2024 CVEs (page 359)
Page 359 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24868 | High | 8.5 | 2024-02-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affe… |
CVE-2024-21886 | High | 7.8 | 2024-02-28 | A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances… |
CVE-2024-21885 | High | 7.8 | 2024-02-28 | A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs a… |
CVE-2024-1965 | Medium | 6.5 | 2024-02-28 | Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal… |
CVE-2024-1808 | Medium | 6.4 | 2024-02-28 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode' shortcode in all… |
CVE-2024-26016 | Medium | 4.3 | 2024-02-28 | A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ow… |
CVE-2024-24779 | Medium | 5.0 | 2024-02-28 | Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to d… |
CVE-2024-24773 | Medium | 4.9 | 2024-02-28 | Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Supers… |
CVE-2024-24772 | Medium | 4.3 | 2024-02-28 | A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database… |
CVE-2024-1636 | High | 8.0 | 2024-02-28 | Potential Cross-Site Scripting (XSS) in the page editing area. |
CVE-2024-1632 | High | 8.8 | 2024-02-28 | Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area. |
CVE-2024-27315 | Medium | 4.3 | 2024-02-28 | An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an er… |
CVE-2024-1861 | Medium | 4.3 | 2024-02-28 | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-1860 | Medium | 6.5 | 2024-02-28 | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-1719 | Medium | 4.3 | 2024-02-28 | The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Con… |
CVE-2024-22459 | Medium | 6.8 | 2024-02-28 | Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper access control vulnerability. A remote h… |
CVE-2024-1954 | Medium | 6.3 | 2024-02-28 | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1… |
CVE-2024-1791 | Medium | 6.4 | 2024-02-28 | The CodeMirror Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Code Mirror block in all versions up to, and including, 1.2.4 d… |
CVE-2024-1566 | Medium | 6.5 | 2024-02-28 | The Redirects plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in all versions up… |
CVE-2024-1516 | Medium | 5.3 | 2024-02-28 | The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_for_saas_push() func… |
CVE-2024-1514 | Critical | 9.8 | 2024-02-28 | The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'cart_contents' parameter in all versions up to, and including, 3… |
CVE-2024-1476 | Medium | 5.3 | 2024-02-28 | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-1368 | Medium | 5.3 | 2024-02-28 | The Page Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate_dat_page() funct… |
CVE-2024-1136 | Medium | 5.3 | 2024-02-28 | The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented URL check in the wps… |
CVE-2024-0975 | Medium | 5.3 | 2024-02-28 | The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.13 via the REST AP… |
CVE-2024-0786 | High | 8.8 | 2024-02-28 | The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to time-based SQL Inject… |
CVE-2024-0768 | Medium | 4.3 | 2024-02-28 | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.4.4… |
CVE-2024-0767 | Medium | 4.3 | 2024-02-28 | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4… |
CVE-2024-0766 | Medium | 4.3 | 2024-02-28 | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch… |
CVE-2024-0682 | Medium | 5.3 | 2024-02-28 | The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not prope… |
CVE-2024-0680 | Medium | 5.3 | 2024-02-28 | The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin n… |
CVE-2024-0433 | Medium | 4.3 | 2024-02-28 | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to mis… |
CVE-2024-0432 | Medium | 4.3 | 2024-02-28 | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to mis… |
CVE-2024-0431 | Medium | 4.3 | 2024-02-28 | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to mis… |
CVE-2024-27913 | Medium | 6.5 | 2024-02-28 | ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OS… |
CVE-2024-1943 | Medium | 4.3 | 2024-02-28 | The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce… |
CVE-2024-1568 | Medium | 6.4 | 2024-02-28 | The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_… |
CVE-2024-1388 | Medium | 4.3 | 2024-02-28 | The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in… |
CVE-2024-22723 | Medium | 4.9 | 2024-02-28 | Webtrees 2.1.18 is vulnerable to Directory Traversal. By manipulating the "media_folder" parameter in the URL, an attacker (in this case, an administrator) can… |
CVE-2024-0550 | Medium | 6.5 | 2024-02-28 | A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API… |
CVE-2024-1932 | Medium | 4.8 | 2024-02-28 | Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout |
CVE-2024-1892 | Medium | 6.5 | 2024-02-28 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML… |
CVE-2024-26302 | Medium | 4.8 | 2024-02-27 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sen… |
CVE-2024-26301 | Medium | 6.5 | 2024-02-27 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sen… |
CVE-2024-26300 | Medium | 6.6 | 2024-02-27 | A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS)… |
CVE-2024-26542 | Medium | 6.1 | 2024-02-27 | Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a craf… |
CVE-2024-26299 | Medium | 6.6 | 2024-02-27 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site s… |
CVE-2024-26298 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26297 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26296 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26295 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26294 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-0763 | High | 8.1 | 2024-02-27 | Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need acces… |
CVE-2024-24027 | High | 7.2 | 2024-02-27 | SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function DistributionMemberLogic::getFansLists. |
CVE-2024-27099 | Critical | 9.8 | 2024-02-27 | The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cause a double free pr… |
CVE-2024-25846 | Critical | 9.1 | 2024-02-27 | In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload files with extension… |
CVE-2024-25843 | Critical | 9.8 | 2024-02-27 | In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform S… |
CVE-2024-25841 | Medium | 5.9 | 2024-02-27 | In the module "So Flexibilite" (soflexibilite) from Common-Services for PrestaShop < 4.1.26, a guest (authenticated customer) can perform Cross Site Scripting… |
CVE-2024-25840 | High | 7.5 | 2024-02-27 | In the module "Account Manager | Sales Representative & Dealers | CRM" (prestasalesmanager) up to 9.0 from Presta World for PrestaShop, a guest can download pe… |
CVE-2024-24323 | High | 7.2 | 2024-02-27 | SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consignee, orderSN, order… |
CVE-2024-21742 | Medium | 5.3 | 2024-02-27 | Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to ad… |
CVE-2024-1926 | Medium | 6.3 | 2024-02-27 | A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknow… |
CVE-2024-1925 | Medium | 5.0 | 2024-02-27 | A vulnerability was found in Ctcms 2.1.2. It has been declared as critical. This vulnerability affects unknown code of the file ctcms/apps/controllers/admin/Up… |
CVE-2024-1924 | Medium | 6.3 | 2024-02-27 | A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the file /get_memb… |
CVE-2024-27508 | High | 7.5 | 2024-02-27 | Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c. |
CVE-2024-26144 | Medium | 5.3 | 2024-02-27 | Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active… |
CVE-2024-26143 | Medium | 6.1 | 2024-02-27 | Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using transla… |
CVE-2024-26142 | High | 7.5 | 2024-02-27 | Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispat… |
CVE-2024-25400 | Critical | 9.8 | 2024-02-27 | Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php. NOTE: this is disputed by multiple third parties because it refers to an HTTP request… |
CVE-2024-25399 | Medium | 6.1 | 2024-02-27 | Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php. |
CVE-2024-25398 | High | 7.5 | 2024-02-27 | In Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt the service. |
CVE-2024-1923 | Medium | 6.3 | 2024-02-27 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as critical. Affected by this issue is the function delete_clas… |
CVE-2024-1922 | Low | 3.5 | 2024-02-27 | A vulnerability has been found in SourceCodester Online Job Portal 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionalit… |
CVE-2024-1403 | Critical | 10.0 | 2024-02-27 | In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypa… |
CVE-2024-27905 | Critical | 9.1 | 2024-02-27 | ** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to u… |
CVE-2024-27507 | High | 7.5 | 2024-02-27 | libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp. |
CVE-2024-25723 | High | 8.8 | 2024-02-27 | ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/acti… |
CVE-2024-1921 | Medium | 4.7 | 2024-02-27 | A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Set… |
CVE-2024-1920 | Medium | 5.6 | 2024-02-27 | A vulnerability, which was classified as critical, has been found in osuuu LightPicture up to 1.2.2. This issue affects the function handle of the file /app/mi… |
CVE-2024-1919 | Low | 3.5 | 2024-02-27 | A vulnerability classified as problematic was found in SourceCodester Online Job Portal 1.0. This vulnerability affects unknown code of the file /Employer/Mana… |
CVE-2024-0819 | High | 7.3 | 2024-02-27 | Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and macOS, allow a low privileged user to ele… |
CVE-2024-0551 | High | 7.1 | 2024-02-27 | Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access… |
CVE-2024-1918 | Medium | 4.7 | 2024-02-27 | A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2024-0197 | High | 7.8 | 2024-02-27 | A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access. |
CVE-2024-1912 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1910 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1909 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1907 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1906 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorr… |
CVE-2024-1653 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxUpdateFolderPosit… |
CVE-2024-1652 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxClearCategory fun… |
CVE-2024-1650 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxRenameCategory fu… |
CVE-2024-1649 | Medium | 4.3 | 2024-02-27 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxDeleteCategory fu… |
CVE-2024-1106 | Medium | 6.1 | 2024-02-27 | The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-0855 | Medium | 5.3 | 2024-02-27 | The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to… |
CVE-2024-1698 | Critical | 9.8 | 2024-02-27 | The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injecti… |
CVE-2024-1687 | Medium | 5.4 | 2024-02-27 | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing… |
CVE-2024-1686 | Medium | 4.3 | 2024-02-27 | The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and in… |
CVE-2024-0759 | High | 7.5 | 2024-02-27 | Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could li… |
CVE-2024-1323 | Medium | 6.4 | 2024-02-27 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Type Grid Widget Title in all versions up to… |