2024 CVEs (page 53)
Page 53 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12328 | Medium | 6.4 | 2025-01-08 | The MAS Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.7 due to ins… |
CVE-2024-11939 | High | 7.5 | 2025-01-08 | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘data’ parameter in all versions up to, and includ… |
CVE-2024-11350 | Critical | 9.8 | 2025-01-08 | The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plu… |
CVE-2024-13173 | High | 7.5 | 2025-01-08 | The health module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2024-12045 | Medium | 4.4 | 2025-01-08 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maker titl… |
CVE-2024-11635 | Critical | 9.8 | 2025-01-08 | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cooki… |
CVE-2024-8002 | Medium | 4.3 | 2025-01-08 | A vulnerability has been found in VIWIS LMS 9.11 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Fil… |
CVE-2024-12852 | Medium | 6.4 | 2025-01-08 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_cmc_text' parameter of the Happy Mouse Cursor in a… |
CVE-2024-12851 | Medium | 6.4 | 2025-01-08 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to Stored Cros… |
CVE-2024-12584 | Medium | 4.3 | 2025-01-08 | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2024-11613 | Critical | 9.8 | 2025-01-08 | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to… |
CVE-2024-12585 | Medium | 6.1 | 2025-01-08 | The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Si… |
CVE-2024-10585 | Medium | 5.3 | 2025-01-08 | The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/… |
CVE-2024-10151 | Medium | 5.4 | 2025-01-08 | The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2024-54731 | Medium | 4.0 | 2025-01-08 | cpdf through 2.8 allows stack consumption via a crafted PDF document. |
CVE-2024-12205 | Medium | 6.4 | 2025-01-08 | The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all versions up to, and inc… |
CVE-2024-12030 | Medium | 6.5 | 2025-01-08 | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' shortcode in all vers… |
CVE-2024-11271 | High | 8.8 | 2025-01-08 | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing capability check on several functions i… |
CVE-2024-11270 | High | 8.8 | 2025-01-08 | The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the 'sync-import… |
CVE-2024-56456 | Medium | 6.8 | 2025-01-08 | Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability ma… |
CVE-2024-56455 | Medium | 5.5 | 2025-01-08 | Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability ma… |
CVE-2024-56454 | Medium | 5.5 | 2025-01-08 | Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability ma… |
CVE-2024-56453 | Medium | 6.8 | 2025-01-08 | Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability ma… |
CVE-2024-56452 | Medium | 5.5 | 2025-01-08 | Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability ma… |
CVE-2024-56451 | High | 7.3 | 2025-01-08 | Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-56450 | Medium | 6.3 | 2025-01-08 | Buffer overflow vulnerability in the component driver module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-56449 | Medium | 6.6 | 2025-01-08 | Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56448 | Medium | 6.7 | 2025-01-08 | Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-54121 | Medium | 6.2 | 2025-01-08 | Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-12713 | Medium | 5.3 | 2025-01-08 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2… |
CVE-2024-12521 | Medium | 6.4 | 2025-01-08 | The Slotti Ajanvaraus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slotti-embed-ga' shortcode in all versions up to, and… |
CVE-2024-12112 | Medium | 6.4 | 2025-01-08 | The Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder plugin for WordPress is vulnerable to S… |
CVE-2024-11916 | High | 7.4 | 2025-01-08 | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capabil… |
CVE-2024-11816 | High | 8.8 | 2025-01-08 | The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability… |
CVE-2024-56447 | High | 7.8 | 2025-01-08 | Vulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2024-56446 | Medium | 4.0 | 2025-01-08 | Vulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-56445 | Medium | 4.3 | 2025-01-08 | Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause features to perform a… |
CVE-2024-56444 | High | 7.5 | 2025-01-08 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56443 | Medium | 6.2 | 2025-01-08 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56442 | Medium | 5.5 | 2025-01-08 | Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to perfor… |
CVE-2024-56441 | Medium | 4.1 | 2025-01-08 | Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56440 | Medium | 6.2 | 2025-01-08 | Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-56439 | High | 7.5 | 2025-01-08 | Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56438 | Medium | 6.0 | 2025-01-08 | Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-56437 | Medium | 5.7 | 2025-01-08 | Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availabili… |
CVE-2024-54120 | Medium | 4.1 | 2025-01-08 | Race condition vulnerability in the distributed notification module Impact: Successful exploitation of this vulnerability may cause features to perform abnorma… |
CVE-2024-47934 | Medium | 5.3 | 2025-01-08 | Improper Input Validation vulnerability in Management Program in TXOne Networks Portable Inspector and Portable Inspector Pro Edition allows remote attacker to… |
CVE-2024-47239 | Medium | 6.5 | 2025-01-08 | Dell PowerScale OneFS versions 8.2.2.x through 9.9.0.0 contain an uncontrolled resource consumption vulnerability. A remote low privileged attacker could poten… |
CVE-2024-56436 | Medium | 5.5 | 2025-01-08 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56435 | Medium | 6.2 | 2025-01-08 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-56434 | Medium | 4.4 | 2025-01-08 | UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of the device. |
CVE-2024-50603 | Critical | 10.0 | 2025-01-08 | An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS… |
CVE-2024-40679 | Medium | 5.5 | 2025-01-08 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be… |
CVE-2024-55218 | Medium | 6.1 | 2025-01-07 | IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter. |
CVE-2024-54819 | Critical | 9.1 | 2025-01-07 | I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/security/validation.php |
CVE-2024-53522 | High | 7.5 | 2025-01-07 | Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allo… |
CVE-2024-35532 | Critical | 9.1 | 2025-01-07 | An XML External Entity (XXE) injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading un… |
CVE-2024-40427 | High | 7.9 | 2025-01-07 | Stack Buffer Overflow in PX4-Autopilot v1.14.3, which allows attackers to execute commands to exploit this vulnerability and cause the program to refuse to exe… |
CVE-2024-55414 | Critical | 9.8 | 2025-01-07 | A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physical memory via spe… |
CVE-2024-55413 | High | 7.8 | 2025-01-07 | A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via… |
CVE-2024-55412 | High | 7.8 | 2025-01-07 | A vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via s… |
CVE-2024-55411 | High | 8.8 | 2025-01-07 | An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via supplying crafted IOC… |
CVE-2024-54007 | High | 7.2 | 2025-01-07 | Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execut… |
CVE-2024-54006 | High | 7.2 | 2025-01-07 | Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execut… |
CVE-2024-50660 | Critical | 9.8 | 2025-01-07 | File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload functionality |
CVE-2024-50659 | Medium | 6.1 | 2025-01-07 | Cross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shippingAsBilling parameter… |
CVE-2024-50658 | Critical | 9.8 | 2025-01-07 | Server-Side Template Injection (SSTI) was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the shippingAsBilling and firstname p… |
CVE-2024-44450 | Medium | 5.4 | 2025-01-07 | Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew. The issue was fixed in version JUN23 #190. |
CVE-2024-8361 | High | 7.5 | 2025-01-07 | In SiWx91x devices, the SHA2/224 algorithm returns a hash of 256 bits instead of 224 bits. This incorrect hash length triggers a software assertion, which subs… |
CVE-2024-56272 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in ThemeSupport Hide Category by User Role for WooCommerce hide-category-by-user-role-for-woocommerce.This issue affects Hi… |
CVE-2024-56270 | Medium | 5.3 | 2025-01-07 | Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Retrieve Embedded Sensitive Data.This issue affects WP SecureSubmit: fr… |
CVE-2024-55555 | High | 8.8 | 2025-01-07 | Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY. This is exacerbated by .env files… |
CVE-2024-40749 | High | 7.5 | 2025-01-07 | Improper Access Controls allows access to protected views. |
CVE-2024-40748 | High | 7.5 | 2025-01-07 | Lack of output escaping in the id attribute of menu lists. |
CVE-2024-40747 | Medium | 6.1 | 2025-01-07 | Various module chromes didn't properly process inputs, leading to XSS vectors. |
CVE-2024-12430 | High | 7.0 | 2025-01-07 | An attacker who successfully exploited these vulnerabilities could cause enable command execution. A vulnerability exists in the AC500 V3 version mentioned. Af… |
CVE-2024-12429 | Medium | 4.3 | 2025-01-07 | An attacker who successfully exploited these vulnerabilities could grant read access to files. A vulnerability exists in the AC500 V3 version mentioned. A succ… |
CVE-2024-56056 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kmfoysal06 SimpleCharm simplecharm allows Reflected XSS.T… |
CVE-2024-55556 | Critical | 9.8 | 2025-01-07 | A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipul… |
CVE-2024-55008 | High | 7.5 | 2025-01-07 | JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users from accessing their… |
CVE-2024-53800 | High | 8.1 | 2025-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in rezgo Rezgo rezgo allows PHP Local Fil… |
CVE-2024-53345 | High | 8.8 | 2025-01-07 | An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code via uploading a cr… |
CVE-2024-52813 | Medium | 4.3 | 2025-01-07 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mech… |
CVE-2024-48245 | High | 7.2 | 2025-01-07 | Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as bo… |
CVE-2024-46603 | High | 7.5 | 2025-01-07 | An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (Do… |
CVE-2024-46602 | High | 7.5 | 2025-01-07 | An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity (XXE) vulnerability may allow an attacker to c… |
CVE-2024-46601 | High | 7.5 | 2025-01-07 | Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 was discovered to contain a buffer overflow. |
CVE-2024-46242 | High | 7.5 | 2025-01-07 | An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (Re… |
CVE-2024-40702 | High | 8.2 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resou… |
CVE-2024-28778 | Medium | 6.5 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to pub… |
CVE-2024-25037 | Medium | 4.3 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is retur… |
CVE-2024-11681 | Medium | 6.8 | 2025-01-07 | A malicious or compromised MacPorts mirror can execute arbitrary commands as root on the machine of a client running port selfupdate against the mirror. |
CVE-2024-45640 | Medium | 5.3 | 2025-01-07 | IBM Security ReaQta 3.12 returns sensitive information in an HTTP response that could be used in further attacks against the system. |
CVE-2024-45100 | Medium | 4.9 | 2025-01-07 | IBM Security ReaQta 3.12 could allow a privileged user to cause a denial of service by sending multiple administration requests due to improper allocation of r… |
CVE-2024-12738 | Medium | 6.1 | 2025-01-07 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2024-12426 | Medium | 6.5 | 2025-01-07 | Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could… |
CVE-2024-12131 | Medium | 4.3 | 2025-01-07 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in al… |
CVE-2024-52893 | Medium | 5.3 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error me… |
CVE-2024-52891 | Medium | 5.4 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow an authenticated user to inject malicious information or obtain information from log… |
CVE-2024-52367 | Medium | 5.3 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could disclose sensitive system information to an unauthorized actor that could be used in further… |