2024 CVEs (page 349)
Page 349 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-0827 | Medium | 4.3 | 2024-03-13 | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… |
CVE-2024-0700 | Medium | 6.4 | 2024-03-13 | The Simple Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tweet this text value in all versions up to, and including, 1.4.0.2… |
CVE-2024-0687 | Medium | 5.3 | 2024-03-13 | The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inclu… |
CVE-2024-0683 | High | 7.3 | 2024-03-13 | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in all versio… |
CVE-2024-0681 | Medium | 5.3 | 2024-03-13 | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up to, and including… |
CVE-2024-0631 | Medium | 5.3 | 2024-03-13 | The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_duitku_respon… |
CVE-2024-0614 | Medium | 4.4 | 2024-03-13 | The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.4.6.4 due to in… |
CVE-2024-0592 | Medium | 5.4 | 2024-03-13 | The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to mi… |
CVE-2024-0591 | Medium | 6.1 | 2024-03-13 | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'A'… |
CVE-2024-0449 | Medium | 4.4 | 2024-03-13 | The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, an… |
CVE-2024-0447 | Medium | 5.0 | 2024-03-13 | The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-0385 | Medium | 4.3 | 2024-03-13 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxAddCategory funct… |
CVE-2024-0377 | Medium | 5.3 | 2024-03-13 | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-0369 | Medium | 4.3 | 2024-03-13 | The Bulk Edit Post Titles plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulkUpdatePostTitles… |
CVE-2024-0368 | High | 8.6 | 2024-03-13 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i… |
CVE-2024-0326 | Medium | 6.4 | 2024-03-13 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Link Wrapper functionality in all versions… |
CVE-2024-0161 | High | 7.2 | 2024-03-13 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacke… |
CVE-2024-25155 | High | 7.2 | 2024-03-13 | In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subs… |
CVE-2024-25154 | Medium | 5.3 | 2024-03-13 | Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files lo… |
CVE-2024-25153 | Critical | 9.8 | 2024-03-13 | A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ director… |
CVE-2024-2247 | High | 8.8 | 2024-03-13 | JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism. |
CVE-2024-28684 | High | 8.8 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.php |
CVE-2024-28675 | High | 8.8 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php |
CVE-2024-26629 | Medium | 5.5 | 2024-03-13 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix RELEASE_LOCKOWNER The test on so_count in nfsd4_release_lockowner() is nonsense… |
CVE-2024-1508 | Medium | 6.4 | 2024-03-13 | The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'settings['title_tags']' attribute of the Mer… |
CVE-2024-1507 | Medium | 6.4 | 2024-03-13 | The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tags' attribute of the Rubix widget in… |
CVE-2024-28668 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/mychannel_add.php |
CVE-2024-28667 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/templets_one_edit.php |
CVE-2024-28666 | Medium | 5.5 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/media_add.php |
CVE-2024-28665 | High | 8.8 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_add.php |
CVE-2024-28432 | High | 8.8 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php. |
CVE-2024-28431 | High | 8.8 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_del.php. |
CVE-2024-28430 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_edit.php. |
CVE-2024-28429 | Medium | 5.5 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.php |
CVE-2024-2416 | Medium | 6.5 | 2024-03-13 | Cross-Site Request Forgery vulnerability in Movistar's 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an attacker to force an e… |
CVE-2024-2415 | High | 7.8 | 2024-03-13 | Command injection vulnerability in Movistar 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an authenticated user to execute com… |
CVE-2024-2414 | High | 8.8 | 2024-03-13 | The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820. This device has the 'adb' service open on port 5555 and pr… |
CVE-2024-2123 | High | 7.2 | 2024-03-13 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2024-1979 | Low | 3.5 | 2024-03-13 | A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the gi… |
CVE-2024-28623 | Medium | 6.1 | 2024-03-13 | RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section. |
CVE-2024-26529 | High | 7.5 | 2024-03-13 | An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) via the mmsServer_handleDeleteNamedVariab… |
CVE-2024-27440 | Medium | 4.8 | 2024-03-13 | The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don't properly verify server certifi… |
CVE-2024-2400 | High | 8.8 | 2024-03-13 | Use after free in Performance Manager in Google Chrome prior to 122.0.6261.128 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2024-2413 | Critical | 9.8 | 2024-03-13 | Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timest… |
CVE-2024-2412 | Medium | 5.3 | 2024-03-13 | The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user reg… |
CVE-2024-1582 | Medium | 6.4 | 2024-03-13 | The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgmza' shortcode in all versions… |
CVE-2024-1421 | Medium | 6.4 | 2024-03-12 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘border_type’ attribute of the Post Carou… |
CVE-2024-1397 | Medium | 6.4 | 2024-03-12 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, an… |
CVE-2024-2395 | High | 7.3 | 2024-03-12 | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.14. This is due to… |
CVE-2024-2107 | Medium | 5.8 | 2024-03-12 | The Blossom Spa theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.3 via generated source. This make… |
CVE-2024-24101 | Critical | 9.8 | 2024-03-12 | Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Eligibility Information Update. |
CVE-2024-0386 | High | 7.2 | 2024-03-12 | The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Referer' HTTP header in all versions up to, and including, 1.6.21 due to… |
CVE-2024-2406 | Medium | 5.4 | 2024-03-12 | A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Uplo… |
CVE-2024-28239 | Medium | 5.4 | 2024-03-12 | Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an… |
CVE-2024-28238 | Low | 2.3 | 2024-03-12 | Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of s… |
CVE-2024-28236 | High | 7.7 | 2024-03-12 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined wi… |
CVE-2024-27305 | Medium | 5.3 | 2024-03-12 | aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vuln… |
CVE-2024-24097 | Medium | 5.4 | 2024-03-12 | Cross Site Scripting (XSS) vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via the News Feed. |
CVE-2024-24093 | Critical | 9.8 | 2024-03-12 | SQL Injection vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via Personal Information Update information. |
CVE-2024-24092 | High | 7.8 | 2024-03-12 | SQL Injection vulnerability in Code-projects.org Scholars Tracking System 1.0 allows attackers to run arbitrary code via login.php. |
CVE-2024-23300 | High | 7.8 | 2024-03-12 | A use-after-free issue was addressed with improved memory management. This issue is fixed in GarageBand 10.4.11. Processing a maliciously crafted file may lead… |
CVE-2024-2130 | Medium | 6.4 | 2024-03-12 | The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and including, 1.2.7 due to i… |
CVE-2024-2031 | Medium | 6.4 | 2024-03-12 | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zoom_recordings_by_meeting' shortcode in a… |
CVE-2024-28186 | High | 7.1 | 2024-03-12 | FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP s… |
CVE-2024-28121 | High | 8.8 | 2024-03-12 | stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time we… |
CVE-2024-28114 | High | 8.1 | 2024-03-12 | Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manage… |
CVE-2024-28113 | Low | 3.5 | 2024-03-12 | Peering Manager is a BGP session management tool. In Peering Manager <=1.8.2, it is possible to redirect users to an arbitrary page using a crafted url. As a r… |
CVE-2024-28112 | Medium | 6.1 | 2024-03-12 | Peering Manager is a BGP session management tool. Affected versions of Peering Manager are subject to a potential stored Cross-Site Scripting (XSS) attack in t… |
CVE-2024-28098 | Medium | 6.4 | 2024-03-12 | The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading se… |
CVE-2024-27894 | High | 8.5 | 2024-03-12 | The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a U… |
CVE-2024-27317 | High | 8.4 | 2024-03-12 | In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Wo… |
CVE-2024-27135 | High | 8.5 | 2024-03-12 | Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, out… |
CVE-2024-1765 | Medium | 5.9 | 2024-03-12 | Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the… |
CVE-2024-1410 | Low | 3.7 | 2024-03-12 | Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resour… |
CVE-2024-1138 | High | 8.8 | 2024-03-12 | The FTL Server component of TIBCO Software Inc.'s TIBCO FTL - Enterprise Edition contains a vulnerability that allows a low privileged attacker with network ac… |
CVE-2024-1137 | Medium | 4.3 | 2024-03-12 | The Proxy and Client components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Enterprise Edition contain a vulnerability that theoretically allows an Active Sp… |
CVE-2024-2182 | Medium | 6.5 | 2024-03-12 | A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject special… |
CVE-2024-28340 | High | 7.5 | 2024-03-12 | An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtai… |
CVE-2024-28339 | Medium | 5.4 | 2024-03-12 | An information leak in the debuginfo.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sen… |
CVE-2024-28338 | High | 8.0 | 2024-03-12 | A login bypass in TOTOLINK A8000RU V7.1cu.643_B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie. |
CVE-2024-26204 | High | 7.5 | 2024-03-12 | Outlook for Android Information Disclosure Vulnerability |
CVE-2024-26203 | High | 7.3 | 2024-03-12 | Azure Data Studio Elevation of Privilege Vulnerability |
CVE-2024-26201 | Medium | 6.6 | 2024-03-12 | Microsoft Intune Linux Agent Elevation of Privilege Vulnerability |
CVE-2024-26199 | High | 7.8 | 2024-03-12 | Microsoft Office Elevation of Privilege Vulnerability |
CVE-2024-26198 | High | 8.8 | 2024-03-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2024-26197 | Medium | 6.5 | 2024-03-12 | Windows Standards-Based Storage Management Service Denial of Service Vulnerability |
CVE-2024-26190 | High | 7.5 | 2024-03-12 | Microsoft QUIC Denial of Service Vulnerability |
CVE-2024-26185 | Medium | 6.5 | 2024-03-12 | Windows Compressed Folder Tampering Vulnerability |
CVE-2024-26182 | High | 7.8 | 2024-03-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-26181 | Medium | 5.5 | 2024-03-12 | Windows Kernel Denial of Service Vulnerability |
CVE-2024-26178 | High | 7.8 | 2024-03-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-26177 | Medium | 5.5 | 2024-03-12 | Windows Kernel Information Disclosure Vulnerability |
CVE-2024-26176 | High | 7.8 | 2024-03-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-26174 | Medium | 5.5 | 2024-03-12 | Windows Kernel Information Disclosure Vulnerability |
CVE-2024-26173 | High | 7.8 | 2024-03-12 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-26170 | High | 7.8 | 2024-03-12 | Windows Composite Image File System (CimFS) Elevation of Privilege Vulnerability |
CVE-2024-26169 | High | 7.8 | 2024-03-12 | Windows Error Reporting Service Elevation of Privilege Vulnerability |
CVE-2024-26166 | High | 8.8 | 2024-03-12 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2024-26165 | High | 8.8 | 2024-03-12 | Visual Studio Code Elevation of Privilege Vulnerability |
CVE-2024-26164 | High | 8.8 | 2024-03-12 | Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability |