2024 CVEs (page 59)
Page 59 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52047 | High | 7.5 | 2024-12-31 | A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Pleas… |
CVE-2024-25133 | High | 8.8 | 2024-12-31 | A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enab… |
CVE-2024-13072 | Medium | 6.3 | 2024-12-31 | A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2024-13070 | Medium | 6.3 | 2024-12-31 | A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown function… |
CVE-2024-56207 | High | 8.8 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-wi… |
CVE-2024-56206 | High | 8.8 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in krishankakkar gap-hub-user-role gap-hub-user-role allows Authentication Bypass.This issue affects gap-hub-us… |
CVE-2024-56204 | High | 8.8 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in yonisink Sinking Dropdowns sinking-dropdowns allows Privilege Escalation.This issue affects Sinking Dropdown… |
CVE-2024-56203 | High | 8.8 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in gholme4 Wayne Audio Player wayne-audio-player allows Privilege Escalation.This issue affects Wayne Audio Pla… |
CVE-2024-56070 | High | 7.4 | 2024-12-31 | Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2024-56066 | Critical | 9.8 | 2024-12-31 | Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Privilege Escalation.This issue affects Agency Toolkit: from n/a through <=… |
CVE-2024-56061 | High | 8.8 | 2024-12-31 | Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a throu… |
CVE-2024-56045 | Critical | 9.3 | 2024-12-31 | Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5. |
CVE-2024-56044 | Critical | 9.8 | 2024-12-31 | Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS… |
CVE-2024-56043 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9. |
CVE-2024-56040 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP vibebp allows Privilege Escalation.This issue affects VibeBP: from n/a through <= 1.9.9.4.1. |
CVE-2024-56002 | Medium | 6.4 | 2024-12-31 | Missing Authorization vulnerability in mightyforms Contact Form, Survey & Form Builder – MightyForms mightyforms allows Exploiting Incorrectly Configured Acces… |
CVE-2024-55995 | Medium | 6.5 | 2024-12-31 | Missing Authorization vulnerability in Torod Company for Information Technology Torod torod allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2024-51667 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in paytiumsupport Paytium paytium.This issue affects Paytium: from n/a through <= 4.4.10. |
CVE-2024-49698 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in PriceListo Best Restaurant Menu by PriceListo best-restaurant-menu-by-pricelisto.This issue affects Best Restaurant Menu… |
CVE-2024-49694 | Medium | 5.3 | 2024-12-31 | Missing Authorization vulnerability in imw3 My Wp Brand my-wp-brand.This issue affects My Wp Brand: from n/a through <= 1.1.2. |
CVE-2024-49687 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce.This issue affects Smart Manager: from n/a through <= 8.45.0. |
CVE-2024-49686 | Medium | 5.4 | 2024-12-31 | Missing Authorization vulnerability in fatcatapps Landing Page Cat landing-page-cat.This issue affects Landing Page Cat: from n/a through <= 1.7.4. |
CVE-2024-56205 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in SunnyKai AI Magic newsletter-page-redirects allows Privilege Escalation.This issue affects AI Magic: from n/a t… |
CVE-2024-56071 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in mikeleembruggen Simple Dashboard simple-dashboard allows Privilege Escalation.This issue affects Simple Dashboa… |
CVE-2024-56068 | High | 7.5 | 2024-12-31 | Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3. |
CVE-2024-56067 | High | 7.5 | 2024-12-31 | Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2024-56064 | Critical | 10.0 | 2024-12-31 | Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This i… |
CVE-2024-56046 | Critical | 10.0 | 2024-12-31 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56042 | Critical | 9.3 | 2024-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This i… |
CVE-2024-56041 | High | 8.5 | 2024-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue… |
CVE-2024-56039 | Critical | 9.3 | 2024-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue… |
CVE-2024-56031 | Medium | 6.5 | 2024-12-31 | Missing Authorization vulnerability in Yulio Aleman Jimenez Smart Shopify Product smart-shopify-product allows Exploiting Incorrectly Configured Access Control… |
CVE-2024-55991 | Medium | 6.5 | 2024-12-31 | Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2024-13061 | Critical | 9.8 | 2024-12-31 | The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability. Although the product enforces an IP whiteli… |
CVE-2024-56265 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers a… |
CVE-2024-56256 | Medium | 5.9 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer.This issue… |
CVE-2024-56235 | Medium | 6.5 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vicky Kumar Coupon coupon-lite allows DOM-Based XSS.This… |
CVE-2024-56234 | Medium | 5.4 | 2024-12-31 | Missing Authorization vulnerability in vowelweb VW Automobile Lite vw-automobile-lite allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2024-56233 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kinhelios KinTPV WooConnect kintpv-connect allows Stored… |
CVE-2024-56231 | Medium | 6.5 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debuggers Studio SaasPricing saaspricing allows DOM-Based… |
CVE-2024-56228 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocomme… |
CVE-2024-56227 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-56226 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons al… |
CVE-2024-56225 | Medium | 5.4 | 2024-12-31 | Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Accessing Functionality Not Properly Constrained… |
CVE-2024-56224 | Medium | 6.5 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ledenbeheer Ledenbeheer ledenbeheer-external-connection a… |
CVE-2024-56223 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood Gulri Slider gulri-slider allows Reflected… |
CVE-2024-56221 | Medium | 6.5 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elicus WPMozo Addons Lite for Elementor wpmozo-addons-lit… |
CVE-2024-56219 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2024-56217 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2024-56215 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in DBAR Productions Member Directory and Contact Form pta-member-directory allows Exploiting Incorrectly Configured Access… |
CVE-2024-56210 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Userpro userpro allows Reflected XSS.This is… |
CVE-2024-56209 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen Kleo kleo allows Reflected XSS.This issue af… |
CVE-2024-13069 | Low | 3.5 | 2024-12-31 | A vulnerability was found in SourceCodester Multi Role Login System 1.0. It has been classified as problematic. Affected is an unknown function of the file /en… |
CVE-2024-12108 | Critical | 9.6 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API. |
CVE-2024-12106 | Critical | 9.4 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings. |
CVE-2024-12105 | Medium | 6.5 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an authenticated user can use a specially crafted HTTP request that can lead to information disclosure. |
CVE-2024-56232 | High | 7.1 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Alex Volkov WP Nice Loader wp-nice-loader allows Stored XSS.This issue affects WP Nice Loader: from n/a thro… |
CVE-2024-56230 | High | 7.5 | 2024-12-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Maidul Dynamic Product Category Grid… |
CVE-2024-56229 | Medium | 4.3 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in SearchIQ SearchIQ searchiq.This issue affects SearchIQ: from n/a through <= 4.6. |
CVE-2024-56222 | Medium | 5.4 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Cross Site Request Forgery.This issue affects CodeBard… |
CVE-2024-56220 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue a… |
CVE-2024-56218 | Medium | 4.3 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Cross Site R… |
CVE-2024-56216 | Medium | 6.5 | 2024-12-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Builder themify-buil… |
CVE-2024-56214 | High | 8.3 | 2024-12-31 | Path Traversal: '.../...//' vulnerability in DeluxeThemes Userpro userpro allows Path Traversal.This issue affects Userpro: from n/a through <= 5.1.9. |
CVE-2024-56213 | Medium | 6.5 | 2024-12-31 | Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.7. |
CVE-2024-56212 | High | 8.5 | 2024-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro… |
CVE-2024-56211 | High | 8.8 | 2024-12-31 | Missing Authorization vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.9. |
CVE-2024-49422 | Medium | 5.2 | 2024-12-31 | Protection Mechanism Failure in bootloader prior to SMR Oct-2024 Release 1 allows physical attackers to reset lockscreen failure count by hardware fault inject… |
CVE-2024-13067 | Medium | 5.3 | 2024-12-31 | A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical. This issue affects some unknown processing of the file /admi… |
CVE-2024-11972 | Critical | 9.8 | 2024-12-31 | The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activat… |
CVE-2024-45497 | High | 7.6 | 2024-12-31 | A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kube… |
CVE-2024-13040 | High | 8.8 | 2024-12-31 | The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers… |
CVE-2024-12839 | High | 8.8 | 2024-12-31 | The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a for… |
CVE-2024-12838 | High | 8.8 | 2024-12-31 | The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regu… |
CVE-2024-13058 | | 2024-12-30 | An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and avai… | |
CVE-2024-13051 | High | 7.8 | 2024-12-30 | Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2024-13050 | High | 7.8 | 2024-12-30 | Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2024-13049 | High | 7.8 | 2024-12-30 | Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2024-13048 | High | 7.8 | 2024-12-30 | Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2024-13047 | High | 7.8 | 2024-12-30 | Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2024-13046 | High | 7.8 | 2024-12-30 | Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2024-13045 | High | 7.8 | 2024-12-30 | Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2024-13044 | High | 7.8 | 2024-12-30 | Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2024-13043 | High | 7.8 | 2024-12-30 | Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected insta… |
CVE-2024-13042 | Medium | 4.3 | 2024-12-30 | A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been classified as problematic. Affected is the… |
CVE-2024-12753 | High | 7.3 | 2024-12-30 | Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installa… |
CVE-2024-12752 | High | 7.8 | 2024-12-30 | Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affect… |
CVE-2024-12751 | High | 7.8 | 2024-12-30 | Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affec… |
CVE-2024-11946 | Medium | 6.5 | 2024-12-30 | iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This vulnerability allows network-adjacent… |
CVE-2024-11944 | High | 8.8 | 2024-12-30 | iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to exec… |
CVE-2024-56801 | Critical | 9.8 | 2024-12-30 | Tasklists provides plugin tasklists for GLPI. Versions prior to 2.0.4 have a blind SQL injection vulnerability. Version 2.0.4 contains a patch for the vulnerab… |
CVE-2024-56800 | High | 7.4 | 2024-12-30 | Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side requ… |
CVE-2024-56799 | Critical | 10.0 | 2024-12-30 | Simofa is a tool to help automate static website building and deployment. Prior to version 0.2.7, due to a design mistake in the RouteLoader class, some API ro… |
CVE-2024-46542 | Medium | 6.5 | 2024-12-30 | Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks. |
CVE-2024-56734 | Medium | 6.1 | 2024-12-30 | Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Bet… |
CVE-2024-56733 | Medium | 5.7 | 2024-12-30 | Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior… |
CVE-2024-56517 | | 2024-12-30 | LGSL (Live Game Server List) provides online status lists for online video games. Versions up to and including 6.2.1 contain a reflected cross-site scripting v… | |
CVE-2024-56516 | | 2024-12-30 | free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions up to and including… | |
CVE-2024-52294 | Medium | 4.3 | 2024-12-30 | Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference (IDOR) vulnerability in the update_subscript… |
CVE-2024-12836 | High | 7.8 | 2024-12-30 | Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |