.4… |
CVE-2024-36553 | High | 8.1 | 2025-02-06 | Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h is vulnerable to MITM attack. |
CVE-2024-57599 | Medium | 4.8 | 2025-02-06 | Cross Site Scripting vulnerability in DouPHP v.1.8 Release 20231203 allows attackers to execute arbitrary code via a crafted payload injected into the descript… |
CVE-2024-57430 | Critical | 9.8 | 2025-02-06 | An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate database queries via the… |
CVE-2024-57429 | Medium | 5.4 | 2025-02-06 | A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote attackers to escalate p… |
CVE-2024-57428 | Critical | 9.3 | 2025-02-06 | A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fields (event_img, se… |
CVE-2024-57427 | Medium | 6.1 | 2025-02-06 | PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints improperly handle user input, allowing maliciou… |
CVE-2024-43779 | High | 7.7 | 2025-02-06 | An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can le… |