2024 CVEs (page 66)
Page 66 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53256 | High | 7.8 | 2024-12-23 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code which suffered a command injection due… |
CVE-2024-45387 | Critical | 9.9 | 2024-12-23 | An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operation… |
CVE-2024-23945 | Medium | 5.9 | 2024-12-23 | Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps p… |
CVE-2024-55539 | Low | 2.5 | 2024-12-23 | Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux) before build 39185, Acronis Cyber Prote… |
CVE-2024-12903 | High | 7.8 | 2024-12-23 | Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to… |
CVE-2024-12902 | High | 8.4 | 2024-12-23 | ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privil… |
CVE-2024-11230 | Medium | 6.4 | 2024-12-23 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and inc… |
CVE-2024-12901 | Medium | 5.3 | 2024-12-23 | A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controlle… |
CVE-2024-12900 | Medium | 6.3 | 2024-12-23 | A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component… |
CVE-2024-54082 | High | 7.2 | 2024-12-23 | home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be execu… |
CVE-2024-52321 | Medium | 5.9 | 2024-12-23 | Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files containing sensitive i… |
CVE-2024-47864 | Medium | 5.3 | 2024-12-23 | home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug function. A remote unauthenticated att… |
CVE-2024-46873 | Critical | 9.8 | 2024-12-23 | Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated att… |
CVE-2024-45721 | High | 7.2 | 2024-12-23 | home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary… |
CVE-2024-12899 | High | 7.3 | 2024-12-23 | A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been rated as critical. This issue affects some unknown processing… |
CVE-2024-12898 | Medium | 6.3 | 2024-12-23 | A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been declared as critical. This vulnerability affects unknown code… |
CVE-2024-56378 | Medium | 4.3 | 2024-12-23 | libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. |
CVE-2024-12897 | Medium | 4.3 | 2024-12-23 | A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222. It has been classified as critical. This affec… |
CVE-2024-56375 | High | 7.5 | 2024-12-22 | An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (vi… |
CVE-2024-12896 | Medium | 5.3 | 2024-12-22 | A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222 and classified as problematic. Affected by this… |
CVE-2024-56314 | Medium | 5.4 | 2024-12-22 | A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the… |
CVE-2024-56313 | Medium | 5.4 | 2024-12-22 | A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into… |
CVE-2024-56312 | Medium | 5.4 | 2024-12-22 | A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts… |
CVE-2024-56311 | High | 8.8 | 2024-12-22 | REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker ca… |
CVE-2024-56310 | High | 8.8 | 2024-12-22 | REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit… |
CVE-2024-12895 | Medium | 6.3 | 2024-12-22 | A vulnerability has been found in TreasureHuntGame TreasureHunt up to 963e0e0 and classified as critical. Affected by this vulnerability is the function consol… |
CVE-2024-12894 | Medium | 6.3 | 2024-12-22 | A vulnerability, which was classified as critical, was found in TreasureHuntGame TreasureHunt up to 963e0e0. Affected is an unknown function of the file Treasu… |
CVE-2024-12893 | Low | 2.4 | 2024-12-22 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. Affected by this issue is some unknown functionality of… |
CVE-2024-12892 | Low | 3.5 | 2024-12-22 | A vulnerability classified as problematic was found in code-projects Online Exam Mastering System 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2024-12891 | Medium | 6.3 | 2024-12-22 | A vulnerability classified as critical has been found in code-projects Online Exam Mastering System 1.0. Affected is an unknown function of the file /account.p… |
CVE-2024-12890 | Medium | 6.3 | 2024-12-22 | A vulnerability was found in code-projects Online Exam Mastering System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2024-11852 | Medium | 4.3 | 2024-12-22 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorize… |
CVE-2024-51464 | Medium | 4.3 | 2024-12-21 | IBM i 7.3, 7.4, and 7.5 is vulnerable to bypassing Navigator for i interface restrictions. By sending a specially crafted request, an authenticated attacker c… |
CVE-2024-51463 | Medium | 5.4 | 2024-12-21 | IBM i 7.3, 7.4, and 7.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the… |
CVE-2024-12884 | High | 7.3 | 2024-12-21 | A vulnerability was found in Codezips E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2024-12883 | Medium | 4.3 | 2024-12-21 | A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2024-12875 | Medium | 4.9 | 2024-12-21 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an… |
CVE-2024-12591 | Medium | 6.4 | 2024-12-21 | The MagicPost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wb_share_social shortcode in all versions up to, and including… |
CVE-2024-12558 | Medium | 6.5 | 2024-12-21 | The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on… |
CVE-2024-12408 | Medium | 6.1 | 2024-12-21 | The WP on AWS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST data in all versions up to, and including, 5.2.1 due to insuffici… |
CVE-2024-11722 | Medium | 5.9 | 2024-12-21 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 d… |
CVE-2024-11688 | Medium | 6.1 | 2024-12-21 | The LaTeX2HTML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ver' or 'date' parameter in all versions up to, and including, 2.5… |
CVE-2024-10453 | Medium | 6.4 | 2024-12-21 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typography Set… |
CVE-2024-9545 | Medium | 6.4 | 2024-12-21 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_contact_box and aux_gm… |
CVE-2024-12588 | Medium | 6.4 | 2024-12-21 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff widget in all versio… |
CVE-2024-11808 | Medium | 6.1 | 2024-12-21 | The Pingmeter Uptime Monitoring plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to, and in… |
CVE-2024-10797 | Medium | 4.3 | 2024-12-21 | The Full Screen Menu for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.7 via the Full Screen… |
CVE-2024-12771 | High | 8.8 | 2024-12-21 | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.4… |
CVE-2024-12721 | High | 7.2 | 2024-12-21 | The Custom Product Tabs For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.4 via deserializat… |
CVE-2024-12697 | Medium | 6.4 | 2024-12-21 | The real.Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.1 due to insufficient input sanitizati… |
CVE-2024-12635 | Medium | 6.5 | 2024-12-21 | The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dir_id' parameter in all versions up to, and including, 2.2.0 due to insuff… |
CVE-2024-12262 | Medium | 6.1 | 2024-12-21 | The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'step' parameter in all versions up to, and including, 5.8001 due… |
CVE-2024-12066 | High | 8.8 | 2024-12-21 | The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() f… |
CVE-2024-11975 | Medium | 6.1 | 2024-12-21 | The Reactflow Visitor Recording and Heatmaps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions… |
CVE-2024-11938 | Medium | 6.4 | 2024-12-21 | The One Click Upsell Funnel for WooCommerce – Funnel Builder for WordPress, Create WooCommerce Upsell, Post-Purchase Upsell & Cross Sell Offers that Boost Sal… |
CVE-2024-11682 | Medium | 6.1 | 2024-12-21 | The G Web Pro Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in all versions up to, and including, 2… |
CVE-2024-11287 | Medium | 6.1 | 2024-12-21 | The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in… |
CVE-2024-11196 | Medium | 6.4 | 2024-12-21 | The Multi-column Tag Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mctagmap shortcode in all versions up to, and inclu… |
CVE-2024-11977 | High | 7.3 | 2024-12-21 | The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-11607 | Medium | 6.1 | 2024-12-21 | The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could al… |
CVE-2024-12846 | Medium | 4.3 | 2024-12-21 | A vulnerability, which was classified as problematic, has been found in Emlog Pro up to 2.4.1. Affected by this issue is some unknown functionality of the file… |
CVE-2024-11349 | Critical | 9.8 | 2024-12-21 | The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly ver… |
CVE-2024-11811 | Medium | 6.1 | 2024-12-20 | The Feedify – Web Push Notifications plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'platform', 'phone', 'email', and 'store_url'… |
CVE-2024-12845 | Low | 3.5 | 2024-12-20 | A vulnerability classified as problematic was found in Emlog Pro up to 2.4.1. Affected by this vulnerability is an unknown functionality in the library /includ… |
CVE-2024-56359 | High | 8.1 | 2024-12-20 | grist-core is a spreadsheet hosting server. A user visiting a malicious document and clicking on a link in a HyperLink cell using a control modifier (meaning f… |
CVE-2024-56358 | High | 8.1 | 2024-12-20 | grist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, because Jav… |
CVE-2024-56357 | High | 8.1 | 2024-12-20 | grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because i… |
CVE-2024-56335 | High | 7.6 | 2024-12-20 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updati… |
CVE-2024-56334 | High | 7.8 | 2024-12-20 | systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter t… |
CVE-2024-55509 | Critical | 9.8 | 2024-12-20 | SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via the i… |
CVE-2024-40875 | | 2024-12-20 | There is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.52. Attackers with system administrator p… | |
CVE-2024-12844 | Medium | 4.3 | 2024-12-20 | A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.1. Affected is an unknown function of the file /admin/store.php. The manipulati… |
CVE-2024-12843 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/plugin.php… |
CVE-2024-56333 | | 2024-12-20 | Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scient… | |
CVE-2024-56331 | Medium | 6.8 | 2024-12-20 | Uptime Kuma is an open source, self-hosted monitoring tool. An **Improper URL Handling Vulnerability** allows an attacker to access sensitive local files on th… |
CVE-2024-56330 | | 2024-12-20 | Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. This would allow user… | |
CVE-2024-56329 | | 2024-12-20 | Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, wi… | |
CVE-2024-55341 | Medium | 4.7 | 2024-12-20 | A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by… |
CVE-2024-12867 | | 2024-12-20 | Server-Side Request Forgery in URL Mapper in Arctic Security's Arctic Hub versions 3.0.1764-5.6.1877 allows an unauthenticated remote attacker to exfiltrate an… | |
CVE-2024-12842 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/user.php. T… |
CVE-2024-55342 | Medium | 4.7 | 2024-12-20 | A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain mali… |
CVE-2024-37758 | High | 8.8 | 2024-12-20 | Improper access control in the endpoint /RoleMenuMapping/AddRoleMenu of Digiteam v4.21.0.0 allows authenticated attackers to escalate privileges. |
CVE-2024-12841 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been classified as problematic. This affects an unknown part of the file /admin/tag.php. The manipul… |
CVE-2024-12677 | High | 7.8 | 2024-12-20 | Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code. |
CVE-2024-56337 | Critical | 9.8 | 2024-12-20 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0… |
CVE-2024-55471 | Medium | 6.5 | 2024-12-20 | Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensit… |
CVE-2024-55470 | High | 7.5 | 2024-12-20 | Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successf… |
CVE-2024-55186 | Medium | 4.3 | 2024-12-20 | An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by… |
CVE-2024-10385 | | 2024-12-20 | Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store mali… | |
CVE-2024-56356 | Medium | 5.9 | 2024-12-20 | In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack |
CVE-2024-56355 | Medium | 4.6 | 2024-12-20 | In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS |
CVE-2024-56354 | Medium | 5.5 | 2024-12-20 | In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission |
CVE-2024-56353 | Medium | 5.5 | 2024-12-20 | In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies |
CVE-2024-56352 | Medium | 4.6 | 2024-12-20 | In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page |
CVE-2024-56351 | Medium | 6.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles |
CVE-2024-56350 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects |
CVE-2024-56349 | Medium | 5.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs |
CVE-2024-56348 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents |
CVE-2024-51466 | Critical | 9.0 | 2024-12-20 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote atta… |
CVE-2024-40695 | High | 8.0 | 2024-12-20 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 could be vulnerable to malicious file upload by not validating the content of the… |