2024 CVEs (page 55)
Page 55 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12332 | Medium | 6.5 | 2025-01-07 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including… |
CVE-2024-12327 | Medium | 4.3 | 2025-01-07 | The LazyLoad Background Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pblzbg_save_set… |
CVE-2024-12324 | Medium | 6.1 | 2025-01-07 | The Unilevel MLM Plan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.1.0… |
CVE-2024-12322 | High | 8.8 | 2025-01-07 | The ThePerfectWedding.nl Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8. This is due to miss… |
CVE-2024-12313 | High | 8.1 | 2025-01-07 | The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization… |
CVE-2024-12291 | Medium | 6.1 | 2025-01-07 | The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.17. This is due to missing or incor… |
CVE-2024-12290 | Medium | 6.1 | 2025-01-07 | The Infility Global plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘set_type’ parameter in all versions up to, and including, 2.9… |
CVE-2024-12288 | Medium | 6.1 | 2025-01-07 | The Simple add pages or posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to miss… |
CVE-2024-12264 | Critical | 9.8 | 2025-01-07 | The PayU CommercePro Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.8.3. This is due to /wp-json/pay… |
CVE-2024-12256 | Medium | 6.1 | 2025-01-07 | The Simple Video Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'analytics_video' parameter in all versions up… |
CVE-2024-12252 | Critical | 9.8 | 2025-01-07 | The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remote_update AJAX action in all versions u… |
CVE-2024-12214 | Medium | 6.1 | 2025-01-07 | The WooCommerce HSS Extension for Streaming Video plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘videolink’ parameter in all ver… |
CVE-2024-12207 | Medium | 4.4 | 2025-01-07 | The Toggles Shortcode and Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and inclu… |
CVE-2024-12176 | Medium | 5.3 | 2025-01-07 | The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wl_config_plugin' AJ… |
CVE-2024-12170 | Medium | 5.4 | 2025-01-07 | The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.15. This is due to missing or incor… |
CVE-2024-12159 | Medium | 5.3 | 2025-01-07 | The Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords plugin for WordPress is vulnerable to Information Exposure in all versions up to, a… |
CVE-2024-12158 | Medium | 5.3 | 2025-01-07 | The Popup – MailChimp, GetResponse and ActiveCampaign Intergrations plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability… |
CVE-2024-12157 | High | 7.5 | 2025-01-07 | The Popup – MailChimp, GetResponse and ActiveCampaign Intergrations plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'upc_dele… |
CVE-2024-12153 | Medium | 6.1 | 2025-01-07 | The GDY Modular Content plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on th… |
CVE-2024-12140 | Medium | 4.3 | 2025-01-07 | The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up… |
CVE-2024-12126 | Medium | 6.1 | 2025-01-07 | The SEO Keywords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘google_error’ parameter in all versions up to, and including, 1… |
CVE-2024-12049 | Medium | 6.1 | 2025-01-07 | The Woo Ukrposhta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order', 'post', and 'idd' parameters in all versions up to, and… |
CVE-2024-11810 | Medium | 6.1 | 2025-01-07 | The PayGreen Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message_id' parameter in all versions up to, and inc… |
CVE-2024-11690 | Medium | 6.1 | 2025-01-07 | The Financial Stocks & Crypto Market Data Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'e' parameter in all versions up… |
CVE-2024-11496 | Medium | 6.5 | 2025-01-07 | The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infility_global_ajax funct… |
CVE-2024-11465 | High | 7.2 | 2025-01-07 | The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserializat… |
CVE-2024-11445 | Medium | 6.4 | 2025-01-07 | The Image Magnify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'image_magnify' shortcode in all versions up to, and inclu… |
CVE-2024-11434 | Medium | 6.1 | 2025-01-07 | The WP – Bulk SMS – by SMS.to plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and includin… |
CVE-2024-11383 | Medium | 6.4 | 2025-01-07 | The CC Canadian Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cc-mortgage-canada' shortcode in all ve… |
CVE-2024-11382 | Medium | 6.4 | 2025-01-07 | The Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-11378 | Medium | 6.1 | 2025-01-07 | The Bizapp for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error' parameter in all versions up to, and including… |
CVE-2024-11377 | Medium | 6.1 | 2025-01-07 | The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and inclu… |
CVE-2024-11375 | Medium | 6.1 | 2025-01-07 | The WC1C plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all ve… |
CVE-2024-11363 | Medium | 6.1 | 2025-01-07 | The Same but Different – Related Posts by Taxonomy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remov… |
CVE-2024-11338 | Medium | 6.4 | 2025-01-07 | The PIXNET Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gtm' and 'venue' parameters in all versions up to, and including… |
CVE-2024-11337 | Medium | 6.4 | 2025-01-07 | The Horoscope And Tarot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'divine_horoscope' shortcode in all versions up to… |
CVE-2024-11290 | Medium | 5.3 | 2025-01-07 | The Member Access plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the WordPress core searc… |
CVE-2024-10527 | Low | 3.1 | 2025-01-07 | The Spacer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the motech_spacer_callback() function in all… |
CVE-2024-12592 | Medium | 6.4 | 2025-01-07 | The Sellsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testSellsy' shortcode in all versions up to, and including, 2.3… |
CVE-2024-12590 | Medium | 6.4 | 2025-01-07 | The WP Youtube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9 due t… |
CVE-2024-12559 | Medium | 5.3 | 2025-01-07 | The ClickDesigns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clickdesigns_add_api' and th… |
CVE-2024-12557 | Medium | 6.1 | 2025-01-07 | The Transporters.io plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing nonce… |
CVE-2024-12541 | Medium | 5.4 | 2025-01-07 | The Chative Live chat and Chatbot plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to mi… |
CVE-2024-12538 | Medium | 4.3 | 2025-01-07 | The Duplicate Post, Page and Any Custom Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.5 v… |
CVE-2024-12528 | Medium | 6.4 | 2025-01-07 | The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp… |
CVE-2024-12419 | Medium | 6.5 | 2025-01-07 | The The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions u… |
CVE-2024-12416 | High | 7.5 | 2025-01-07 | The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to SQL Injection via the 'woomotiv_seen_products_.*' cookie in all ve… |
CVE-2024-12402 | Critical | 9.8 | 2025-01-07 | The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all v… |
CVE-2024-12098 | Medium | 6.1 | 2025-01-07 | The ARS Affiliate Page Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'utm_keyword' parameter in all versions up to, and i… |
CVE-2024-11934 | Medium | 6.4 | 2025-01-07 | The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formaloo' s… |
CVE-2024-11899 | Medium | 6.4 | 2025-01-07 | The Slider Pro Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sliderpro' shortcode in all versions up to, and includi… |
CVE-2024-11777 | Medium | 6.4 | 2025-01-07 | The Sell Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sell_media_search_form_gutenberg' shortcode in all versions… |
CVE-2024-11437 | Medium | 4.9 | 2025-01-07 | The Timeline Designer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.4 due to insufficient e… |
CVE-2024-55553 | High | 7.5 | 2025-01-06 | In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffe… |
CVE-2024-54767 | High | 7.5 | 2025-01-06 | An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authenticati… |
CVE-2024-54764 | Medium | 6.5 | 2025-01-06 | An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication. |
CVE-2024-54763 | Medium | 6.5 | 2025-01-06 | An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication. |
CVE-2024-53936 | Medium | 6.3 | 2025-01-06 | The com.asianmobile.callcolor (aka Color Phone Call Screen App) application through 24 for Android enables any application (with no permissions) to place phone… |
CVE-2024-53935 | Medium | 6.5 | 2025-01-06 | The com.callos14.callscreen.colorphone (aka iCall OS17 - Color Phone Flash) application through 4.3 for Android enables any application (with no permissions) t… |
CVE-2024-53934 | High | 7.7 | 2025-01-06 | The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (w… |
CVE-2024-53933 | Medium | 6.3 | 2025-01-06 | The com.callerscreen.colorphone.themes.callflash (aka Color Call Theme & Call Screen) application through 1.0.7 for Android enables any application (with no pe… |
CVE-2024-53932 | Critical | 9.1 | 2025-01-06 | The com.remi.colorphone.callscreen.calltheme.callerscreen (aka Color Phone: Call Screen Theme) application through 21.1.9 for Android enables any application (… |
CVE-2024-53931 | Critical | 9.1 | 2025-01-06 | The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no permissions) to place p… |
CVE-2024-51741 | Medium | 4.4 | 2025-01-06 | Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when… |
CVE-2024-48457 | High | 7.5 | 2025-01-06 | An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3… |
CVE-2024-48456 | High | 7.5 | 2025-01-06 | An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3… |
CVE-2024-48455 | Low | 2.7 | 2025-01-06 | An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3… |
CVE-2024-46981 | High | 7.0 | 2025-01-06 | Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage colle… |
CVE-2024-55076 | High | 8.1 | 2025-01-06 | Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. |
CVE-2024-55075 | Medium | 4.3 | 2025-01-06 | Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and rec… |
CVE-2024-55074 | High | 8.8 | 2025-01-06 | The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issu… |
CVE-2024-55408 | Medium | 5.3 | 2025-01-06 | An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver when crafted IOCTL re… |
CVE-2024-55407 | High | 7.8 | 2025-01-06 | An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write actions via supplyin… |
CVE-2024-46209 | Medium | 5.4 | 2025-01-06 | A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or… |
CVE-2024-35498 | Medium | 6.1 | 2025-01-06 | A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2024-56828 | Critical | 9.8 | 2025-01-06 | File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base6… |
CVE-2024-55629 | High | 7.5 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, TCP streams with TCP urge… |
CVE-2024-55628 | High | 7.5 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.8, DNS resource name… |
CVE-2024-55627 | Medium | 5.9 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a specially crafted TCP s… |
CVE-2024-55626 | Low | 3.3 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large BPF filter file p… |
CVE-2024-55529 | Critical | 9.8 | 2025-01-06 | Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template. |
CVE-2024-54880 | Critical | 9.1 | 2025-01-06 | SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts in bulk. |
CVE-2024-54879 | Critical | 9.1 | 2025-01-06 | SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely. |
CVE-2024-46622 | Critical | 9.8 | 2025-01-06 | An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8.0.x before 8.0.18… |
CVE-2024-46073 | Medium | 6.1 | 2025-01-06 | A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper sanitization of the "n… |
CVE-2024-56769 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg Syzbot reports [1]… |
CVE-2024-56768 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP On x86-64 calling bpf_get_smp_processo… |
CVE-2024-56767 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset The at_xdmac_memset… |
CVE-2024-56766 | High | 7.8 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix double free in atmel_pmecc_create_user() The "user" pointer was convert… |
CVE-2024-56765 | High | 7.8 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct The mapping VMA address is… |
CVE-2024-56764 | High | 7.8 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: ublk: detach gendisk from ublk device if add_disk() fails Inside ublk_abort_requests(), g… |
CVE-2024-56763 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it wil… |
CVE-2024-56761 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-ENDBRANCH #CPs An indirect branch instruction sets the CPU… |
CVE-2024-56760 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Handle lack of irqdomain gracefully Alexandre observed a warning emitted from pc… |
CVE-2024-56759 | High | 7.8 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tr… |
CVE-2024-56758 | Medium | 5.5 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: btrfs: check folio mapping after unlock in relocate_one_folio() When we call btrfs_read_f… |
CVE-2024-56757 | High | 7.8 | 2025-01-06 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect MediaTek claim an s… |
CVE-2024-55605 | High | 7.5 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large input buffer to t… |
CVE-2024-51472 | Low | 3.1 | 2025-01-06 | IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. This vulnerab… |
CVE-2024-47475 | Medium | 5.0 | 2025-01-06 | Dell PowerScale OneFS 8.2.2.x through 9.8.0.x contains an incorrect permission assignment for critical resource vulnerability. A locally authenticated attacker… |