2024 CVEs (page 372)
Page 372 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20810 | Low | 3.3 | 2024-02-06 | Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-22853 | Critical | 9.8 | 2024-02-06 | D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a te… |
CVE-2024-22852 | Critical | 9.8 | 2024-02-06 | D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to enable… |
CVE-2024-24112 | Critical | 9.8 | 2024-02-06 | xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter. |
CVE-2024-22773 | High | 8.1 | 2024-02-06 | Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass. |
CVE-2024-0244 | Critical | 9.8 | 2024-02-06 | Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigg… |
CVE-2024-24398 | Critical | 9.8 | 2024-02-06 | Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted… |
CVE-2024-23049 | Critical | 9.8 | 2024-02-05 | An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component. |
CVE-2024-0964 | Critical | 9.4 | 2024-02-05 | A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request. |
CVE-2024-24595 | Medium | 6.0 | 2024-02-05 | Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user email… |
CVE-2024-1210 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it poss… |
CVE-2024-1209 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due… |
CVE-2024-1208 | Medium | 5.3 | 2024-02-05 | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it poss… |
CVE-2024-1177 | Medium | 5.3 | 2024-02-05 | The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-1121 | Medium | 5.3 | 2024-02-05 | The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_json_file() functi… |
CVE-2024-1092 | Medium | 4.3 | 2024-02-05 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized data modifi… |
CVE-2024-1075 | Low | 3.7 | 2024-02-05 | The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all versions up to, and… |
CVE-2024-1072 | High | 8.2 | 2024-02-05 | The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized mo… |
CVE-2024-1046 | Medium | 6.4 | 2024-02-05 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-0969 | Medium | 5.3 | 2024-02-05 | The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it… |
CVE-2024-0961 | Medium | 6.4 | 2024-02-05 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the code editor in all versions up to, and including, 1.58… |
CVE-2024-0954 | Medium | 6.4 | 2024-02-05 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-0869 | High | 8.8 | 2024-02-05 | The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options… |
CVE-2024-0859 | Medium | 4.3 | 2024-02-05 | The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or… |
CVE-2024-0835 | Medium | 4.3 | 2024-02-05 | The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissed_handler… |
CVE-2024-0834 | Medium | 6.4 | 2024-02-05 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_to parameter in all versions up to, and including… |
CVE-2024-0823 | Medium | 5.4 | 2024-02-05 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' url in carousels in all versions up to… |
CVE-2024-0797 | Medium | 4.3 | 2024-02-05 | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized access of fun… |
CVE-2024-0796 | Medium | 4.3 | 2024-02-05 | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Cross-Site Request Forgery… |
CVE-2024-0791 | Medium | 4.3 | 2024-02-05 | The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to… |
CVE-2024-0790 | Medium | 5.4 | 2024-02-05 | The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc… |
CVE-2024-0761 | High | 8.1 | 2024-02-05 | The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomnes… |
CVE-2024-0709 | Critical | 9.8 | 2024-02-05 | The Cryptocurrency Widgets – Price Ticker & Coins List plugin for WordPress is vulnerable to SQL Injection via the 'coinslist' parameter in versions 2.0 to 2.6… |
CVE-2024-0701 | Medium | 5.3 | 2024-02-05 | The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side re… |
CVE-2024-0699 | Medium | 6.6 | 2024-02-05 | The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati… |
CVE-2024-0691 | Medium | 5.5 | 2024-02-05 | The FileBird plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported folder titles in all versions up to, and including, 5.5.8.1 due to… |
CVE-2024-0678 | Medium | 6.5 | 2024-02-05 | The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' parameter in all versio… |
CVE-2024-0668 | Medium | 6.6 | 2024-02-05 | The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via deserialization of unt… |
CVE-2024-0660 | Medium | 6.1 | 2024-02-05 | The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forg… |
CVE-2024-0659 | Medium | 5.5 | 2024-02-05 | The Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2024-0630 | Medium | 4.4 | 2024-02-05 | The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the RSS feed source in all versions up to, and including, 4.23.4 du… |
CVE-2024-0612 | Medium | 4.4 | 2024-02-05 | The Content Views – Post Grid, Slider, Accordion (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin s… |
CVE-2024-0597 | Medium | 4.4 | 2024-02-05 | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 12.3.15… |
CVE-2024-0586 | Medium | 6.4 | 2024-02-05 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-0585 | Medium | 5.4 | 2024-02-05 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-0509 | Medium | 6.1 | 2024-02-05 | The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘request’ parameter in all versions up to… |
CVE-2024-0508 | Medium | 6.4 | 2024-02-05 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table Elementor Widget in all versions up… |
CVE-2024-0448 | Medium | 6.4 | 2024-02-05 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget URL parameters in all versions up to… |
CVE-2024-0428 | High | 7.1 | 2024-02-05 | The Index Now plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.3. This is due to missing or incorrect… |
CVE-2024-0384 | Medium | 6.4 | 2024-02-05 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipe Notes in all versions up to, and including, 9.1.0 due to insuf… |
CVE-2024-0382 | Medium | 6.4 | 2024-02-05 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0… |
CVE-2024-0380 | Medium | 5.4 | 2024-02-05 | The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.0 via the 'icon' attribute used in Shor… |
CVE-2024-0374 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u… |
CVE-2024-0373 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u… |
CVE-2024-0372 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of data due to a missing… |
CVE-2024-0371 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a m… |
CVE-2024-0370 | Medium | 4.3 | 2024-02-05 | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a m… |
CVE-2024-0366 | Medium | 4.3 | 2024-02-05 | The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via… |
CVE-2024-0324 | High | 8.2 | 2024-02-05 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-0255 | Medium | 6.4 | 2024-02-05 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-recipe-text-share' shortcode in all versions up to… |
CVE-2024-0254 | Medium | 6.4 | 2024-02-05 | The (Simply) Guest Author Name plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's post meta in all versions up to, and includin… |
CVE-2024-0221 | Critical | 9.1 | 2024-02-05 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8… |
CVE-2024-24807 | Low | 2.7 | 2024-02-05 | Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name… |
CVE-2024-24574 | Medium | 6.5 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attac… |
CVE-2024-24559 | Low | 3.7 | 2024-02-05 | Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `heig… |
CVE-2024-24543 | Critical | 9.8 | 2024-02-05 | Buffer Overflow vulnerability in the function setSchedWifi in Tenda AC9 v.3.0, firmware version v.15.03.06.42_multi allows a remote attacker to cause a denial… |
CVE-2024-22208 | Medium | 6.5 | 2024-02-05 | phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticat… |
CVE-2024-1052 | High | 8.0 | 2024-02-05 | Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate ac… |
CVE-2024-0202 | Medium | 5.9 | 2024-02-05 | A security vulnerability has been identified in the cryptlib cryptographic library when cryptlib is compiled with the support for RSA key exchange ciphersuites… |
CVE-2024-22567 | High | 8.8 | 2024-02-05 | File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do. |
CVE-2024-22202 | Medium | 5.7 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof… |
CVE-2024-24396 | Medium | 6.1 | 2024-02-05 | Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafte… |
CVE-2024-24267 | High | 7.5 | 2024-02-05 | gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function. |
CVE-2024-24266 | High | 7.5 | 2024-02-05 | gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at /src/filters/dasher.c. |
CVE-2024-24265 | High | 7.5 | 2024-02-05 | gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function. |
CVE-2024-24263 | High | 7.5 | 2024-02-05 | Lotos WebServer v0.1.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the response_append_status_line function at /lotos/src/response.c. |
CVE-2024-24262 | High | 7.5 | 2024-02-05 | media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip_uac_stop_timer function at /uac/sip-uac-transaction.c. |
CVE-2024-24260 | High | 7.5 | 2024-02-05 | media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip_subscribe_remove function at /uac/sip-uac-subscribe.c. |
CVE-2024-24259 | High | 7.5 | 2024-02-05 | freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function. |
CVE-2024-24258 | High | 7.5 | 2024-02-05 | freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function. |
CVE-2024-0953 | Medium | 6.1 | 2024-02-05 | When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code. This may surp… |
CVE-2024-24469 | High | 8.8 | 2024-02-05 | Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the delete_post .php. |
CVE-2024-24468 | High | 8.8 | 2024-02-05 | Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_customblock.php. |
CVE-2024-24397 | Medium | 5.4 | 2024-02-05 | Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafte… |
CVE-2024-23054 | Critical | 9.8 | 2024-02-05 | An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++stati… |
CVE-2024-0323 | Critical | 9.8 | 2024-02-05 | The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network-based attacker can exp… |
CVE-2024-24768 | Medium | 6.5 | 2024-02-05 | 1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword… |
CVE-2024-24762 | High | 7.5 | 2024-02-05 | `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Ty… |
CVE-2024-23109 | Critical | 10.0 | 2024-02-05 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorize… |
CVE-2024-23108 | Critical | 10.0 | 2024-02-05 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorize… |
CVE-2024-1225 | High | 7.3 | 2024-02-05 | A vulnerability classified as critical was found in QiboSoft QiboCMS X1 up to 1.0.6. Affected by this vulnerability is the function rmb_pay of the file /applic… |
CVE-2024-24864 | Medium | 5.3 | 2024-02-05 | A race condition was found in the Linux kernel's media/dvb-core in dvbdmx_write() function. This can result in a null pointer dereference issue, possibly leadi… |
CVE-2024-24861 | Low | 3.3 | 2024-02-05 | A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000_get_frequency() function. This can result in return value overflow… |
CVE-2024-24860 | Medium | 4.6 | 2024-02-05 | A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference is… |
CVE-2024-24859 | Medium | 4.6 | 2024-02-05 | A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception is… |
CVE-2024-24858 | Medium | 4.6 | 2024-02-05 | A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcas… |
CVE-2024-24857 | Medium | 4.6 | 2024-02-05 | A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow i… |
CVE-2024-24855 | Medium | 5.0 | 2024-02-05 | A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference iss… |
CVE-2024-23196 | Medium | 5.3 | 2024-02-05 | A race condition was found in the Linux kernel's sound/hda device driver in snd_hdac_regmap_sync() function. This can result in a null pointer dereference iss… |
CVE-2024-22667 | High | 7.8 | 2024-02-05 | Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the op… |