2024 CVEs (page 358)
Page 358 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21723 | Medium | 4.3 | 2024-02-29 | Inadequate parsing of URLs could result into an open redirect. |
CVE-2024-21722 | Medium | 6.3 | 2024-02-29 | The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified. |
CVE-2024-20344 | Medium | 5.3 | 2024-02-29 | A vulnerability in system resource management in Cisco UCS 6400 and 6500 Series Fabric Interconnects that are in Intersight Managed Mode (IMM) could allow an u… |
CVE-2024-20321 | High | 8.6 | 2024-02-29 | A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause… |
CVE-2024-20294 | Medium | 6.6 | 2024-02-29 | A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent at… |
CVE-2024-20291 | Medium | 5.8 | 2024-02-29 | A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mo… |
CVE-2024-20267 | High | 8.6 | 2024-02-29 | A vulnerability with the handling of MPLS traffic for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the netstack process to une… |
CVE-2024-1971 | High | 7.3 | 2024-02-29 | A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2024-1970 | Medium | 4.3 | 2024-02-29 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Learning System V2 1.0. Affected is an unknown function of the file /i… |
CVE-2024-1939 | High | 8.8 | 2024-02-29 | Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2024-1938 | High | 8.8 | 2024-02-29 | Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chrom… |
CVE-2024-1928 | Medium | 4.7 | 2024-02-29 | A vulnerability, which was classified as critical, has been found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this issue is some unkn… |
CVE-2024-1927 | Medium | 6.3 | 2024-02-29 | A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2024-1722 | Low | 3.7 | 2024-02-29 | A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in. |
CVE-2024-1586 | Medium | 6.4 | 2024-02-29 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all versions up to, and in… |
CVE-2024-1570 | Medium | 6.4 | 2024-02-29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-1519 | Medium | 6.5 | 2024-02-29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-1496 | Medium | 6.4 | 2024-02-29 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_url parameter in all versions up to, an… |
CVE-2024-1492 | Medium | 5.3 | 2024-02-29 | The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function i… |
CVE-2024-1475 | Medium | 5.3 | 2024-02-29 | The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the REST… |
CVE-2024-1472 | Medium | 5.3 | 2024-02-29 | The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.6 via the REST API. This makes it possi… |
CVE-2024-1470 | High | 7.1 | 2024-02-29 | Authorization Bypass Through User-Controlled Key vulnerability in NetIQ (OpenText) Client Login Extension on Windows allows Privilege Escalation, Code Injectio… |
CVE-2024-1448 | Medium | 6.4 | 2024-02-29 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions… |
CVE-2024-1447 | Medium | 6.4 | 2024-02-29 | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aThemes Slider button element in all versions up to, and… |
CVE-2024-1445 | Medium | 6.4 | 2024-02-29 | The Page scroll to id plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.7… |
CVE-2024-1425 | Medium | 6.4 | 2024-02-29 | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerabl… |
CVE-2024-1411 | Medium | 6.4 | 2024-02-29 | The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the settings of the Twitter Buttons Widget in all vers… |
CVE-2024-1408 | Medium | 6.4 | 2024-02-29 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-1390 | Medium | 4.3 | 2024-02-29 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2024-1389 | Medium | 5.3 | 2024-02-29 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2024-1349 | Medium | 6.4 | 2024-02-29 | The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerabl… |
CVE-2024-1340 | Medium | 5.4 | 2024-02-29 | The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_exp… |
CVE-2024-1339 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is… |
CVE-2024-1338 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is… |
CVE-2024-1337 | Medium | 4.3 | 2024-02-29 | The SKT Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveSktbuilderPageData'… |
CVE-2024-1336 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is… |
CVE-2024-1335 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is… |
CVE-2024-1334 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is… |
CVE-2024-1322 | Medium | 5.3 | 2024-02-29 | The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due… |
CVE-2024-1318 | Medium | 6.5 | 2024-02-29 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modificatio… |
CVE-2024-1317 | High | 8.8 | 2024-02-29 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to SQL Injection via the ‘s… |
CVE-2024-1294 | Medium | 5.3 | 2024-02-29 | The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an… |
CVE-2024-1288 | Medium | 4.3 | 2024-02-29 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sas… |
CVE-2024-1282 | Medium | 6.4 | 2024-02-29 | The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) i… |
CVE-2024-1277 | Medium | 6.4 | 2024-02-29 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom fields in all versions up to, and including, 2.2.4 due to insuffic… |
CVE-2024-1276 | Medium | 6.4 | 2024-02-29 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-1242 | Medium | 6.4 | 2024-02-29 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all versions up to, and… |
CVE-2024-1236 | Medium | 6.4 | 2024-02-29 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-1235 | Medium | 6.4 | 2024-02-29 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom class field in all versions up to, and includ… |
CVE-2024-1218 | Medium | 4.3 | 2024-02-29 | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API… |
CVE-2024-1217 | High | 7.6 | 2024-02-29 | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing ca… |
CVE-2024-1206 | High | 8.8 | 2024-02-29 | The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the 'recipes' parameter in all versions up to, and including, 9.1.2 due to insuffic… |
CVE-2024-1192 | Low | 3.3 | 2024-02-29 | A vulnerability was found in South River WebDrive 18.00.5057. It has been declared as problematic. This vulnerability affects unknown code of the component New… |
CVE-2024-1191 | Low | 3.3 | 2024-02-29 | A vulnerability was found in Hyper CdCatalog 2.3.1. It has been classified as problematic. This affects an unknown part of the component HCF File Handler. The… |
CVE-2024-1172 | Medium | 5.4 | 2024-02-29 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-1171 | Medium | 5.4 | 2024-02-29 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-1133 | Medium | 4.3 | 2024-02-29 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capab… |
CVE-2024-1130 | Medium | 5.3 | 2024-02-29 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check… |
CVE-2024-1129 | Medium | 5.3 | 2024-02-29 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check… |
CVE-2024-1128 | Medium | 5.4 | 2024-02-29 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is… |
CVE-2024-1091 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reini… |
CVE-2024-1090 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stopO… |
CVE-2024-1089 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the optim… |
CVE-2024-1070 | Medium | 6.4 | 2024-02-29 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the features attribute in all versions up to, and including… |
CVE-2024-1058 | Medium | 6.4 | 2024-02-29 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the onclick parameter in all versions up to, and including… |
CVE-2024-1054 | Medium | 6.4 | 2024-02-29 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wcj_product_barcode' shortcode in all version… |
CVE-2024-1044 | Medium | 5.3 | 2024-02-29 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_r… |
CVE-2024-1043 | Medium | 6.5 | 2024-02-29 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppb_remov… |
CVE-2024-0984 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disab… |
CVE-2024-0983 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enabl… |
CVE-2024-0978 | Medium | 5.3 | 2024-02-29 | The My Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.14 via the REST API. This ma… |
CVE-2024-0907 | Medium | 5.3 | 2024-02-29 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check… |
CVE-2024-0838 | Medium | 6.4 | 2024-02-29 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the side image URL parameter in the Age Gate in all versio… |
CVE-2024-0821 | Medium | 6.1 | 2024-02-29 | The Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'section'… |
CVE-2024-0792 | Medium | 6.4 | 2024-02-29 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions… |
CVE-2024-0702 | High | 7.3 | 2024-02-29 | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functi… |
CVE-2024-0658 | Medium | 4.4 | 2024-02-29 | The Insert PHP Code Snippet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's name when accessing the insert-php-code-snippet-ma… |
CVE-2024-0656 | Medium | 4.4 | 2024-02-29 | The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-0621 | Medium | 4.4 | 2024-02-29 | The Simple Share Buttons Adder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.4.1… |
CVE-2024-0620 | Medium | 5.3 | 2024-02-29 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.9 via API. Thi… |
CVE-2024-0616 | Medium | 5.3 | 2024-02-29 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4… |
CVE-2024-0604 | Medium | 4.4 | 2024-02-29 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and… |
CVE-2024-0602 | Medium | 4.4 | 2024-02-29 | The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and in… |
CVE-2024-0590 | Medium | 6.1 | 2024-02-29 | The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonc… |
CVE-2024-0516 | Medium | 5.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_u… |
CVE-2024-0515 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0514 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0513 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0512 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0506 | Medium | 6.4 | 2024-02-29 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $instance[alt] param… |
CVE-2024-0442 | Medium | 6.4 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via element URL parameters in all versions up to, an… |
CVE-2024-0438 | Medium | 6.4 | 2024-02-29 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link parameter in the Age Gate in all versions… |
CVE-2024-0379 | Medium | 4.3 | 2024-02-29 | The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-26146 | Medium | 5.3 | 2024-02-29 | Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible de… |
CVE-2024-26141 | Medium | 5.8 | 2024-02-29 | Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with… |
CVE-2024-25126 | Medium | 5.3 | 2024-02-29 | Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leadi… |
CVE-2024-26559 | Medium | 5.3 | 2024-02-28 | An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information. |
CVE-2024-25579 | Medium | 6.8 | 2024-02-28 | OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS c… |
CVE-2024-25422 | Critical | 9.8 | 2024-02-28 | SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMCMS_Menu.php compone… |
CVE-2024-23910 | High | 8.8 | 2024-02-28 | Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the… |