2024 CVEs (page 38)
Page 38 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55416 | Low | 3.5 | 2025-01-30 | DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Ja… |
CVE-2024-55415 | Medium | 5.7 | 2025-01-30 | DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass. |
CVE-2024-53615 | Medium | 6.5 | 2025-01-30 | A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to exec… |
CVE-2024-8494 | Medium | 4.3 | 2025-01-30 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'e… |
CVE-2024-13742 | Critical | 9.8 | 2025-01-30 | The iControlWP – Multiple WordPress Site Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.5 via des… |
CVE-2024-13720 | High | 8.8 | 2025-01-30 | The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gky_image_uploader_main_fun… |
CVE-2024-13715 | Medium | 4.3 | 2025-01-30 | The zStore Manager Basic plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the zstore_clear_cache() function… |
CVE-2024-13707 | High | 8.8 | 2025-01-30 | The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or i… |
CVE-2024-13705 | Medium | 6.1 | 2025-01-30 | The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL i… |
CVE-2024-13700 | Medium | 6.4 | 2025-01-30 | The Embed Swagger UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsgui' shortcode in all versions up to, and including… |
CVE-2024-13671 | High | 7.5 | 2025-01-30 | The Music Sheet Viewer plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.1 via the read_score_file() function… |
CVE-2024-13670 | Medium | 6.4 | 2025-01-30 | The Music Sheet Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pn_msv' shortcode in all versions up to, and includi… |
CVE-2024-13664 | Medium | 6.4 | 2025-01-30 | The WP Post List Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpb_post_list_table' shortcode in all versions up to… |
CVE-2024-13661 | Medium | 6.4 | 2025-01-30 | The Table Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wptableeditor_vtabs' shortcode in all versions up to, and… |
CVE-2024-13652 | Medium | 4.3 | 2025-01-30 | The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clear_ecpay_debug… |
CVE-2024-13646 | High | 8.1 | 2025-01-30 | The Single-user-chat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validatio… |
CVE-2024-13596 | Medium | 6.5 | 2025-01-30 | The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'sur… |
CVE-2024-13549 | Medium | 6.4 | 2025-01-30 | The All Bootstrap Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Accordion" widget in all versions up to, and including, 1.3… |
CVE-2024-13512 | Medium | 6.1 | 2025-01-30 | The Wonder FontAwesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or in… |
CVE-2024-13460 | Medium | 6.4 | 2025-01-30 | The WE – Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Testimonial Author Names in all versions up to, and including… |
CVE-2024-13400 | Medium | 6.4 | 2025-01-30 | The Kona Gallery Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Kona: Instagram for Gutenberg" Block, specifically in the "al… |
CVE-2024-13349 | Medium | 6.4 | 2025-01-30 | The Stockdio Historical Chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stockdio-historical-chart' shortcode in all v… |
CVE-2024-12861 | Medium | 6.5 | 2025-01-30 | The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2s_v… |
CVE-2024-12822 | Critical | 9.8 | 2025-01-30 | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing ca… |
CVE-2024-12821 | High | 8.8 | 2025-01-30 | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing ca… |
CVE-2024-12451 | Medium | 6.4 | 2025-01-30 | The HTML5 chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'HTML5CHAT' shortcode in all versions up to, and including, 1… |
CVE-2024-12444 | Medium | 6.4 | 2025-01-30 | The WP Dispensary plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpd_menu' shortcode in all versions up to, and including… |
CVE-2024-12320 | Medium | 6.1 | 2025-01-30 | The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 4.7 due to… |
CVE-2024-12299 | Medium | 6.1 | 2025-01-30 | The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8… |
CVE-2024-12269 | High | 7.5 | 2025-01-30 | The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db() fu… |
CVE-2024-12177 | Medium | 6.1 | 2025-01-30 | The Ai Image Alt Text Generator for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and… |
CVE-2024-12129 | High | 8.8 | 2025-01-30 | The Royal Core plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check… |
CVE-2024-12102 | Medium | 4.3 | 2025-01-30 | The Typer Core plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.6 via the 'elementor-template' shortcode du… |
CVE-2024-11600 | High | 7.2 | 2025-01-30 | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execution in all versions… |
CVE-2024-11583 | Medium | 4.3 | 2025-01-30 | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss of data due to a mi… |
CVE-2024-10847 | Medium | 6.4 | 2025-01-30 | The Storely theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 18 due to insuf… |
CVE-2024-10591 | High | 8.8 | 2025-01-30 | The MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress is vulnerable to unauthorized mod… |
CVE-2024-13466 | Medium | 6.4 | 2025-01-30 | The Automatically Hierarchic Categories in Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autocategorymenu' shortcode… |
CVE-2024-13380 | Medium | 6.4 | 2025-01-30 | The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rr_form' shortcode in all v… |
CVE-2024-13706 | Medium | 6.1 | 2025-01-30 | The WP Image Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'file' parameter in all versions up to, and including, 1.0.1… |
CVE-2024-13453 | High | 7.3 | 2025-01-30 | The The Contact Form & SMTP Plugin for WordPress by PirateForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and… |
CVE-2024-12524 | Medium | 6.4 | 2025-01-30 | The Clinked Client Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'clinked-login-button' shortcode in all versions u… |
CVE-2024-12409 | Medium | 6.1 | 2025-01-30 | The Simple:Press Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 6.10.11… |
CVE-2024-13758 | Medium | 6.5 | 2025-01-30 | The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to m… |
CVE-2024-13732 | Medium | 6.4 | 2025-01-30 | The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘section_tag’ parameter in all ver… |
CVE-2024-13694 | High | 7.5 | 2025-01-30 | The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2024-13470 | Medium | 6.4 | 2025-01-30 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in… |
CVE-2024-13642 | Medium | 6.4 | 2025-01-30 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hotspot widget in all versions up to… |
CVE-2024-13457 | Medium | 5.3 | 2025-01-30 | The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the… |
CVE-2024-12921 | Medium | 6.4 | 2025-01-30 | The EthereumICO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ethereum-ico shortcode in all versions up to, and including… |
CVE-2024-12709 | Medium | 4.3 | 2025-01-30 | The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted ac… |
CVE-2024-12708 | High | 7.1 | 2025-01-30 | The Bulk Me Now! WordPress plugin through 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where th… |
CVE-2024-12638 | High | 7.1 | 2025-01-30 | The Bulk Me Now! WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-12400 | High | 7.1 | 2025-01-30 | The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. |
CVE-2024-12163 | Medium | 6.5 | 2025-01-30 | The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads. |
CVE-2024-10309 | Medium | 5.9 | 2025-01-30 | The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could… |
CVE-2024-57665 | Critical | 9.8 | 2025-01-29 | JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title parameter is control… |
CVE-2024-57513 | Medium | 6.5 | 2025-01-29 | A floating-point exception (FPE) vulnerability exists in the AP4_TfraAtom::AP4_TfraAtom function in Bento4. |
CVE-2024-57510 | High | 7.8 | 2025-01-29 | Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code via the AP4_Memory… |
CVE-2024-57509 | High | 7.8 | 2025-01-29 | Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code via the AP4_File… |
CVE-2024-57395 | Critical | 9.8 | 2025-01-29 | Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrary code and obtain s… |
CVE-2024-54852 | Critical | 9.8 | 2025-01-29 | When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper… |
CVE-2024-54851 | High | 8.8 | 2025-01-29 | Teedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection. |
CVE-2024-51182 | Medium | 6.1 | 2025-01-29 | HTML Injection vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary HTML code via the "erro" parameter. |
CVE-2024-48761 | High | 8.8 | 2025-01-29 | Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter. |
CVE-2024-23733 | High | 7.5 | 2025-01-29 | The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach… |
CVE-2024-12705 | High | 7.5 | 2025-01-29 | Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affec… |
CVE-2024-11187 | High | 7.5 | 2025-01-29 | It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker send… |
CVE-2024-48852 | Critical | 9.4 | 2025-01-29 | Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This i… |
CVE-2024-48849 | Critical | 9.4 | 2025-01-29 | Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affec… |
CVE-2024-10001 | High | 7.1 | 2025-01-29 | A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the ident… |
CVE-2024-57439 | Medium | 4.9 | 2025-01-29 | An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login nam… |
CVE-2024-57438 | Medium | 5.4 | 2025-01-29 | Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles. |
CVE-2024-57437 | Medium | 6.5 | 2025-01-29 | RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list. |
CVE-2024-57436 | High | 7.2 | 2025-01-29 | RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to imp… |
CVE-2024-54462 | High | 7.1 | 2025-01-29 | The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in case… |
CVE-2024-54461 | High | 7.1 | 2025-01-29 | The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cas… |
CVE-2024-41140 | High | 8.1 | 2025-01-29 | Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function. |
CVE-2024-13561 | Medium | 6.4 | 2025-01-29 | The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's brid_override_yt shortcode in all versions up… |
CVE-2024-57965 | Unrated | | 2025-01-29 | In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href'… |
CVE-2024-7695 | High | 7.5 | 2025-01-29 | Multiple switches are affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which allows data to be… |
CVE-2024-13696 | High | 7.2 | 2025-01-29 | The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist… |
CVE-2024-12749 | High | 7.1 | 2025-01-29 | The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2024-57519 | High | 7.5 | 2025-01-28 | An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file. |
CVE-2024-56529 | High | 7.1 | 2025-01-28 | Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when HSTS is disabled on… |
CVE-2024-48310 | High | 7.5 | 2025-01-28 | AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backen… |
CVE-2024-57514 | Medium | 4.8 | 2025-01-28 | The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web interface. When a s… |
CVE-2024-57376 | High | 8.8 | 2025-01-28 | Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901C allows unauthenticated users to execut… |
CVE-2024-55968 | High | 8.8 | 2025-01-28 | An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the mac… |
CVE-2024-29869 | Medium | 5.5 | 2025-01-28 | Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. A… |
CVE-2024-40677 | High | 8.4 | 2025-01-28 | In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing permission check. Thi… |
CVE-2024-40676 | High | 7.7 | 2025-01-28 | In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a confused deputy. T… |
CVE-2024-40675 | High | 7.5 | 2025-01-28 | In parseUriInternal of Intent.java, there is a possible infinite loop due to improper input validation. This could lead to local denial of service with no addi… |
CVE-2024-40674 | Medium | 5.3 | 2025-01-28 | In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a logic error in the code. This could lea… |
CVE-2024-40673 | Medium | 6.5 | 2025-01-28 | In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validat… |
CVE-2024-40672 | High | 8.4 | 2025-01-28 | In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local es… |
CVE-2024-40670 | High | 8.4 | 2025-01-28 | In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privil… |
CVE-2024-40669 | High | 8.4 | 2025-01-28 | In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privil… |
CVE-2024-40651 | High | 8.4 | 2025-01-28 | In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no addi… |
CVE-2024-40649 | High | 8.4 | 2025-01-28 | In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no addi… |