2024 CVEs (page 41)
Page 41 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13586 | Medium | 6.4 | 2025-01-25 | The Masy Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'justified-gallery' shortcode in all versions up to, and in… |
CVE-2024-13551 | Medium | 6.4 | 2025-01-25 | The ABC Notation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abcjs' shortcode in all versions up to, and including, 6.1… |
CVE-2024-13550 | Medium | 6.5 | 2025-01-25 | The ABC Notation plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.1.3 via the 'file' attribute of the 'abcjs' short… |
CVE-2024-13548 | Medium | 6.4 | 2025-01-25 | The Power Ups for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'magic-button' shortcode in all versions up to… |
CVE-2024-13467 | Medium | 6.1 | 2025-01-25 | The WP Contact Form7 Email Spam Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, an… |
CVE-2024-13458 | Medium | 6.4 | 2025-01-25 | The WordPress SEO Friendly Accordion FAQ with AI assisted content generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2024-13441 | Medium | 6.4 | 2025-01-25 | The Bilingual Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bl_otherlang_link_1 parameter in all versions up to, and includi… |
CVE-2024-13370 | Medium | 6.5 | 2025-01-25 | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access du… |
CVE-2024-13368 | Medium | 4.3 | 2025-01-25 | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access du… |
CVE-2024-12885 | Medium | 6.5 | 2025-01-25 | The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a… |
CVE-2024-12826 | Medium | 4.3 | 2025-01-25 | The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wo… |
CVE-2024-12817 | Medium | 6.4 | 2025-01-25 | The Etsy Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_link' shortcode in all versions up to, and includ… |
CVE-2024-12816 | Medium | 6.4 | 2025-01-25 | The NOTICE BOARD BY TOWKIR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'notice-board' shortcode in all versions up to, a… |
CVE-2024-12529 | Medium | 6.4 | 2025-01-25 | The brodos.net Onlineshop Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'BrodosCategory' shortcode in all versions… |
CVE-2024-12512 | Medium | 6.4 | 2025-01-25 | The Ask Me Anything (Anonymously) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'askmeanythingpeople' shortcode in all ver… |
CVE-2024-12113 | Medium | 4.3 | 2025-01-25 | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized loss of d… |
CVE-2024-12076 | Medium | 6.1 | 2025-01-25 | The Target Video Easy Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to miss… |
CVE-2024-11825 | Medium | 6.4 | 2025-01-25 | The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘zone’ parameter in all versions up to, and including, 1.51.0 due to… |
CVE-2024-12600 | High | 7.2 | 2025-01-25 | The Custom Product Tabs Lite for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.0 via deseria… |
CVE-2024-10552 | Medium | 6.4 | 2025-01-25 | The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘api_key’ and 'api_secret' parameters in all versions up to… |
CVE-2024-13721 | Medium | 6.4 | 2025-01-25 | The Plethora Plugins Tabs + Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the anchor parameter in all versions up to, and in… |
CVE-2024-13709 | Medium | 4.3 | 2025-01-25 | The Linear plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect no… |
CVE-2024-50698 | Critical | 9.8 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content. |
CVE-2024-50697 | High | 8.1 | 2025-01-24 | In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not have sufficient bound… |
CVE-2024-50695 | Critical | 9.8 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing MQTT topic bounds… |
CVE-2024-50694 | Critical | 9.8 | 2025-01-24 | In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of… |
CVE-2024-50692 | Medium | 5.4 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inve… |
CVE-2024-50690 | Medium | 6.5 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firmware updates. |
CVE-2024-57277 | Medium | 5.7 | 2025-01-24 | InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload. |
CVE-2024-57095 | Medium | 6.8 | 2025-01-24 | SQL injection vulnerability in Go-CMS v.1.1.10 allows a remote attacker to execute arbitrary code via a crafted payload. |
CVE-2024-57041 | Medium | 4.6 | 2025-01-24 | A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their prof… |
CVE-2024-52807 | High | 8.6 | 2025-01-24 | The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various compone… |
CVE-2024-56404 | Critical | 9.9 | 2025-01-24 | In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installa… |
CVE-2024-35122 | Low | 2.8 | 2025-01-24 | IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to a file level local denial of service caused by an insufficient authority requirement. A local non-privileged user… |
CVE-2024-45077 | Medium | 6.5 | 2025-01-24 | IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restricte… |
CVE-2024-41757 | Medium | 5.9 | 2025-01-24 | IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transp… |
CVE-2024-40706 | Medium | 5.3 | 2025-01-24 | IBM InfoSphere Information Server 11.7 could allow a remote user to obtain sensitive version information that could aid in further attacks against the system. |
CVE-2024-40693 | High | 8.0 | 2025-01-24 | IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attack… |
CVE-2024-25034 | High | 8.0 | 2025-01-24 | IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process. Attackers ca… |
CVE-2024-13698 | Medium | 6.5 | 2025-01-24 | The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'do… |
CVE-2024-9499 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary… |
CVE-2024-9498 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK installer can lead to privilege escalation and arbitrary code… |
CVE-2024-9497 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary cod… |
CVE-2024-9496 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit installer can lead to privilege escalation and arbitrary c… |
CVE-2024-9495 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows installer can lead to privilege escalation and arbitrary co… |
CVE-2024-9494 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210 VCP Win 2k installer can lead to privilege escalation and arbitrary c… |
CVE-2024-9493 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the ToolStick installer can lead to privilege escalation and arbitrary code executi… |
CVE-2024-9492 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code… |
CVE-2024-9491 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code ex… |
CVE-2024-9490 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code… |
CVE-2024-57184 | Medium | 5.5 | 2025-01-24 | An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_process_pmt in media_tools/mpegts.c:2163… |
CVE-2024-41739 | High | 8.8 | 2025-01-24 | IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion. |
CVE-2024-11913 | Medium | 5.4 | 2025-01-24 | The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 v… |
CVE-2024-10324 | Medium | 4.3 | 2025-01-24 | The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the registe… |
CVE-2024-13594 | Medium | 6.5 | 2025-01-24 | The Simple Downloads List plugin for WordPress is vulnerable to SQL Injection via the 'category' attribute of the 'neofix_sdl' shortcode in all versions up to… |
CVE-2024-13572 | Medium | 6.4 | 2025-01-24 | The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfusion-widget' shortc… |
CVE-2024-13542 | Medium | 6.4 | 2025-01-24 | The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2024-13409 | High | 7.5 | 2025-01-24 | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in al… |
CVE-2024-13408 | High | 7.5 | 2025-01-24 | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in al… |
CVE-2024-13354 | Medium | 6.4 | 2025-01-24 | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi… |
CVE-2024-13335 | Medium | 4.3 | 2025-01-24 | The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capabi… |
CVE-2024-13583 | Medium | 6.4 | 2025-01-24 | The Simple Gallery with Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'c2tw_sgwf' shortcode in all versions up to… |
CVE-2024-12494 | Medium | 6.4 | 2025-01-24 | The BMLT Meeting Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bmlt_meeting_map' shortcode in all versions up to, and… |
CVE-2024-13545 | Critical | 9.8 | 2025-01-24 | The Bootstrap Ultimate theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.9 via the path parameter. This makes… |
CVE-2024-13683 | Medium | 4.3 | 2025-01-24 | The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.0. This is due to… |
CVE-2024-13680 | Medium | 6.5 | 2025-01-24 | The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortcode in all versions… |
CVE-2024-13659 | Medium | 6.4 | 2025-01-24 | The Listamester plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listamester' shortcode in all versions up to, and including… |
CVE-2024-11931 | Medium | 6.4 | 2025-01-24 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8… |
CVE-2024-55573 | Critical | 9.1 | 2025-01-23 | An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with… |
CVE-2024-53379 | High | 7.5 | 2025-01-23 | Heap buffer overflow in the server site handshake implementation in Real Time Logic LLC's SharkSSL version (from 05/05/24) commit 64808a5e12c83b38f85c943dee011… |
CVE-2024-57556 | Medium | 6.1 | 2025-01-23 | Cross Site Scripting vulnerability in nbubna store v.2.14.2 and before allows a remote attacker to execute arbitrary code via the store.deep.js component |
CVE-2024-57386 | Medium | 6.1 | 2025-01-23 | Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function. |
CVE-2024-57329 | Medium | 5.4 | 2025-01-23 | HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attacker… |
CVE-2024-57328 | Critical | 9.8 | 2025-01-23 | A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0. The vulnerability arises because the input fields username and pass… |
CVE-2024-57326 | Medium | 6.1 | 2025-01-23 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in the search.php file of the Online Pizza Delivery System 1.0. The vulnerability allows an attacke… |
CVE-2024-55195 | High | 7.5 | 2025-01-23 | An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the program to requests to al… |
CVE-2024-55194 | Critical | 9.8 | 2025-01-23 | OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h. |
CVE-2024-55193 | Critical | 9.8 | 2025-01-23 | OpenImageIO v3.1.0.0dev was discovered to contain a segmentation violation via the component /OpenImageIO/string_view.h. |
CVE-2024-55192 | Critical | 9.8 | 2025-01-23 | OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char const*). |
CVE-2024-53923 | Critical | 9.1 | 2025-01-23 | An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high priv… |
CVE-2024-53588 | High | 7.8 | 2025-01-23 | A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\D… |
CVE-2024-50665 | Medium | 5.5 | 2025-01-23 | gpac 2.4 contains a SEGV at src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio in MP4Box. |
CVE-2024-50664 | High | 7.8 | 2025-01-23 | gpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box. |
CVE-2024-55930 | Medium | 6.7 | 2025-01-23 | Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files |
CVE-2024-55929 | Medium | 5.3 | 2025-01-23 | A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sourc… |
CVE-2024-55928 | Medium | 6.5 | 2025-01-23 | Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets wi… |
CVE-2024-55927 | High | 7.6 | 2025-01-23 | A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or for… |
CVE-2024-55926 | High | 7.6 | 2025-01-23 | A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploitin… |
CVE-2024-45672 | Medium | 6.0 | 2025-01-23 | IBM Security Verify Bridge 1.0.0 through 1.0.15 could allow a local privileged user to overwrite files due to excessive privileges granted to the agent. which… |
CVE-2024-55925 | High | 7.5 | 2025-01-23 | In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the… |
CVE-2024-52331 | High | 7.5 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that… |
CVE-2024-52330 | High | 7.4 | 2025-01-23 | ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmwa… |
CVE-2024-52329 | High | 7.4 | 2025-01-23 | ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and o… |
CVE-2024-52328 | Low | 2.3 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can d… |
CVE-2024-52327 | Medium | 6.5 | 2025-01-23 | The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed. |
CVE-2024-12079 | Low | 3.3 | 2025-01-23 | ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-th… |
CVE-2024-12078 | Medium | 6.3 | 2025-01-23 | ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control an… |
CVE-2024-11147 | High | 7.6 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as r… |
CVE-2024-55971 | Critical | 10.0 | 2025-01-23 | SQL Injection vulnerability in the default configuration of the Logitime WebClock application <= 5.43.0 allows an unauthenticated user to run arbitrary code on… |
CVE-2024-52325 | Critical | 9.6 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection. |