2024 CVEs (page 357)
Page 357 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23488 | Low | 3.1 | 2024-02-29 | Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived… |
CVE-2024-1887 | Medium | 4.3 | 2024-02-29 | Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to… |
CVE-2024-25594 | Medium | 6.5 | 2024-02-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Savvy Wordpress Development MyWaze allows Stored XSS.This… |
CVE-2024-25292 | Critical | 9.6 | 2024-02-29 | Cross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-25291 | Critical | 9.8 | 2024-02-29 | Deskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin. |
CVE-2024-1982 | Medium | 6.5 | 2024-02-29 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the get_restore_progres… |
CVE-2024-1981 | Critical | 9.8 | 2024-02-29 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table_prefix' parameter in version 0.9.68 due to insuffic… |
CVE-2024-1978 | Medium | 5.5 | 2024-02-29 | The Friends plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.5 via the discover_available_feeds func… |
CVE-2024-25098 | Medium | 6.5 | 2024-02-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Bajorat PB oEmbed HTML5 Audio – with Cache Support… |
CVE-2024-25094 | Medium | 6.5 | 2024-02-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Jura & Nicolas Montigny PJ News Ticker allows Stored… |
CVE-2024-25093 | High | 7.1 | 2024-02-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Rating System allows Stored XSS.This is… |
CVE-2024-24525 | Critical | 9.8 | 2024-02-29 | An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL. |
CVE-2024-23501 | Medium | 5.9 | 2024-02-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shopfiles Ltd Ebook Store allows Stored XSS.This issue af… |
CVE-2024-21752 | High | 7.1 | 2024-02-29 | Cross-Site Request Forgery (CSRF) vulnerability in Ernest Marcinko Ajax Search Lite allows Reflected XSS.This issue affects Ajax Search Lite: from n/a through… |
CVE-2024-1977 | Medium | 4.4 | 2024-02-29 | The Restaurant Solutions – Checklist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Checklist points in version 1.0.0 due to insuffi… |
CVE-2024-1976 | Medium | 4.3 | 2024-02-29 | The Marketing Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20200925. This is due to missing… |
CVE-2024-1437 | High | 7.1 | 2024-02-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in José Fernandez Adsmonetizer allows Reflected XSS.This iss… |
CVE-2024-1434 | Medium | 5.9 | 2024-02-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Media Alt Renamer allows Stored XSS.This issue… |
CVE-2024-1435 | Medium | 5.3 | 2024-02-29 | Insertion of Sensitive Information Into Sent Data vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: from n/a through <= 0.20.6. |
CVE-2024-1341 | Medium | 4.9 | 2024-02-29 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode in all versions up to, and inc… |
CVE-2024-1468 | High | 8.8 | 2024-02-29 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… |
CVE-2024-0689 | Medium | 4.4 | 2024-02-29 | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a meta import in all versions up to, and including, 2.6.4 due to i… |
CVE-2024-22871 | High | 7.5 | 2024-02-29 | An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function. |
CVE-2024-27517 | Medium | 5.4 | 2024-02-29 | Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permissions. |
CVE-2024-27516 | Critical | 9.8 | 2024-02-29 | Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive info… |
CVE-2024-27284 | High | 7.5 | 2024-02-29 | cassandra-rs is a Cassandra (CQL) driver for Rust. Code that attempts to use an item (e.g., a row) returned by an iterator after the iterator has advanced to t… |
CVE-2024-27092 | Medium | 5.4 | 2024-02-29 | Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send emails with Spoofed Co… |
CVE-2024-27083 | Medium | 4.3 | 2024-02-29 | Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth lo… |
CVE-2024-26473 | Medium | 6.1 | 2024-02-29 | A reflected cross-site scripting (XSS) vulnerability in SocialMediaWebsite v1.0.1 allows attackers to inject malicious JavaScript into the web browser of a vic… |
CVE-2024-26472 | Medium | 6.1 | 2024-02-29 | KLiK SocialMediaWebsite version 1.0.1 from msaad1999 has a reflected cross-site scripting (XSS) vulnerability which may allow remote attackers to execute arbit… |
CVE-2024-26471 | Medium | 5.4 | 2024-02-29 | A reflected cross-site scripting (XSS) vulnerability in zhimengzhe iBarn v1.5 allows attackers to inject malicious JavaScript into the web browser of a victim… |
CVE-2024-26470 | High | 8.1 | 2024-02-29 | A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the pass… |
CVE-2024-26462 | Medium | 5.5 | 2024-02-29 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c. |
CVE-2024-26461 | High | 7.5 | 2024-02-29 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. |
CVE-2024-26458 | Medium | 5.3 | 2024-02-29 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c. |
CVE-2024-26132 | Medium | 4.0 | 2024-02-29 | Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through… |
CVE-2024-26131 | High | 8.4 | 2024-02-29 | Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious… |
CVE-2024-25932 | Medium | 4.3 | 2024-02-29 | Cross-Site Request Forgery (CSRF) vulnerability in Manish Kumar Agarwal Change Table Prefix change-table-prefix allows Cross Site Request Forgery.This issue af… |
CVE-2024-25931 | Medium | 4.3 | 2024-02-29 | Cross-Site Request Forgery (CSRF) vulnerability in Heureka Group Heureka.This issue affects Heureka: from n/a through 1.0.8. |
CVE-2024-25930 | Medium | 4.3 | 2024-02-29 | Cross-Site Request Forgery (CSRF) vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: fr… |
CVE-2024-25833 | Critical | 9.8 | 2024-02-29 | F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in… |
CVE-2024-25832 | High | 8.8 | 2024-02-29 | F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dangerous type by mani… |
CVE-2024-25831 | Medium | 5.4 | 2024-02-29 | F-logic DataCube3 Version 1.0 is affected by a reflected cross-site scripting (XSS) vulnerability due to improper input sanitization. An authenticated, remote… |
CVE-2024-25830 | Critical | 9.8 | 2024-02-29 | F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can explo… |
CVE-2024-25713 | High | 8.6 | 2024-02-29 | yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of… |
CVE-2024-25712 | Medium | 6.1 | 2024-02-29 | http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently… |
CVE-2024-25262 | High | 8.1 | 2024-02-29 | texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. This vulnerability allows attackers to cause a De… |
CVE-2024-25128 | Critical | 9.1 | 2024-02-29 | Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to f… |
CVE-2024-25065 | Critical | 9.1 | 2024-02-29 | Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue. |
CVE-2024-25006 | High | 8.1 | 2024-02-29 | XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive… |
CVE-2024-24708 | Medium | 4.3 | 2024-02-29 | Cross-Site Request Forgery (CSRF) vulnerability in W3speedster W3SPEEDSTER.This issue affects W3SPEEDSTER: from n/a through 7.19. |
CVE-2024-24701 | Medium | 4.3 | 2024-02-29 | Cross-Site Request Forgery (CSRF) vulnerability in Native Grid LLC A no-code page builder for beautiful performance-based content.This issue affects A no-code… |
CVE-2024-24155 | Medium | 6.5 | 2024-02-29 | Bento4 v1.5.1-628 contains a Memory leak on AP4_Movie::AP4_Movie, parsing tracks and added into m_Tracks list, but mp42aac cannot correctly delete when we got… |
CVE-2024-24150 | Medium | 6.5 | 2024-02-29 | A memory leak issue discovered in parseSWF_TEXTRECORD in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file. |
CVE-2024-24149 | Medium | 6.5 | 2024-02-29 | A memory leak issue discovered in parseSWF_GLYPHENTRY in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file. |
CVE-2024-24147 | Medium | 6.5 | 2024-02-29 | A memory leak issue discovered in parseSWF_FILLSTYLEARRAY in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file. |
CVE-2024-24146 | Medium | 6.5 | 2024-02-29 | A memory leak issue discovered in parseSWF_DEFINEBUTTON in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file. |
CVE-2024-23946 | Medium | 5.3 | 2024-02-29 | Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue. |
CVE-2024-23807 | Critical | 9.8 | 2024-02-29 | The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are reco… |
CVE-2024-23519 | Medium | 4.3 | 2024-02-29 | Cross-Site Request Forgery (CSRF) vulnerability in M&S Consulting Email Before Download.This issue affects Email Before Download: from n/a through 6.9.7. |
CVE-2024-23328 | Critical | 9.1 | 2024-02-29 | Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execu… |
CVE-2024-23302 | High | 7.5 | 2024-02-29 | Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. |
CVE-2024-23052 | Critical | 9.8 | 2024-02-29 | An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson… |
CVE-2024-22939 | High | 8.8 | 2024-02-29 | Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_edit component. |
CVE-2024-22936 | Medium | 6.1 | 2024-02-29 | Cross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student Information Systems v.3053 al… |
CVE-2024-22251 | Medium | 5.9 | 2024-02-29 | VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device). A malicious actor with local administra… |
CVE-2024-21726 | Medium | 6.5 | 2024-02-29 | Inadequate content filtering leads to XSS vulnerabilities in various components. |
CVE-2024-21725 | Medium | 6.1 | 2024-02-29 | Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components. |
CVE-2024-21724 | Medium | 6.1 | 2024-02-29 | Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions. |
CVE-2024-21723 | Medium | 4.3 | 2024-02-29 | Inadequate parsing of URLs could result into an open redirect. |
CVE-2024-21722 | Medium | 6.3 | 2024-02-29 | The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified. |
CVE-2024-20344 | Medium | 5.3 | 2024-02-29 | A vulnerability in system resource management in Cisco UCS 6400 and 6500 Series Fabric Interconnects that are in Intersight Managed Mode (IMM) could allow an u… |
CVE-2024-20321 | High | 8.6 | 2024-02-29 | A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause… |
CVE-2024-20294 | Medium | 6.6 | 2024-02-29 | A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent at… |
CVE-2024-20291 | Medium | 5.8 | 2024-02-29 | A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mo… |
CVE-2024-20267 | High | 8.6 | 2024-02-29 | A vulnerability with the handling of MPLS traffic for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the netstack process to une… |
CVE-2024-1971 | High | 7.3 | 2024-02-29 | A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2024-1970 | Medium | 4.3 | 2024-02-29 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Learning System V2 1.0. Affected is an unknown function of the file /i… |
CVE-2024-1939 | High | 8.8 | 2024-02-29 | Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-1938 | High | 8.8 | 2024-02-29 | Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chrom… |
CVE-2024-1928 | Medium | 4.7 | 2024-02-29 | A vulnerability, which was classified as critical, has been found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this issue is some unkn… |
CVE-2024-1927 | Medium | 6.3 | 2024-02-29 | A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2024-1722 | Low | 3.7 | 2024-02-29 | A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in. |
CVE-2024-1586 | Medium | 6.4 | 2024-02-29 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all versions up to, and in… |
CVE-2024-1570 | Medium | 6.4 | 2024-02-29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-1519 | Medium | 6.5 | 2024-02-29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-1496 | Medium | 6.4 | 2024-02-29 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_url parameter in all versions up to, an… |
CVE-2024-1492 | Medium | 5.3 | 2024-02-29 | The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function i… |
CVE-2024-1475 | Medium | 5.3 | 2024-02-29 | The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the REST… |
CVE-2024-1472 | Medium | 5.3 | 2024-02-29 | The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.6 via the REST API. This makes it possi… |
CVE-2024-1470 | High | 7.1 | 2024-02-29 | Authorization Bypass Through User-Controlled Key vulnerability in NetIQ (OpenText) Client Login Extension on Windows allows Privilege Escalation, Code Injectio… |
CVE-2024-1448 | Medium | 6.4 | 2024-02-29 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions… |
CVE-2024-1447 | Medium | 6.4 | 2024-02-29 | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aThemes Slider button element in all versions up to, and… |
CVE-2024-1445 | Medium | 6.4 | 2024-02-29 | The Page scroll to id plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.7… |
CVE-2024-1425 | Medium | 6.4 | 2024-02-29 | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerabl… |
CVE-2024-1411 | Medium | 6.4 | 2024-02-29 | The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the settings of the Twitter Buttons Widget in all vers… |
CVE-2024-1408 | Medium | 6.4 | 2024-02-29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-1390 | Medium | 4.3 | 2024-02-29 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2024-1389 | Medium | 5.3 | 2024-02-29 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2024-1349 | Medium | 6.4 | 2024-02-29 | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerabl… |