2024 CVEs (page 52)
Page 52 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5769 | Medium | 4.3 | 2025-01-09 | The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functi… |
CVE-2024-12848 | High | 8.8 | 2025-01-09 | The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in al… |
CVE-2024-12819 | Medium | 6.4 | 2025-01-09 | The Searchie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sio_embed_media' shortcode in all versions up to, and includin… |
CVE-2024-12621 | Medium | 6.4 | 2025-01-09 | The Yumpu E-Paper publishing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'YUMPU' shortcode in all versions up to, and in… |
CVE-2024-12618 | Medium | 4.3 | 2025-01-09 | The Newsletter2Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetStyles' AJAX action in… |
CVE-2024-12616 | Medium | 4.3 | 2025-01-09 | The Bitly's WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX act… |
CVE-2024-12605 | Medium | 4.3 | 2025-01-09 | The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPres… |
CVE-2024-12542 | High | 8.6 | 2025-01-09 | The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all ver… |
CVE-2024-12515 | Medium | 6.4 | 2025-01-09 | The Muslim Prayer Time-Salah/Iqamah plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Masjid ID parameter in all versions up to, and in… |
CVE-2024-12514 | Medium | 6.4 | 2025-01-09 | The 3DVieweronline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '3Dvo-model' shortcode in all versions up to, and includi… |
CVE-2024-12496 | Medium | 6.4 | 2025-01-09 | The Linear plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linear_block_buy_commissions' shortcode in all versions up to, a… |
CVE-2024-12493 | Medium | 6.4 | 2025-01-09 | The Files Download Delay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fddwrap' shortcode in all versions up to, and incl… |
CVE-2024-12491 | Medium | 6.4 | 2025-01-09 | The SimplyRETS Real Estate IDX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sr_search_form' shortcode in all versions up… |
CVE-2024-12394 | Medium | 6.1 | 2025-01-09 | The Action Network plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.4 du… |
CVE-2024-12330 | High | 7.5 | 2025-01-09 | The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all version… |
CVE-2024-12285 | Medium | 6.1 | 2025-01-09 | The SEMA API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘catid’ parameter in all versions up to, and including, 5.27 due to i… |
CVE-2024-12249 | Medium | 4.3 | 2025-01-09 | The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() funct… |
CVE-2024-12222 | Medium | 6.1 | 2025-01-09 | The Deliver via Shipos for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dvsfw_bulk_label_url’ parameter in all ver… |
CVE-2024-12218 | Medium | 6.1 | 2025-01-09 | The Woocommerce check pincode/zipcode for shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4… |
CVE-2024-12206 | Medium | 4.3 | 2025-01-09 | The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This… |
CVE-2024-12122 | Medium | 6.1 | 2025-01-09 | The ResAds plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.6 due to insu… |
CVE-2024-12067 | Medium | 6.5 | 2025-01-09 | The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'booking_itinerary' paramete… |
CVE-2024-11929 | Medium | 6.4 | 2025-01-09 | The Responsive FlipBook Plugin Wordpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the rfbwp_save_settings() functionin all version… |
CVE-2024-11907 | Medium | 6.4 | 2025-01-09 | The Skyword API Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skyword_iframe' shortcode in all versions up to, and… |
CVE-2024-11815 | Medium | 6.1 | 2025-01-09 | The Pósturinn\'s Shipping with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the printed_marked and nonprinted_mark… |
CVE-2024-11686 | Medium | 6.1 | 2025-01-09 | The WhatsApp 🚀 click to chat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'manycontacts_code' parameter in all versions up to… |
CVE-2024-11642 | Critical | 9.8 | 2025-01-09 | The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder plugin for WordPr… |
CVE-2024-11328 | Medium | 6.1 | 2025-01-09 | The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg wit… |
CVE-2024-13153 | Medium | 6.4 | 2025-01-09 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and includin… |
CVE-2024-12802 | Critical | 9.1 | 2025-01-09 | SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager… |
CVE-2024-43663 | Critical | 9.8 | 2025-01-09 | There are many buffer overflow vulnerabilities present in several CGI binaries of the charging station.This issue affects Iocharger firmware for AC model charg… |
CVE-2024-43662 | | 2025-01-09 | The <redacted>.exe or <redacted>.exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectively as any user, although the user inte… | |
CVE-2024-43661 | Critical | 9.8 | 2025-01-09 | The <redacted>.so library, which is used by <redacted>, is vulnerable to a buffer overflow in the code that handles the deletion of certificates. This buffer o… |
CVE-2024-43660 | High | 7.5 | 2025-01-09 | The CGI script <redacted>.sh can be used to download any file on the filesystem. This issue affects Iocharger firmware for AC model chargers beforeversion 241… |
CVE-2024-43659 | High | 7.2 | 2025-01-09 | After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Ioc… |
CVE-2024-43658 | | 2025-01-09 | Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary files This issue affects Iocharger firmwar… | |
CVE-2024-43657 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2024-43656 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2024-43655 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… | |
CVE-2024-43654 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Inject… |
CVE-2024-43653 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2024-43652 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iochar… |
CVE-2024-43651 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iochar… | |
CVE-2024-43650 | | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Iocharger firmware for AC models allows OS Command Injecti… | |
CVE-2024-43649 | High | 8.8 | 2025-01-09 | Authenticated command injection in the filename of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firm… |
CVE-2024-43648 | High | 8.8 | 2025-01-09 | Command injection in the <redacted> parameter of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firmwa… |
CVE-2024-40765 | Critical | 9.8 | 2025-01-09 | An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and po… |
CVE-2024-12806 | Medium | 4.9 | 2025-01-09 | A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file. |
CVE-2024-12805 | High | 7.2 | 2025-01-09 | A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution. |
CVE-2024-12803 | High | 7.2 | 2025-01-09 | A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to cod… |
CVE-2024-53706 | High | 7.8 | 2025-01-09 | A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to `root` and potenti… |
CVE-2024-53705 | High | 7.5 | 2025-01-09 | A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection to an IP address on… |
CVE-2024-53704 | Critical | 9.8 | 2025-01-09 | An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. |
CVE-2024-40762 | Critical | 9.8 | 2025-01-09 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predict… |
CVE-2024-13041 | Medium | 4.2 | 2025-01-09 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 p… |
CVE-2024-6324 | Medium | 4.3 | 2025-01-09 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 p… |
CVE-2024-12736 | Medium | 6.1 | 2025-01-09 | The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2024-12731 | Medium | 6.1 | 2025-01-09 | The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2024-12717 | Medium | 4.8 | 2025-01-09 | The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-12715 | Medium | 6.1 | 2025-01-09 | The Asgard Security Scanner WordPress plugin through 0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-12714 | Medium | 6.1 | 2025-01-09 | The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-10815 | Medium | 4.2 | 2025-01-09 | The PostLists WordPress plugin through 2.0.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead… |
CVE-2024-56827 | Medium | 5.6 | 2025-01-09 | A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress u… |
CVE-2024-56826 | Medium | 5.6 | 2025-01-09 | A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress u… |
CVE-2024-13213 | Low | 3.5 | 2025-01-09 | A vulnerability classified as problematic was found in SingMR HouseRent 1.0. This vulnerability affects unknown code of the file /toAdminUpdateHousePage?hID=30… |
CVE-2024-13212 | Medium | 6.3 | 2025-01-09 | A vulnerability classified as critical has been found in SingMR HouseRent 1.0. This affects the function singleUpload/upload of the file src/main/java/com/hous… |
CVE-2024-13211 | Medium | 6.3 | 2025-01-09 | A vulnerability was found in SingMR HouseRent 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/main/jav… |
CVE-2024-13210 | Medium | 4.7 | 2025-01-09 | A vulnerability was found in donglight bookstore电商书城系统说明 1.0. It has been declared as critical. Affected by this vulnerability is the function uploadPicture of… |
CVE-2024-13209 | Low | 2.4 | 2025-01-09 | A vulnerability was found in Redaxo CMS 5.18.1. It has been classified as problematic. Affected is an unknown function of the file /index.php?page=structure&ca… |
CVE-2024-13206 | High | 7.8 | 2025-01-09 | A vulnerability classified as critical has been found in REVE Antivirus 1.0.0.0 on Linux. This affects an unknown part of the file /usr/local/reveantivirus/tmp… |
CVE-2024-13205 | Low | 2.4 | 2025-01-09 | A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2024-13204 | Medium | 5.5 | 2025-01-09 | A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-13203 | Medium | 4.3 | 2025-01-09 | A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads… |
CVE-2024-13202 | Low | 2.4 | 2025-01-09 | A vulnerability was found in wander-chu SpringBoot-Blog 1.0 and classified as problematic. This issue affects the function modifiyArticle of the file src/main/… |
CVE-2024-13201 | Medium | 4.7 | 2025-01-09 | A vulnerability has been found in wander-chu SpringBoot-Blog 1.0 and classified as critical. This vulnerability affects the function upload of the file src/mai… |
CVE-2024-13200 | High | 7.3 | 2025-01-09 | A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/c… |
CVE-2024-37372 | Low | 3.6 | 2025-01-09 | The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subt… |
CVE-2024-27980 | High | 8.1 | 2025-01-09 | Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands a… |
CVE-2024-13199 | Low | 3.5 | 2025-01-09 | A vulnerability classified as problematic was found in langhsu Mblog Blog System 3.5.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-13198 | Low | 3.7 | 2025-01-09 | A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulati… |
CVE-2024-13197 | Low | 3.5 | 2025-01-09 | A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been rated as problematic. This issue affects the function updateUser of the file src/ma… |
CVE-2024-13196 | Low | 3.5 | 2025-01-09 | A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been declared as problematic. This vulnerability affects the function BookSearchList of… |
CVE-2024-13195 | Medium | 6.3 | 2025-01-09 | A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been classified as critical. This affects the function getHtml of the file src/main/java… |
CVE-2024-13194 | Medium | 6.3 | 2025-01-09 | A vulnerability was found in Sucms 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/admin_members.php?ac… |
CVE-2024-13193 | Medium | 6.3 | 2025-01-08 | A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file SEMCMS_Im… |
CVE-2024-13192 | Low | 3.5 | 2025-01-08 | A vulnerability, which was classified as problematic, was found in ZeroWdd myblog 1.0. Affected is the function update of the file src/main/java/com/wdd/myblog… |
CVE-2024-13191 | Medium | 6.3 | 2025-01-08 | A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0. This issue affects the function upload of the file src/main/java/com/w… |
CVE-2024-54010 | Low | 3.4 | 2025-01-08 | A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to cond… |
CVE-2024-53995 | | 2025-01-08 | SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c… | |
CVE-2024-52869 | Medium | 6.0 | 2025-01-08 | Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when there is an operating… |
CVE-2024-13190 | Medium | 6.3 | 2025-01-08 | A vulnerability classified as critical was found in ZeroWdd myblog 1.0. This vulnerability affects unknown code of the file src/main/resources/mapper/BlogMappe… |
CVE-2024-12431 | Medium | 4.3 | 2025-01-08 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthori… |
CVE-2024-13189 | High | 7.3 | 2025-01-08 | A vulnerability classified as critical has been found in ZeroWdd myblog 1.0. This affects an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlo… |
CVE-2024-54818 | High | 8.8 | 2025-01-08 | SourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control. via /php-lms/admin/?page=user/list. |
CVE-2024-53526 | Medium | 6.4 | 2025-01-08 | composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function. |
CVE-2024-13188 | Medium | 5.3 | 2025-01-08 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2024-6350 | Medium | 6.5 | 2025-01-08 | A malformed 802.15.4 packet causes a buffer overflow to occur leading to an assert and a denial of service. A watchdog reset clears the error condition automat… |
CVE-2024-56787 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: soc: imx8m: Probe the SoC driver as platform driver With driver_async_probe=* on kernel c… |
CVE-2024-56785 | Medium | 5.5 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a Fix the dtc warnings: arc… |
CVE-2024-56784 | High | 7.8 | 2025-01-08 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Adding array index check to prevent memory corruption [Why & How] Array… |