2024 CVEs (page 51)
Page 51 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13291 | High | 7.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 b… |
CVE-2024-13290 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4. |
CVE-2024-13289 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS)… |
CVE-2024-13288 | Medium | 4.3 | 2025-01-09 | Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from… |
CVE-2024-56114 | Medium | 6.5 | 2025-01-09 | Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authori… |
CVE-2024-56113 | High | 7.5 | 2025-01-09 | Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information defined in Django settings file through… |
CVE-2024-55494 | Medium | 6.1 | 2025-01-09 | A PHP Code Injection vulnerability that can lead to Remote Code Execution (RCE) and XSS in Opencode Mobile Collect Call v5.4.7 allows attackers to execute arbi… |
CVE-2024-54887 | High | 8.0 | 2025-01-09 | TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /userRpm/Wan6to4TunnelCf… |
CVE-2024-54762 | Medium | 6.3 | 2025-01-09 | Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. This is because the filterKeyword method does not completely filter SQL injecti… |
CVE-2024-54761 | Medium | 6.3 | 2025-01-09 | BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter. |
CVE-2024-54724 | Critical | 9.8 | 2025-01-09 | PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusion. |
CVE-2024-46505 | Critical | 9.1 | 2025-01-09 | Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities. |
CVE-2024-42898 | Medium | 5.4 | 2025-01-09 | A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int… |
CVE-2024-13287 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (X… |
CVE-2024-13286 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This i… |
CVE-2024-13285 | Critical | 9.8 | 2025-01-09 | Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf: *.*. |
CVE-2024-13284 | High | 8.8 | 2025-01-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, f… |
CVE-2024-13283 | Medium | 6.1 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issu… |
CVE-2024-13282 | High | 8.8 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0. |
CVE-2024-13281 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2. |
CVE-2024-13280 | Critical | 9.8 | 2025-01-09 | Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0… |
CVE-2024-13279 | Critical | 9.8 | 2025-01-09 | Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0… |
CVE-2024-13278 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0. |
CVE-2024-13277 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1. |
CVE-2024-13276 | High | 7.5 | 2025-01-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity… |
CVE-2024-13275 | Medium | 5.3 | 2025-01-09 | Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0… |
CVE-2024-13274 | Medium | 5.3 | 2025-01-09 | Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12… |
CVE-2024-13273 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Open Social allows Cross-Site Scripting (XSS).This… |
CVE-2024-13272 | Medium | 6.3 | 2025-01-09 | Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 bef… |
CVE-2024-13271 | Medium | 4.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4. |
CVE-2024-13270 | Medium | 4.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1. |
CVE-2024-13269 | Medium | 5.3 | 2025-01-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0… |
CVE-2024-13268 | Medium | 6.8 | 2025-01-09 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This is… |
CVE-2024-13267 | High | 7.5 | 2025-01-09 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local F… |
CVE-2024-13266 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from… |
CVE-2024-13265 | High | 7.5 | 2025-01-09 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inc… |
CVE-2024-13264 | Critical | 9.8 | 2025-01-09 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion… |
CVE-2024-13263 | Medium | 5.5 | 2025-01-09 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inc… |
CVE-2024-13262 | Medium | 4.8 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal View Password allows Cross-Site Scripting (XSS).Th… |
CVE-2024-13261 | Low | 3.5 | 2025-01-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13… |
CVE-2024-13260 | High | 8.8 | 2025-01-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: f… |
CVE-2024-10215 | Critical | 9.8 | 2025-01-09 | The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing… |
CVE-2024-13259 | High | 7.5 | 2025-01-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 befor… |
CVE-2024-13258 | Critical | 9.8 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authen… |
CVE-2024-13257 | Medium | 5.3 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0… |
CVE-2024-13256 | High | 7.5 | 2025-01-09 | Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2… |
CVE-2024-13255 | High | 7.5 | 2025-01-09 | Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Ser… |
CVE-2024-13254 | High | 7.5 | 2025-01-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before… |
CVE-2024-13253 | Critical | 9.1 | 2025-01-09 | Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notificat… |
CVE-2024-13252 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal TacJS allows Cross-Site Scripting (XSS).This issue… |
CVE-2024-13251 | High | 8.8 | 2025-01-09 | Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2… |
CVE-2024-13250 | High | 8.8 | 2025-01-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer… |
CVE-2024-13249 | Medium | 5.4 | 2025-01-09 | Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuil… |
CVE-2024-13248 | Medium | 5.5 | 2025-01-09 | Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 befor… |
CVE-2024-13247 | Medium | 4.8 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Coffee allows Cross-Site Scripting (XSS).This issu… |
CVE-2024-13246 | Medium | 5.3 | 2025-01-09 | Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuil… |
CVE-2024-13245 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-… |
CVE-2024-13244 | High | 8.8 | 2025-01-09 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6… |
CVE-2024-13243 | Medium | 6.5 | 2025-01-09 | Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1. |
CVE-2024-13242 | Critical | 9.1 | 2025-01-09 | Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*. |
CVE-2024-13241 | Critical | 9.1 | 2025-01-09 | Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before… |
CVE-2024-13240 | High | 7.5 | 2025-01-09 | Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 befor… |
CVE-2024-13239 | Critical | 9.8 | 2025-01-09 | Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): fro… |
CVE-2024-13238 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Typogrify allows Cross-Site Scripting (XSS).This i… |
CVE-2024-13237 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal File Entity (fieldable files) allows Cross-Site Sc… |
CVE-2024-10106 | Low | 3.7 | 2025-01-09 | A buffer overflow vulnerability in the packet handoff plugin allows an attacker to overwrite memory outside the plugin's buffer. |
CVE-2024-43176 | Medium | 5.4 | 2025-01-09 | IBM OpenPages 9.0 could allow an authenticated user to obtain sensitive information such as configurations that should only be available to privileged users. |
CVE-2024-6155 | Medium | 6.4 | 2025-01-09 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cro… |
CVE-2024-5769 | Medium | 4.3 | 2025-01-09 | The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functi… |
CVE-2024-12848 | High | 8.8 | 2025-01-09 | The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in al… |
CVE-2024-12819 | Medium | 6.4 | 2025-01-09 | The Searchie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sio_embed_media' shortcode in all versions up to, and includin… |
CVE-2024-12621 | Medium | 6.4 | 2025-01-09 | The Yumpu E-Paper publishing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'YUMPU' shortcode in all versions up to, and in… |
CVE-2024-12618 | Medium | 4.3 | 2025-01-09 | The Newsletter2Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetStyles' AJAX action in… |
CVE-2024-12616 | Medium | 4.3 | 2025-01-09 | The Bitly's WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX act… |
CVE-2024-12605 | Medium | 4.3 | 2025-01-09 | The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPres… |
CVE-2024-12542 | High | 8.6 | 2025-01-09 | The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all ver… |
CVE-2024-12515 | Medium | 6.4 | 2025-01-09 | The Muslim Prayer Time-Salah/Iqamah plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Masjid ID parameter in all versions up to, and in… |
CVE-2024-12514 | Medium | 6.4 | 2025-01-09 | The 3DVieweronline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '3Dvo-model' shortcode in all versions up to, and includi… |
CVE-2024-12496 | Medium | 6.4 | 2025-01-09 | The Linear plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linear_block_buy_commissions' shortcode in all versions up to, a… |
CVE-2024-12493 | Medium | 6.4 | 2025-01-09 | The Files Download Delay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fddwrap' shortcode in all versions up to, and incl… |
CVE-2024-12491 | Medium | 6.4 | 2025-01-09 | The SimplyRETS Real Estate IDX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sr_search_form' shortcode in all versions up… |
CVE-2024-12394 | Medium | 6.1 | 2025-01-09 | The Action Network plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.4 du… |
CVE-2024-12330 | High | 7.5 | 2025-01-09 | The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all version… |
CVE-2024-12285 | Medium | 6.1 | 2025-01-09 | The SEMA API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘catid’ parameter in all versions up to, and including, 5.27 due to i… |
CVE-2024-12249 | Medium | 4.3 | 2025-01-09 | The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() funct… |
CVE-2024-12222 | Medium | 6.1 | 2025-01-09 | The Deliver via Shipos for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dvsfw_bulk_label_url’ parameter in all ver… |
CVE-2024-12218 | Medium | 6.1 | 2025-01-09 | The Woocommerce check pincode/zipcode for shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4… |
CVE-2024-12206 | Medium | 4.3 | 2025-01-09 | The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This… |
CVE-2024-12122 | Medium | 6.1 | 2025-01-09 | The ResAds plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.6 due to insu… |
CVE-2024-12067 | Medium | 6.5 | 2025-01-09 | The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'booking_itinerary' paramete… |
CVE-2024-11929 | Medium | 6.4 | 2025-01-09 | The Responsive FlipBook Plugin Wordpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the rfbwp_save_settings() functionin all version… |
CVE-2024-11907 | Medium | 6.4 | 2025-01-09 | The Skyword API Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skyword_iframe' shortcode in all versions up to, and… |
CVE-2024-11815 | Medium | 6.1 | 2025-01-09 | The Pósturinn\'s Shipping with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the printed_marked and nonprinted_mark… |
CVE-2024-11686 | Medium | 6.1 | 2025-01-09 | The WhatsApp 🚀 click to chat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'manycontacts_code' parameter in all versions up to… |
CVE-2024-11642 | Critical | 9.8 | 2025-01-09 | The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder plugin for WordPr… |
CVE-2024-11328 | Medium | 6.1 | 2025-01-09 | The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg wit… |
CVE-2024-13153 | Medium | 6.4 | 2025-01-09 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and includin… |
CVE-2024-12802 | Critical | 9.1 | 2025-01-09 | SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager… |
CVE-2024-43663 | Critical | 9.8 | 2025-01-09 | There are many buffer overflow vulnerabilities present in several CGI binaries of the charging station.This issue affects Iocharger firmware for AC model charg… |
CVE-2024-43662 | | 2025-01-09 | The <redacted>.exe or <redacted>.exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectively as any user, although the user inte… |