2024 CVEs (page 374)
Page 374 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22148 | High | 7.1 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Editor JoomUnited allows Reflected XSS.This issu… |
CVE-2024-21750 | High | 7.1 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scribit Shortcodes Finder allows Reflected XSS.This issue… |
CVE-2024-24548 | Medium | 6.5 | 2024-02-01 | Payment EX Ver1.1.5b and earlier allows a remote unauthenticated attacker to obtain the information of the user who purchases merchandise using Payment EX. |
CVE-2024-22859 | High | 8.8 | 2024-02-01 | Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the v… |
CVE-2024-23941 | Medium | 5.4 | 2024-02-01 | Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated atta… |
CVE-2024-0831 | Medium | 4.5 | 2024-02-01 | Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensiti… |
CVE-2024-24573 | High | 8.8 | 2024-01-31 | facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request… |
CVE-2024-24572 | Medium | 6.5 | 2024-01-31 | facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was unsafely called ins… |
CVE-2024-24571 | Medium | 5.4 | 2024-01-31 | facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found t… |
CVE-2024-24747 | High | 8.8 | 2024-01-31 | MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but… |
CVE-2024-23653 | Critical | 9.8 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as bui… |
CVE-2024-23652 | Critical | 10.0 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerf… |
CVE-2024-23651 | High | 8.7 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in par… |
CVE-2024-23650 | Medium | 5.3 | 2024-01-31 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend… |
CVE-2024-21626 | High | 8.6 | 2024-01-31 | runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descrip… |
CVE-2024-1117 | High | 7.3 | 2024-01-31 | A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of the file /applicatio… |
CVE-2024-1116 | High | 7.3 | 2024-01-31 | A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application/plugins/controller… |
CVE-2024-1115 | High | 7.3 | 2024-01-31 | A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controlle… |
CVE-2024-1114 | Medium | 6.5 | 2024-01-31 | A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function dlfile of the file /application/index/… |
CVE-2024-1113 | Medium | 6.3 | 2024-01-31 | A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /application/index/contro… |
CVE-2024-22159 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager… |
CVE-2024-22158 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership… |
CVE-2024-22153 | Medium | 5.9 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood & Alexandre Faustino Stock Locations for Wo… |
CVE-2024-22150 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PWR Plugins Portfolio & Image Gallery for WordPress | Pow… |
CVE-2024-22146 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows St… |
CVE-2024-21917 | Critical | 9.8 | 2024-01-31 | A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authenticat… |
CVE-2024-21916 | High | 8.6 | 2024-01-31 | A denial-of-service vulnerability exists in specific Rockwell Automation ControlLogix ang GuardLogix controllers. If exploited, the product could potentially… |
CVE-2024-1111 | Medium | 4.3 | 2024-01-31 | A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Login System 1.0. Affected by this issue is some unknown functio… |
CVE-2024-23637 | Medium | 4.2 | 2024-01-31 | OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change th… |
CVE-2024-22297 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeboxr CBX Map for Google Map & OpenStreetMap allows St… |
CVE-2024-22295 | Medium | 5.9 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Galle… |
CVE-2024-22293 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrea Tarantini BP Profile Search allows Reflected XSS.T… |
CVE-2024-22292 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP… |
CVE-2024-22289 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberNetikz Post views Stats post-views-stats allows DOM-… |
CVE-2024-22286 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aluka BA Plus – Before & After Image Slider FREE allows R… |
CVE-2024-22282 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Torbert SimpleMap Store Locator allows Reflected… |
CVE-2024-22163 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shield Security Shield Security – Smart Bot Blocking & In… |
CVE-2024-22162 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Shortcodes allows Reflected XSS.This issue… |
CVE-2024-22161 | Medium | 5.9 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harmonic Design HD Quiz allows Stored XSS.This issue affe… |
CVE-2024-22160 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bradley B. Dalina Image Tag Manager allows Reflected XSS… |
CVE-2024-21893 | High | 8.2 | 2024-01-31 | A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons… |
CVE-2024-21888 | High | 8.8 | 2024-01-31 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privil… |
CVE-2024-24579 | Medium | 5.3 | 2024-01-31 | stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar arc… |
CVE-2024-24566 | Medium | 5.3 | 2024-01-31 | Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-prote… |
CVE-2024-22310 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formzu Inc. Formzu WP allows Stored XSS.This issue affect… |
CVE-2024-22307 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay.This is… |
CVE-2024-22306 | Medium | 5.9 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hometory Mang Board WP allows Stored XSS.This issue affec… |
CVE-2024-22302 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignazio Scimone Albo Pretorio On line allows Stored XSS.T… |
CVE-2024-23508 | High | 7.1 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress a… |
CVE-2024-23505 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DearHive PDF Viewer & 3D PDF Flipbook – DearPDF allows St… |
CVE-2024-23502 | Medium | 6.5 | 2024-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in InfornWeb Posts List Designer by Category – List Category… |
CVE-2024-0833 | High | 7.8 | 2024-01-31 | In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In a… |
CVE-2024-0832 | High | 7.8 | 2024-01-31 | In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environ… |
CVE-2024-0219 | High | 7.8 | 2024-01-31 | In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an env… |
CVE-2024-1103 | Low | 3.5 | 2024-01-31 | A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionalit… |
CVE-2024-22140 | High | 8.8 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0. |
CVE-2024-22136 | Medium | 4.3 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in DroitThemes Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder.This issue aff… |
CVE-2024-1112 | High | 7.3 | 2024-01-31 | Heap-based buffer overflow vulnerability in Resource Hacker, developed by Angus Johnson, affecting version 3.6.0.92. This vulnerability could allow an attacker… |
CVE-2024-22304 | Medium | 5.4 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a through 2.3.2. |
CVE-2024-22291 | Medium | 4.3 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Browser Theme Color.This issue affects Browser Theme Color: from n/a through 1.3. |
CVE-2024-22285 | Medium | 5.4 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Elise Bosse Frontpage Manager.This issue affects Frontpage Manager: from n/a through 1.3. |
CVE-2024-22143 | Medium | 5.4 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check.This issue affects WP Spell Check: from n/a through 9.17. |
CVE-2024-1086 | High | 7.8 | 2024-01-31 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_… |
CVE-2024-1085 | High | 7.8 | 2024-01-31 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_ca… |
CVE-2024-0589 | Medium | 5.4 | 2024-01-31 | Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows allows an attacker wi… |
CVE-2024-23507 | High | 8.5 | 2024-01-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affect… |
CVE-2024-22305 | High | 7.5 | 2024-01-31 | Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects… |
CVE-2024-22290 | High | 7.1 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in AboZain,O7abeeb,UnitOne Custom Dashboard Widgets allows Cross-Site Scripting (XSS).This issue affects Custom… |
CVE-2024-22287 | High | 7.1 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Luděk Melichar Better Anchor Links allows Cross-Site Scripting (XSS).This issue affects Better Anchor Links… |
CVE-2024-1099 | Low | 3.5 | 2024-01-31 | A vulnerability was found in Rebuild up to 3.5.5. It has been classified as problematic. Affected is the function getFileOfData of the file /filex/read-raw. Th… |
CVE-2024-1098 | Medium | 4.3 | 2024-01-31 | A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic. This issue affects the function QiniuCloud.getStorageFile of the file /filex/pr… |
CVE-2024-23775 | High | 7.5 | 2024-01-31 | Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_ext… |
CVE-2024-23170 | Medium | 5.5 | 2024-01-31 | An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could… |
CVE-2024-1012 | Medium | 6.3 | 2024-01-31 | A vulnerability, which was classified as critical, has been found in Wanhu ezOFFICE 11.1.0. This issue affects some unknown processing of the file defaultroot/… |
CVE-2024-0836 | Medium | 4.3 | 2024-01-31 | The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca… |
CVE-2024-22236 | Low | 3.3 | 2024-01-31 | In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to loc… |
CVE-2024-0914 | Medium | 5.9 | 2024-01-31 | A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potent… |
CVE-2024-1069 | High | 7.2 | 2024-01-31 | The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versio… |
CVE-2024-23745 | Critical | 9.8 | 2024-01-31 | In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, e… |
CVE-2024-22569 | Medium | 5.4 | 2024-01-31 | Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=in… |
CVE-2024-23834 | Medium | 6.3 | 2024-01-30 | Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only… |
CVE-2024-1077 | High | 8.8 | 2024-01-30 | Use after free in Network in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a malicious file. (Chro… |
CVE-2024-1060 | High | 8.8 | 2024-01-30 | Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2024-1059 | High | 8.8 | 2024-01-30 | Use after free in Peer Connection in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML… |
CVE-2024-24567 | Medium | 4.8 | 2024-01-30 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a d… |
CVE-2024-24558 | High | 8.2 | 2024-01-30 | TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-next-experimental` NPM… |
CVE-2024-24556 | High | 7.2 | 2024-01-30 | urql is a GraphQL client that exposes a set of helpers for several frameworks. The `@urql/next` package is vulnerable to XSS. To exploit this an attacker woul… |
CVE-2024-23841 | High | 8.2 | 2024-01-30 | apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cros… |
CVE-2024-21388 | Medium | 6.5 | 2024-01-30 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2024-1036 | High | 7.3 | 2024-01-30 | A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function uploadIcon of the file /application/index/controlle… |
CVE-2024-24565 | Medium | 5.7 | 2024-01-30 | CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the Crat… |
CVE-2024-23840 | Medium | 5.5 | 2024-01-30 | GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --deb… |
CVE-2024-23838 | High | 7.5 | 2024-01-30 | TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the Ht… |
CVE-2024-23825 | Low | 3.0 | 2024-01-30 | TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by the user. That use… |
CVE-2024-23647 | Medium | 6.5 | 2024-01-30 | Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offe… |
CVE-2024-22200 | Low | 3.3 | 2024-01-30 | vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, users can run the U… |
CVE-2024-22193 | Low | 3.5 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are n… |
CVE-2024-21671 | Low | 3.7 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is poss… |
CVE-2024-21653 | Medium | 6.5 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Nodes and… |
CVE-2024-21649 | High | 8.8 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4… |