2024 CVEs (page 50)
Page 50 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11874 | Medium | 6.4 | 2025-01-11 | The Grid Accordion Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'grid_accordion' shortcode in all versions up to, an… |
CVE-2024-11758 | Medium | 6.4 | 2025-01-11 | The WP SPID Italia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 2.9 due t… |
CVE-2024-11386 | Medium | 6.4 | 2025-01-11 | The GatorMail SmartForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gatormailsmartform' shortcode in all versions up t… |
CVE-2024-42174 | Low | 3.7 | 2025-01-11 | HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore comp… |
CVE-2024-42173 | Medium | 4.8 | 2025-01-11 | HCL MyXalytics is affected by an improper password policy implementation vulnerability. Weak passwords and lack of account lockout policies allow attackers to… |
CVE-2024-42172 | Medium | 5.3 | 2025-01-11 | HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity th… |
CVE-2024-42171 | Medium | 6.4 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-42170 | Medium | 6.8 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-12587 | Medium | 6.1 | 2025-01-11 | The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-12304 | Medium | 6.4 | 2025-01-11 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in a… |
CVE-2024-42169 | High | 7.1 | 2025-01-11 | HCL MyXalytics is affected by insecure direct object references. It occurs due to missing access control checks, which fail to verify whether a user should be… |
CVE-2024-42168 | High | 8.9 | 2025-01-11 | HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then ind… |
CVE-2024-12627 | High | 7.5 | 2025-01-11 | The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all ve… |
CVE-2024-12505 | Medium | 6.4 | 2025-01-11 | The Trackserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tsmap' shortcode in all versions up to, and including, 5.0… |
CVE-2024-12472 | Medium | 4.3 | 2025-01-11 | The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() functi… |
CVE-2024-12404 | High | 7.5 | 2025-01-11 | The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'post_title' parameter in all versions up to, and including, 1.1.0 d… |
CVE-2024-12204 | Medium | 5.4 | 2025-01-11 | The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to mis… |
CVE-2024-11327 | Medium | 6.1 | 2025-01-11 | The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scr… |
CVE-2024-9188 | High | 8.8 | 2025-01-10 | Specially constructed queries cause cross platform scripting leaking administrator tokens |
CVE-2024-9134 | High | 8.3 | 2025-01-10 | Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection… |
CVE-2024-9133 | Medium | 6.6 | 2025-01-10 | A user with administrator privileges is able to retrieve authentication tokens |
CVE-2024-9132 | High | 8.1 | 2025-01-10 | The administrator is able to configure an insecure captive portal script |
CVE-2024-9131 | High | 7.2 | 2025-01-10 | A user with administrator privileges can perform command injection |
CVE-2024-7142 | Medium | 4.6 | 2025-01-10 | On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption mig… |
CVE-2024-47520 | High | 7.6 | 2025-01-10 | A user with advanced report application access rights can perform actions for which they are not authorized |
CVE-2024-47519 | High | 8.3 | 2025-01-10 | Backup uploads to ETM subject to man-in-the-middle interception |
CVE-2024-47518 | Medium | 6.4 | 2025-01-10 | Specially constructed queries targeting ETM could discover active remote access sessions |
CVE-2024-47517 | Medium | 6.8 | 2025-01-10 | Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access |
CVE-2024-7095 | Medium | 4.3 | 2025-01-10 | On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted p… |
CVE-2024-5872 | Medium | 6.5 | 2025-01-10 | On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane be… |
CVE-2024-54998 | Medium | 5.4 | 2025-01-10 | MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create. |
CVE-2024-54997 | Medium | 5.4 | 2025-01-10 | MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit. |
CVE-2024-54996 | High | 8.8 | 2025-01-10 | MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/r… |
CVE-2024-54994 | Medium | 6.5 | 2025-01-10 | MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relations… |
CVE-2024-6437 | Medium | 5.8 | 2025-01-10 | On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Fl… |
CVE-2024-33299 | Medium | 4.7 | 2025-01-10 | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the… |
CVE-2024-33298 | Medium | 6.1 | 2025-01-10 | Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in th… |
CVE-2024-33297 | Medium | 4.7 | 2025-01-10 | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the… |
CVE-2024-12847 | Critical | 9.8 | 2025-01-10 | NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating… |
CVE-2024-54910 | Medium | 4.7 | 2025-01-10 | Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function. |
CVE-2024-6880 | | 2025-01-10 | During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as on… | |
CVE-2024-6662 | | 2025-01-10 | Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/index.php?id=7,7,0"… | |
CVE-2024-57228 | High | 8.0 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function. |
CVE-2024-57227 | High | 8.0 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function. |
CVE-2024-57226 | High | 8.0 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function. |
CVE-2024-57225 | Critical | 9.8 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function. |
CVE-2024-57224 | Critical | 9.8 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function. |
CVE-2024-57223 | Critical | 9.8 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function. |
CVE-2024-57222 | Medium | 6.3 | 2025-01-10 | Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function. |
CVE-2024-54687 | Medium | 6.1 | 2025-01-10 | Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php. |
CVE-2024-57214 | Medium | 6.3 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function. |
CVE-2024-57213 | Medium | 6.3 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd parameter in the action_passwd function. |
CVE-2024-57212 | Medium | 5.1 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the action_reboot function. |
CVE-2024-57211 | High | 8.0 | 2025-01-10 | TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable_wsh function. |
CVE-2024-54849 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensitive data or execute a man-in-the-middle a… |
CVE-2024-54848 | High | 7.4 | 2025-01-10 | Improper handling and storage of certificates in CP Plus CP-VNR-3104 B3223P22C02424 allow attackers to decrypt communications or execute a man-in-the-middle at… |
CVE-2024-54847 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access sensitive data or execute a man-in-the-… |
CVE-2024-54846 | Medium | 5.9 | 2025-01-10 | An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a man-in-the-middle attack. |
CVE-2024-56511 | Critical | 9.8 | 2025-01-10 | DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter… |
CVE-2024-50807 | Medium | 6.1 | 2025-01-10 | Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting (XSS) via file upload using the svg and pdf extensions. |
CVE-2024-46210 | High | 7.2 | 2025-01-10 | An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2024-29971 | Critical | 9.8 | 2025-01-10 | Scontain SCONE 5.8.0 has an interface vulnerability that leads to state corruption via injected signals. |
CVE-2024-29970 | Critical | 9.8 | 2025-01-10 | Fortanix Enclave OS 3.36.1941-EM has an interface vulnerability that leads to state corruption via injected signals. |
CVE-2024-25371 | High | 7.5 | 2025-01-10 | Gramine before a390e33e16ed374a40de2344562a937f289be2e1 suffers from an Interface vulnerability due to mismatching SW signals vs HW exceptions. |
CVE-2024-57687 | Critical | 9.8 | 2025-01-10 | An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows remote attackers to e… |
CVE-2024-57686 | Critical | 9.8 | 2025-01-10 | A Cross Site Scripting (XSS) vulnerability was found in /landrecordsys/admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers… |
CVE-2024-41787 | Critical | 9.8 | 2025-01-10 | IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. B… |
CVE-2024-57823 | Critical | 9.3 | 2025-01-10 | In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptor_uri_normalize_path(). |
CVE-2024-57822 | Medium | 4.0 | 2025-01-10 | In Raptor RDF Syntax Library through 2.0.16, there is a heap-based buffer over-read when parsing triples with the nquads parser in raptor_ntriples_parse_term_i… |
CVE-2024-13318 | Medium | 5.3 | 2025-01-10 | The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() functi… |
CVE-2024-13183 | Medium | 6.4 | 2025-01-10 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versions up to, and including… |
CVE-2024-12606 | Medium | 4.3 | 2025-01-10 | The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPres… |
CVE-2024-12473 | Medium | 6.5 | 2025-01-10 | The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPres… |
CVE-2024-56377 | Medium | 5.4 | 2025-01-09 | A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the Survey Titl… |
CVE-2024-56376 | Medium | 5.4 | 2025-01-09 | A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the me… |
CVE-2024-51229 | High | 8.8 | 2025-01-09 | Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via the theme management function. |
CVE-2024-46464 | High | 7.8 | 2025-01-09 | In PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulated to render the host computer unavailabl… |
CVE-2024-55226 | Medium | 5.4 | 2025-01-09 | Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs. |
CVE-2024-55225 | Critical | 9.8 | 2025-01-09 | An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted au… |
CVE-2024-55224 | Critical | 9.6 | 2025-01-09 | An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username fi… |
CVE-2024-48806 | Medium | 6.8 | 2025-01-09 | Buffer Overflow vulnerability in Neat Board NFC v.1.20240620.0015 allows a physically proximate attackers to escalate privileges via a crafted payload to the p… |
CVE-2024-13312 | Medium | 5.3 | 2025-01-09 | Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 befo… |
CVE-2024-13311 | High | 7.3 | 2025-01-09 | Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*. |
CVE-2024-13310 | Medium | 6.5 | 2025-01-09 | Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*. |
CVE-2024-13309 | Medium | 5.4 | 2025-01-09 | Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login… |
CVE-2024-13308 | Low | 3.8 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (X… |
CVE-2024-13305 | Medium | 4.8 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS… |
CVE-2024-13304 | Medium | 4.5 | 2025-01-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3. |
CVE-2024-13303 | Medium | 5.3 | 2025-01-09 | Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2. |
CVE-2024-13302 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 befor… |
CVE-2024-13301 | Medium | 6.1 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth… |
CVE-2024-13300 | Medium | 6.6 | 2025-01-09 | Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*. |
CVE-2024-13299 | Medium | 6.6 | 2025-01-09 | Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*. |
CVE-2024-13298 | Medium | 4.8 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS)… |
CVE-2024-13297 | Medium | 6.6 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15. |
CVE-2024-13296 | Medium | 6.6 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1. |
CVE-2024-13295 | Medium | 6.6 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3. |
CVE-2024-13294 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This i… |
CVE-2024-13293 | Low | 3.1 | 2025-01-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2. |
CVE-2024-13292 | Medium | 4.8 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This iss… |