2024 CVEs (page 359)
Page 359 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22532 | Medium | 6.5 | 2024-02-28 | Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x86) allows attackers to cause a denial of service via crafted xwd file. |
CVE-2024-21798 | Medium | 4.8 | 2024-02-28 | ELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affected product with spec… |
CVE-2024-26476 | Low | 3.5 | 2024-02-28 | An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq_form.php component. |
CVE-2024-26450 | Medium | 5.4 | 2024-02-28 | An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forge… |
CVE-2024-25869 | High | 8.8 | 2024-02-28 | An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload… |
CVE-2024-25868 | Medium | 6.1 | 2024-02-28 | A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via the me… |
CVE-2024-25867 | Critical | 9.1 | 2024-02-28 | A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the members… |
CVE-2024-25866 | High | 8.8 | 2024-02-28 | A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email p… |
CVE-2024-25351 | Low | 3.8 | 2024-02-28 | SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to run arbitrary SQL commands via the editid… |
CVE-2024-25350 | Critical | 9.8 | 2024-02-28 | SQL Injection vulnerability in /zms/admin/edit-ticket.php in PHPGurukul Zoo Management System 1.0 via tickettype and tprice parameters. |
CVE-2024-22983 | High | 8.1 | 2024-02-28 | SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in t… |
CVE-2024-1972 | Low | 3.5 | 2024-02-28 | A vulnerability was found in SourceCodester Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the fi… |
CVE-2024-27285 | Medium | 5.4 | 2024-02-28 | YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2024-25859 | High | 7.1 | 2024-02-28 | A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code. |
CVE-2024-25435 | Medium | 6.1 | 2024-02-28 | A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injec… |
CVE-2024-25202 | Medium | 6.1 | 2024-02-28 | Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attackers to run arbitrary code via the search… |
CVE-2024-25170 | Critical | 9.1 | 2024-02-28 | An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header. |
CVE-2024-25169 | Critical | 9.8 | 2024-02-28 | An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request. |
CVE-2024-24148 | High | 7.5 | 2024-02-28 | A memory leak issue discovered in parseSWF_FREECHARACTER in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file. |
CVE-2024-27948 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in bytesforall Atahualpa.This issue affects Atahualpa: from n/a through 3.7.24. |
CVE-2024-27103 | Medium | 6.1 | 2024-02-28 | Querybook is a Big Data Querying UI. When a user searches for their queries, datadocs, tables and lists, the search result is marked and highlighted, and this… |
CVE-2024-26342 | High | 7.5 | 2024-02-28 | A Null pointer dereference in usr/sbin/httpd in ASUS AC68U 3.0.0.4.384.82230 allows remote attackers to trigger DoS via network packet. |
CVE-2024-1847 | High | 7.8 | 2024-02-28 | Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Us… |
CVE-2024-21749 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au 1 click disable all.This issue affects 1 click disable all: from n/a through 1.0.1. |
CVE-2024-0560 | Medium | 6.3 | 2024-02-28 | A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Toke… |
CVE-2024-24705 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Octa Code Accessibility.This issue affects Accessibility: from n/a through 1.0.6. |
CVE-2024-24702 | Medium | 4.3 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Matt Martz & Andy Stratton Page Restrict.This issue affects Page Restrict: from n/a through 2.5.5. |
CVE-2024-27515 | High | 7.2 | 2024-02-28 | Osclass 5.1.2 is vulnerable to SQL Injection. |
CVE-2024-25927 | Critical | 9.3 | 2024-02-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Joel Starnes postMash – custom post order.This issue affe… |
CVE-2024-25910 | Critical | 9.8 | 2024-02-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a th… |
CVE-2024-25902 | High | 7.6 | 2024-02-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniorange Malware Scanner.This issue affects Malware Sca… |
CVE-2024-24868 | High | 8.5 | 2024-02-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affe… |
CVE-2024-21886 | High | 7.8 | 2024-02-28 | A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances… |
CVE-2024-21885 | High | 7.8 | 2024-02-28 | A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs a… |
CVE-2024-1965 | Medium | 6.5 | 2024-02-28 | Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal… |
CVE-2024-1808 | Medium | 6.4 | 2024-02-28 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_qrcode' shortcode in all… |
CVE-2024-26016 | Medium | 4.3 | 2024-02-28 | A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ow… |
CVE-2024-24779 | Medium | 5.0 | 2024-02-28 | Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to d… |
CVE-2024-24773 | Medium | 4.9 | 2024-02-28 | Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Supers… |
CVE-2024-24772 | Medium | 4.3 | 2024-02-28 | A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database… |
CVE-2024-1636 | High | 8.0 | 2024-02-28 | Potential Cross-Site Scripting (XSS) in the page editing area. |
CVE-2024-1632 | High | 8.8 | 2024-02-28 | Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area. |
CVE-2024-27315 | Medium | 4.3 | 2024-02-28 | An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an er… |
CVE-2024-1861 | Medium | 4.3 | 2024-02-28 | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-1860 | Medium | 6.5 | 2024-02-28 | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-1719 | Medium | 4.3 | 2024-02-28 | The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Con… |
CVE-2024-22459 | Medium | 6.8 | 2024-02-28 | Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper access control vulnerability. A remote h… |
CVE-2024-1954 | Medium | 6.3 | 2024-02-28 | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1… |
CVE-2024-1791 | Medium | 6.4 | 2024-02-28 | The CodeMirror Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Code Mirror block in all versions up to, and including, 1.2.4 d… |
CVE-2024-1566 | Medium | 6.5 | 2024-02-28 | The Redirects plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in all versions up… |
CVE-2024-1516 | Medium | 5.3 | 2024-02-28 | The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_for_saas_push() func… |
CVE-2024-1514 | Critical | 9.8 | 2024-02-28 | The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'cart_contents' parameter in all versions up to, and including, 3… |
CVE-2024-1476 | Medium | 5.3 | 2024-02-28 | The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-1368 | Medium | 5.3 | 2024-02-28 | The Page Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate_dat_page() funct… |
CVE-2024-1136 | Medium | 5.3 | 2024-02-28 | The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented URL check in the wps… |
CVE-2024-0975 | Medium | 5.3 | 2024-02-28 | The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.13 via the REST AP… |
CVE-2024-0786 | High | 8.8 | 2024-02-28 | The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to time-based SQL Inject… |
CVE-2024-0768 | Medium | 4.3 | 2024-02-28 | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.4.4… |
CVE-2024-0767 | Medium | 4.3 | 2024-02-28 | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4… |
CVE-2024-0766 | Medium | 4.3 | 2024-02-28 | The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch… |
CVE-2024-0682 | Medium | 5.3 | 2024-02-28 | The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not prope… |
CVE-2024-0680 | Medium | 5.3 | 2024-02-28 | The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin n… |
CVE-2024-0433 | Medium | 4.3 | 2024-02-28 | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to mis… |
CVE-2024-0432 | Medium | 4.3 | 2024-02-28 | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to mis… |
CVE-2024-0431 | Medium | 4.3 | 2024-02-28 | The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to mis… |
CVE-2024-27913 | Medium | 6.5 | 2024-02-28 | ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OS… |
CVE-2024-1943 | Medium | 4.3 | 2024-02-28 | The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce… |
CVE-2024-1568 | Medium | 6.4 | 2024-02-28 | The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_… |
CVE-2024-1388 | Medium | 4.3 | 2024-02-28 | The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in… |
CVE-2024-22723 | Medium | 4.9 | 2024-02-28 | Webtrees 2.1.18 is vulnerable to Directory Traversal. By manipulating the "media_folder" parameter in the URL, an attacker (in this case, an administrator) can… |
CVE-2024-0550 | Medium | 6.5 | 2024-02-28 | A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API… |
CVE-2024-1932 | Medium | 4.8 | 2024-02-28 | Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout |
CVE-2024-1892 | Medium | 6.5 | 2024-02-28 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML… |
CVE-2024-26302 | Medium | 4.8 | 2024-02-27 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sen… |
CVE-2024-26301 | Medium | 6.5 | 2024-02-27 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sen… |
CVE-2024-26300 | Medium | 6.6 | 2024-02-27 | A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS)… |
CVE-2024-26542 | Medium | 6.1 | 2024-02-27 | Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a craf… |
CVE-2024-26299 | Medium | 6.6 | 2024-02-27 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site s… |
CVE-2024-26298 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26297 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26296 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26295 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-26294 | High | 7.2 | 2024-02-27 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2024-0763 | High | 8.1 | 2024-02-27 | Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need acces… |
CVE-2024-24027 | High | 7.2 | 2024-02-27 | SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function DistributionMemberLogic::getFansLists. |
CVE-2024-27099 | Critical | 9.8 | 2024-02-27 | The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cause a double free pr… |
CVE-2024-25846 | Critical | 9.1 | 2024-02-27 | In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload files with extension… |
CVE-2024-25843 | Critical | 9.8 | 2024-02-27 | In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform S… |
CVE-2024-25841 | Medium | 5.9 | 2024-02-27 | In the module "So Flexibilite" (soflexibilite) from Common-Services for PrestaShop < 4.1.26, a guest (authenticated customer) can perform Cross Site Scripting… |
CVE-2024-25840 | High | 7.5 | 2024-02-27 | In the module "Account Manager | Sales Representative & Dealers | CRM" (prestasalesmanager) up to 9.0 from Presta World for PrestaShop, a guest can download pe… |
CVE-2024-24323 | High | 7.2 | 2024-02-27 | SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consignee, orderSN, order… |
CVE-2024-21742 | Medium | 5.3 | 2024-02-27 | Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to ad… |
CVE-2024-1926 | Medium | 6.3 | 2024-02-27 | A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknow… |
CVE-2024-1925 | Medium | 5.0 | 2024-02-27 | A vulnerability was found in Ctcms 2.1.2. It has been declared as critical. This vulnerability affects unknown code of the file ctcms/apps/controllers/admin/Up… |
CVE-2024-1924 | Medium | 6.3 | 2024-02-27 | A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the file /get_memb… |
CVE-2024-27508 | High | 7.5 | 2024-02-27 | Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c. |
CVE-2024-26144 | Medium | 5.3 | 2024-02-27 | Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active… |
CVE-2024-26143 | Medium | 6.1 | 2024-02-27 | Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using transla… |
CVE-2024-26142 | High | 7.5 | 2024-02-27 | Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispat… |
CVE-2024-25400 | Critical | 9.8 | 2024-02-27 | Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php. NOTE: this is disputed by multiple third parties because it refers to an HTTP request… |