2024 CVEs (page 54)
Page 54 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8361 | High | 7.5 | 2025-01-07 | In SiWx91x devices, the SHA2/224 algorithm returns a hash of 256 bits instead of 224 bits. This incorrect hash length triggers a software assertion, which subs… |
CVE-2024-56272 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in ThemeSupport Hide Category by User Role for WooCommerce hide-category-by-user-role-for-woocommerce.This issue affects Hi… |
CVE-2024-56270 | Medium | 5.3 | 2025-01-07 | Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Retrieve Embedded Sensitive Data.This issue affects WP SecureSubmit: fr… |
CVE-2024-55555 | High | 8.8 | 2025-01-07 | Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY. This is exacerbated by .env files… |
CVE-2024-40749 | High | 7.5 | 2025-01-07 | Improper Access Controls allows access to protected views. |
CVE-2024-40748 | High | 7.5 | 2025-01-07 | Lack of output escaping in the id attribute of menu lists. |
CVE-2024-40747 | Medium | 6.1 | 2025-01-07 | Various module chromes didn't properly process inputs, leading to XSS vectors. |
CVE-2024-12430 | High | 7.0 | 2025-01-07 | An attacker who successfully exploited these vulnerabilities could cause enable command execution. A vulnerability exists in the AC500 V3 version mentioned. Af… |
CVE-2024-12429 | Medium | 4.3 | 2025-01-07 | An attacker who successfully exploited these vulnerabilities could grant read access to files. A vulnerability exists in the AC500 V3 version mentioned. A succ… |
CVE-2024-56056 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kmfoysal06 SimpleCharm simplecharm allows Reflected XSS.T… |
CVE-2024-55556 | Critical | 9.8 | 2025-01-07 | A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipul… |
CVE-2024-55008 | High | 7.5 | 2025-01-07 | JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users from accessing their… |
CVE-2024-53800 | High | 8.1 | 2025-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in rezgo Rezgo rezgo allows PHP Local Fil… |
CVE-2024-53345 | High | 8.8 | 2025-01-07 | An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code via uploading a cr… |
CVE-2024-52813 | Medium | 4.3 | 2025-01-07 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mech… |
CVE-2024-48245 | High | 7.2 | 2025-01-07 | Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as bo… |
CVE-2024-46603 | High | 7.5 | 2025-01-07 | An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (Do… |
CVE-2024-46602 | High | 7.5 | 2025-01-07 | An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity (XXE) vulnerability may allow an attacker to c… |
CVE-2024-46601 | High | 7.5 | 2025-01-07 | Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 was discovered to contain a buffer overflow. |
CVE-2024-46242 | High | 7.5 | 2025-01-07 | An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (Re… |
CVE-2024-40702 | High | 8.2 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resou… |
CVE-2024-28778 | Medium | 6.5 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to pub… |
CVE-2024-25037 | Medium | 4.3 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is retur… |
CVE-2024-11681 | Medium | 6.8 | 2025-01-07 | A malicious or compromised MacPorts mirror can execute arbitrary commands as root on the machine of a client running port selfupdate against the mirror. |
CVE-2024-45640 | Medium | 5.3 | 2025-01-07 | IBM Security ReaQta 3.12 returns sensitive information in an HTTP response that could be used in further attacks against the system. |
CVE-2024-45100 | Medium | 4.9 | 2025-01-07 | IBM Security ReaQta 3.12 could allow a privileged user to cause a denial of service by sending multiple administration requests due to improper allocation of r… |
CVE-2024-12738 | Medium | 6.1 | 2025-01-07 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2024-12426 | Medium | 6.5 | 2025-01-07 | Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could… |
CVE-2024-12131 | Medium | 4.3 | 2025-01-07 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in al… |
CVE-2024-52893 | Medium | 5.3 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error me… |
CVE-2024-52891 | Medium | 5.4 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow an authenticated user to inject malicious information or obtain information from log… |
CVE-2024-52367 | Medium | 5.3 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could disclose sensitive system information to an unauthorized actor that could be used in further… |
CVE-2024-52366 | Medium | 5.9 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly e… |
CVE-2024-12711 | Medium | 5.3 | 2025-01-07 | The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_d… |
CVE-2024-12532 | Medium | 4.3 | 2025-01-07 | The BWD Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.18 in widgets/bwdeb-con… |
CVE-2024-12425 | Low | 3.3 | 2025-01-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traver… |
CVE-2024-12316 | Medium | 5.3 | 2025-01-07 | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_action() function in… |
CVE-2024-12033 | Medium | 4.3 | 2025-01-07 | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() function in all versions… |
CVE-2024-11826 | Medium | 6.4 | 2025-01-07 | The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for… |
CVE-2024-56300 | High | 7.5 | 2025-01-07 | Insertion of Sensitive Information Into Sent Data vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Re… |
CVE-2024-56299 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pektsekye Notify Odoo notify-odoo allows Stored XSS.This… |
CVE-2024-56298 | Medium | 5.9 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rob @ 5 Star Plugins Pretty Simple Popup Builder pretty-s… |
CVE-2024-56297 | Medium | 5.9 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Highlight highlight allows Stored XSS.This i… |
CVE-2024-56296 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board WP mangboard allows Reflected XSS.T… |
CVE-2024-56294 | Medium | 6.4 | 2025-01-07 | Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-56293 | Medium | 5.9 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integ… |
CVE-2024-56292 | Medium | 5.9 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Email Reminders email-reminders allows Stored X… |
CVE-2024-56291 | High | 8.1 | 2025-01-07 | Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from… |
CVE-2024-56290 | Critical | 9.3 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address Fo… |
CVE-2024-56289 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey Groundhogg groundhogg allows Reflected XSS.T… |
CVE-2024-56288 | Medium | 5.9 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs wp-docs allows Stored XSS.This issu… |
CVE-2024-56287 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AppJetty WP jQuery DataTable wp-jquery-datatable allows S… |
CVE-2024-56286 | High | 7.5 | 2025-01-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-a… |
CVE-2024-56285 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-ad… |
CVE-2024-56284 | Critical | 9.3 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms… |
CVE-2024-56283 | High | 8.1 | 2025-01-07 | Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Lo… |
CVE-2024-56282 | High | 7.5 | 2025-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elicus WPMozo Addons Lite for Elemento… |
CVE-2024-56281 | High | 7.5 | 2025-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woo… |
CVE-2024-56280 | High | 8.8 | 2025-01-07 | Incorrect Privilege Assignment vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Privilege Escalation.This issue affects WPGuppy: from n/… |
CVE-2024-56279 | Medium | 6.4 | 2025-01-07 | Server-Side Request Forgery (SSRF) vulnerability in mra13 Compact WP Audio Player compact-wp-audio-player allows Server Side Request Forgery.This issue affects… |
CVE-2024-56278 | Critical | 9.1 | 2025-01-07 | Improper Control of Generation of Code ('Code Injection') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows PHP Remote File I… |
CVE-2024-56276 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-56275 | Medium | 4.1 | 2025-01-07 | Server-Side Request Forgery (SSRF) vulnerability in Envato Envato Elements allows Server Side Request Forgery.This issue affects Envato Elements: from n/a thro… |
CVE-2024-56274 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Store… |
CVE-2024-56273 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in wpvividplugins WPvivid Backup and Migration wpvivid-backuprestore allows Accessing Functionality Not Properly Constraine… |
CVE-2024-56271 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2024-51715 | High | 8.5 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickWhale ClickWhale clickwhale allows Blind SQL Injecti… |
CVE-2024-51700 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eutrue NAVER Analytics naver-analytics allows Stored XSS… |
CVE-2024-51651 | Medium | 5.3 | 2025-01-07 | Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2024-49649 | Critical | 9.8 | 2025-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-… |
CVE-2024-49644 | High | 8.8 | 2025-01-07 | Incorrect Privilege Assignment vulnerability in AllAccessible Accessibility by AllAccessible allaccessible allows Privilege Escalation.This issue affects Acces… |
CVE-2024-49633 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows Reflec… |
CVE-2024-49294 | Medium | 4.3 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Cros… |
CVE-2024-49249 | High | 8.6 | 2025-01-07 | Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a… |
CVE-2024-49222 | Critical | 9.8 | 2025-01-07 | Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a… |
CVE-2024-43243 | Critical | 10.0 | 2025-01-07 | Unrestricted Upload of File with Dangerous Type vulnerability in themeglow JobBoard Job listing job-board-light allows Upload a Web Shell to a Web Server.This… |
CVE-2024-12719 | Medium | 4.3 | 2025-01-07 | The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_ajax_action_read_subf… |
CVE-2024-12699 | Medium | 6.4 | 2025-01-07 | The Service Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.9 due to insufficient input sanitizat… |
CVE-2024-12152 | High | 7.5 | 2025-01-07 | The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download… |
CVE-2024-54030 | Medium | 4.4 | 2025-01-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through use after free. |
CVE-2024-47398 | High | 8.8 | 2025-01-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the device is unable to boot up through out-of-bounds write. |
CVE-2024-45070 | Medium | 5.5 | 2025-01-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-12516 | Medium | 6.4 | 2025-01-07 | The Coupon Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Coupon Code' parameter in all versions up to, and including, 1.2.1… |
CVE-2024-12202 | High | 8.8 | 2025-01-07 | The Croma Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check… |
CVE-2024-12077 | Medium | 6.1 | 2025-01-07 | The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all ver… |
CVE-2024-11627 | Medium | 6.8 | 2025-01-07 | : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, fro… |
CVE-2024-11626 | High | 8.4 | 2025-01-07 | Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitef… |
CVE-2024-11625 | High | 7.7 | 2025-01-07 | Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.81… |
CVE-2024-10866 | Medium | 5.3 | 2025-01-07 | The Export Import Menus plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dsp_export_import_menus() fu… |
CVE-2024-9502 | Medium | 6.4 | 2025-01-07 | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross… |
CVE-2024-9354 | Medium | 6.1 | 2025-01-07 | The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and inclu… |
CVE-2024-12781 | Medium | 4.3 | 2025-01-07 | The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-12624 | Medium | 6.4 | 2025-01-07 | The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget in all versions up… |
CVE-2024-12499 | Medium | 6.4 | 2025-01-07 | The WP jQuery DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_jdt' shortcode in all versions up to, and includ… |
CVE-2024-12495 | Medium | 6.4 | 2025-01-07 | The Bootstrap Blocks for WP Editor v2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gtb-bootstrap/column' block in all versions up… |
CVE-2024-12437 | Medium | 6.4 | 2025-01-07 | The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'envato' shortcode in all versions up to, and includin… |
CVE-2024-11764 | Medium | 6.4 | 2025-01-07 | The Solar Wizard Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'solar_wizard' shortcode in all versions up to, and in… |
CVE-2024-11725 | High | 8.8 | 2025-01-07 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation d… |
CVE-2024-11282 | Medium | 5.3 | 2025-01-07 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4… |
CVE-2024-9702 | Medium | 6.4 | 2025-01-07 | The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialrocket-floating' shortcode… |