2024 CVEs (page 38)
Page 38 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47891 | High | 7.8 | 2025-01-31 | Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions. |
CVE-2024-13463 | Medium | 6.4 | 2025-01-31 | The SeatReg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'seatreg' shortcode in all versions up to, and including, 1.56.0… |
CVE-2024-46974 | High | 7.8 | 2025-01-31 | Software installed and run as a non-privileged user may conduct improper read/write operations on imported/exported DMA buffers. |
CVE-2024-13767 | High | 8.1 | 2025-01-31 | The Live2DWebCanvas plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ClearFiles() function in all… |
CVE-2024-13399 | Medium | 6.4 | 2025-01-31 | The Gosign – Posts Slider Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posts-slider-block' block in all versions up to, and… |
CVE-2024-13397 | Medium | 6.4 | 2025-01-31 | The WPRadio – WordPress Radio Streaming Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpradio_player' shortcode in… |
CVE-2024-13396 | Medium | 6.4 | 2025-01-31 | The Frictionless plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'frictionless_form' shortcode[s] in all versions up to, and… |
CVE-2024-23929 | High | 7.3 | 2025-01-31 | This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Pioneer DMH-WT7600NEX devices. Although authenticat… |
CVE-2024-23921 | High | 8.8 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentica… |
CVE-2024-23920 | High | 8.8 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentica… |
CVE-2024-24731 | High | 7.5 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not requir… |
CVE-2024-23973 | High | 8.8 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not requir… |
CVE-2024-23971 | High | 8.8 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentica… |
CVE-2024-23970 | Medium | 6.5 | 2025-01-31 | This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex charging stations. Aut… |
CVE-2024-23969 | High | 8.8 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentica… |
CVE-2024-23968 | High | 8.8 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentica… |
CVE-2024-23963 | High | 8.0 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain… |
CVE-2024-23962 | Medium | 5.3 | 2025-01-31 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Alpine Halo9 devices. Authentication is not required… |
CVE-2024-23937 | Medium | 4.3 | 2025-01-31 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Silicon Labs Gecko OS. Authentication is no… |
CVE-2024-23930 | Medium | 4.3 | 2025-01-31 | This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Pioneer DMH-WT7600NEX devices. Authen… |
CVE-2024-23928 | Medium | 6.5 | 2025-01-31 | This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of Pioneer DMH-WT7600NEX d… |
CVE-2024-1211 | Medium | 6.4 | 2025-01-31 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2024-11611 | High | 7.8 | 2025-01-30 | AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2024-11610 | High | 7.8 | 2025-01-30 | AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2024-11609 | High | 7.8 | 2025-01-30 | AutomationDirect C-More EA9 EAP9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex… |
CVE-2024-10604 | Medium | 5.3 | 2025-01-30 | Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports… |
CVE-2024-10603 | Medium | 5.3 | 2025-01-30 | Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in so… |
CVE-2024-10026 | Medium | 5.3 | 2025-01-30 | A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot ident… |
CVE-2024-44142 | High | 7.8 | 2025-01-30 | The issue was addressed with improved bounds checks. This issue is fixed in GarageBand 10.4.12. Processing a maliciously crafted image may lead to arbitrary co… |
CVE-2024-12248 | Critical | 9.8 | 2025-01-30 | Contec Health CMS8000 Patient Monitor is vulnerable to an out-of-bounds write, which could allow an attacker to send specially formatted UDP requests in order… |
CVE-2024-2658 | | 2025-01-30 | A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent… | |
CVE-2024-55417 | Medium | 4.3 | 2025-01-30 | DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload… |
CVE-2024-55416 | Low | 3.5 | 2025-01-30 | DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Ja… |
CVE-2024-55415 | Medium | 5.7 | 2025-01-30 | DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass. |
CVE-2024-53615 | Medium | 6.5 | 2025-01-30 | A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to exec… |
CVE-2024-8494 | Medium | 4.3 | 2025-01-30 | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'e… |
CVE-2024-13742 | Critical | 9.8 | 2025-01-30 | The iControlWP – Multiple WordPress Site Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.5 via des… |
CVE-2024-13720 | High | 8.8 | 2025-01-30 | The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gky_image_uploader_main_fun… |
CVE-2024-13715 | Medium | 4.3 | 2025-01-30 | The zStore Manager Basic plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the zstore_clear_cache() function… |
CVE-2024-13707 | High | 8.8 | 2025-01-30 | The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or i… |
CVE-2024-13705 | Medium | 6.1 | 2025-01-30 | The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL i… |
CVE-2024-13700 | Medium | 6.4 | 2025-01-30 | The Embed Swagger UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsgui' shortcode in all versions up to, and including… |
CVE-2024-13671 | High | 7.5 | 2025-01-30 | The Music Sheet Viewer plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.1 via the read_score_file() function… |
CVE-2024-13670 | Medium | 6.4 | 2025-01-30 | The Music Sheet Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pn_msv' shortcode in all versions up to, and includi… |
CVE-2024-13664 | Medium | 6.4 | 2025-01-30 | The WP Post List Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpb_post_list_table' shortcode in all versions up to… |
CVE-2024-13661 | Medium | 6.4 | 2025-01-30 | The Table Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wptableeditor_vtabs' shortcode in all versions up to, and… |
CVE-2024-13652 | Medium | 4.3 | 2025-01-30 | The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clear_ecpay_debug… |
CVE-2024-13646 | High | 8.1 | 2025-01-30 | The Single-user-chat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validatio… |
CVE-2024-13596 | Medium | 6.5 | 2025-01-30 | The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'sur… |
CVE-2024-13549 | Medium | 6.4 | 2025-01-30 | The All Bootstrap Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Accordion" widget in all versions up to, and including, 1.3… |
CVE-2024-13512 | Medium | 6.1 | 2025-01-30 | The Wonder FontAwesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or in… |
CVE-2024-13460 | Medium | 6.4 | 2025-01-30 | The WE – Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Testimonial Author Names in all versions up to, and including… |
CVE-2024-13400 | Medium | 6.4 | 2025-01-30 | The Kona Gallery Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Kona: Instagram for Gutenberg" Block, specifically in the "al… |
CVE-2024-13349 | Medium | 6.4 | 2025-01-30 | The Stockdio Historical Chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stockdio-historical-chart' shortcode in all v… |
CVE-2024-12861 | Medium | 6.5 | 2025-01-30 | The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2s_v… |
CVE-2024-12822 | Critical | 9.8 | 2025-01-30 | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing ca… |
CVE-2024-12821 | High | 8.8 | 2025-01-30 | The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing ca… |
CVE-2024-12451 | Medium | 6.4 | 2025-01-30 | The HTML5 chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'HTML5CHAT' shortcode in all versions up to, and including, 1… |
CVE-2024-12444 | Medium | 6.4 | 2025-01-30 | The WP Dispensary plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpd_menu' shortcode in all versions up to, and including… |
CVE-2024-12320 | Medium | 6.1 | 2025-01-30 | The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 4.7 due to… |
CVE-2024-12299 | Medium | 6.1 | 2025-01-30 | The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8… |
CVE-2024-12269 | High | 7.5 | 2025-01-30 | The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db() fu… |
CVE-2024-12177 | Medium | 6.1 | 2025-01-30 | The Ai Image Alt Text Generator for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and… |
CVE-2024-12129 | High | 8.8 | 2025-01-30 | The Royal Core plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check… |
CVE-2024-12102 | Medium | 4.3 | 2025-01-30 | The Typer Core plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.6 via the 'elementor-template' shortcode du… |
CVE-2024-11600 | High | 7.2 | 2025-01-30 | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execution in all versions… |
CVE-2024-11583 | Medium | 4.3 | 2025-01-30 | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss of data due to a mi… |
CVE-2024-10847 | Medium | 6.4 | 2025-01-30 | The Storely theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 18 due to insuf… |
CVE-2024-10591 | High | 8.8 | 2025-01-30 | The MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress is vulnerable to unauthorized mod… |
CVE-2024-13466 | Medium | 6.4 | 2025-01-30 | The Automatically Hierarchic Categories in Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autocategorymenu' shortcode… |
CVE-2024-13380 | Medium | 6.4 | 2025-01-30 | The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rr_form' shortcode in all v… |
CVE-2024-13706 | Medium | 6.1 | 2025-01-30 | The WP Image Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'file' parameter in all versions up to, and including, 1.0.1… |
CVE-2024-13453 | High | 7.3 | 2025-01-30 | The The Contact Form & SMTP Plugin for WordPress by PirateForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and… |
CVE-2024-12524 | Medium | 6.4 | 2025-01-30 | The Clinked Client Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'clinked-login-button' shortcode in all versions u… |
CVE-2024-12409 | Medium | 6.1 | 2025-01-30 | The Simple:Press Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 6.10.11… |
CVE-2024-13758 | Medium | 6.5 | 2025-01-30 | The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to m… |
CVE-2024-13732 | Medium | 6.4 | 2025-01-30 | The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘section_tag’ parameter in all ver… |
CVE-2024-13694 | High | 7.5 | 2025-01-30 | The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2024-13470 | Medium | 6.4 | 2025-01-30 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in… |
CVE-2024-13642 | Medium | 6.4 | 2025-01-30 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hotspot widget in all versions up to… |
CVE-2024-13457 | Medium | 5.3 | 2025-01-30 | The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the… |
CVE-2024-12921 | Medium | 6.4 | 2025-01-30 | The EthereumICO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ethereum-ico shortcode in all versions up to, and including… |
CVE-2024-12709 | Medium | 4.3 | 2025-01-30 | The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted ac… |
CVE-2024-12708 | High | 7.1 | 2025-01-30 | The Bulk Me Now! WordPress plugin through 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where th… |
CVE-2024-12638 | High | 7.1 | 2025-01-30 | The Bulk Me Now! WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-12400 | High | 7.1 | 2025-01-30 | The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. |
CVE-2024-12163 | Medium | 6.5 | 2025-01-30 | The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads. |
CVE-2024-10309 | Medium | 5.9 | 2025-01-30 | The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could… |
CVE-2024-57665 | Critical | 9.8 | 2025-01-29 | JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title parameter is control… |
CVE-2024-57513 | Medium | 6.5 | 2025-01-29 | A floating-point exception (FPE) vulnerability exists in the AP4_TfraAtom::AP4_TfraAtom function in Bento4. |
CVE-2024-57510 | High | 7.8 | 2025-01-29 | Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code via the AP4_Memory… |
CVE-2024-57509 | High | 7.8 | 2025-01-29 | Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code via the AP4_File… |
CVE-2024-57395 | Critical | 9.8 | 2025-01-29 | Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrary code and obtain s… |
CVE-2024-54852 | Critical | 9.8 | 2025-01-29 | When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper… |
CVE-2024-54851 | High | 8.8 | 2025-01-29 | Teedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection. |
CVE-2024-51182 | Medium | 6.1 | 2025-01-29 | HTML Injection vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary HTML code via the "erro" parameter. |
CVE-2024-48761 | High | 8.8 | 2025-01-29 | Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter. |
CVE-2024-23733 | High | 7.5 | 2025-01-29 | The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach… |
CVE-2024-12705 | High | 7.5 | 2025-01-29 | Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affec… |
CVE-2024-11187 | High | 7.5 | 2025-01-29 | It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker send… |