2024 CVEs (page 66)
Page 66 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51464 | Medium | 4.3 | 2024-12-21 | IBM i 7.3, 7.4, and 7.5 is vulnerable to bypassing Navigator for i interface restrictions. By sending a specially crafted request, an authenticated attacker c… |
CVE-2024-51463 | Medium | 5.4 | 2024-12-21 | IBM i 7.3, 7.4, and 7.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the… |
CVE-2024-12884 | High | 7.3 | 2024-12-21 | A vulnerability was found in Codezips E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2024-12883 | Medium | 4.3 | 2024-12-21 | A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2024-12875 | Medium | 4.9 | 2024-12-21 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an… |
CVE-2024-12591 | Medium | 6.4 | 2024-12-21 | The MagicPost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wb_share_social shortcode in all versions up to, and including… |
CVE-2024-12558 | Medium | 6.5 | 2024-12-21 | The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on… |
CVE-2024-12408 | Medium | 6.1 | 2024-12-21 | The WP on AWS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST data in all versions up to, and including, 5.2.1 due to insuffici… |
CVE-2024-11722 | Medium | 5.9 | 2024-12-21 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 d… |
CVE-2024-11688 | Medium | 6.1 | 2024-12-21 | The LaTeX2HTML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ver' or 'date' parameter in all versions up to, and including, 2.5… |
CVE-2024-10453 | Medium | 6.4 | 2024-12-21 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typography Set… |
CVE-2024-9545 | Medium | 6.4 | 2024-12-21 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_contact_box and aux_gm… |
CVE-2024-12588 | Medium | 6.4 | 2024-12-21 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff widget in all versio… |
CVE-2024-11808 | Medium | 6.1 | 2024-12-21 | The Pingmeter Uptime Monitoring plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to, and in… |
CVE-2024-10797 | Medium | 4.3 | 2024-12-21 | The Full Screen Menu for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.7 via the Full Screen… |
CVE-2024-12771 | High | 8.8 | 2024-12-21 | The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.4… |
CVE-2024-12721 | High | 7.2 | 2024-12-21 | The Custom Product Tabs For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.4 via deserializat… |
CVE-2024-12697 | Medium | 6.4 | 2024-12-21 | The real.Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.1 due to insufficient input sanitizati… |
CVE-2024-12635 | Medium | 6.5 | 2024-12-21 | The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dir_id' parameter in all versions up to, and including, 2.2.0 due to insuff… |
CVE-2024-12262 | Medium | 6.1 | 2024-12-21 | The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'step' parameter in all versions up to, and including, 5.8001 due… |
CVE-2024-12066 | High | 8.8 | 2024-12-21 | The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() f… |
CVE-2024-11975 | Medium | 6.1 | 2024-12-21 | The Reactflow Visitor Recording and Heatmaps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions… |
CVE-2024-11938 | Medium | 6.4 | 2024-12-21 | The One Click Upsell Funnel for WooCommerce – Funnel Builder for WordPress, Create WooCommerce Upsell, Post-Purchase Upsell & Cross Sell Offers that Boost Sal… |
CVE-2024-11682 | Medium | 6.1 | 2024-12-21 | The G Web Pro Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in all versions up to, and including, 2… |
CVE-2024-11287 | Medium | 6.1 | 2024-12-21 | The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in… |
CVE-2024-11196 | Medium | 6.4 | 2024-12-21 | The Multi-column Tag Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mctagmap shortcode in all versions up to, and inclu… |
CVE-2024-11977 | High | 7.3 | 2024-12-21 | The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-11607 | Medium | 6.1 | 2024-12-21 | The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could al… |
CVE-2024-12846 | Medium | 4.3 | 2024-12-21 | A vulnerability, which was classified as problematic, has been found in Emlog Pro up to 2.4.1. Affected by this issue is some unknown functionality of the file… |
CVE-2024-11349 | Critical | 9.8 | 2024-12-21 | The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly ver… |
CVE-2024-11811 | Medium | 6.1 | 2024-12-20 | The Feedify – Web Push Notifications plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'platform', 'phone', 'email', and 'store_url'… |
CVE-2024-12845 | Low | 3.5 | 2024-12-20 | A vulnerability classified as problematic was found in Emlog Pro up to 2.4.1. Affected by this vulnerability is an unknown functionality in the library /includ… |
CVE-2024-56359 | High | 8.1 | 2024-12-20 | grist-core is a spreadsheet hosting server. A user visiting a malicious document and clicking on a link in a HyperLink cell using a control modifier (meaning f… |
CVE-2024-56358 | High | 8.1 | 2024-12-20 | grist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, because Jav… |
CVE-2024-56357 | High | 8.1 | 2024-12-20 | grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because i… |
CVE-2024-56335 | High | 7.6 | 2024-12-20 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updati… |
CVE-2024-56334 | High | 7.8 | 2024-12-20 | systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter t… |
CVE-2024-55509 | Critical | 9.8 | 2024-12-20 | SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via the i… |
CVE-2024-40875 | | 2024-12-20 | There is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.52. Attackers with system administrator p… | |
CVE-2024-12844 | Medium | 4.3 | 2024-12-20 | A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.1. Affected is an unknown function of the file /admin/store.php. The manipulati… |
CVE-2024-12843 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/plugin.php… |
CVE-2024-56333 | | 2024-12-20 | Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scient… | |
CVE-2024-56331 | Medium | 6.8 | 2024-12-20 | Uptime Kuma is an open source, self-hosted monitoring tool. An **Improper URL Handling Vulnerability** allows an attacker to access sensitive local files on th… |
CVE-2024-56330 | | 2024-12-20 | Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. This would allow user… | |
CVE-2024-56329 | | 2024-12-20 | Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, wi… | |
CVE-2024-55341 | Medium | 4.7 | 2024-12-20 | A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by… |
CVE-2024-12867 | | 2024-12-20 | Server-Side Request Forgery in URL Mapper in Arctic Security's Arctic Hub versions 3.0.1764-5.6.1877 allows an unauthenticated remote attacker to exfiltrate an… | |
CVE-2024-12842 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/user.php. T… |
CVE-2024-55342 | Medium | 4.7 | 2024-12-20 | A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain mali… |
CVE-2024-37758 | High | 8.8 | 2024-12-20 | Improper access control in the endpoint /RoleMenuMapping/AddRoleMenu of Digiteam v4.21.0.0 allows authenticated attackers to escalate privileges. |
CVE-2024-12841 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been classified as problematic. This affects an unknown part of the file /admin/tag.php. The manipul… |
CVE-2024-12677 | High | 7.8 | 2024-12-20 | Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code. |
CVE-2024-56337 | Critical | 9.8 | 2024-12-20 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0… |
CVE-2024-55471 | Medium | 6.5 | 2024-12-20 | Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensit… |
CVE-2024-55470 | High | 7.5 | 2024-12-20 | Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successf… |
CVE-2024-55186 | Medium | 4.3 | 2024-12-20 | An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by… |
CVE-2024-10385 | | 2024-12-20 | Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store mali… | |
CVE-2024-56356 | Medium | 5.9 | 2024-12-20 | In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack |
CVE-2024-56355 | Medium | 4.6 | 2024-12-20 | In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS |
CVE-2024-56354 | Medium | 5.5 | 2024-12-20 | In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission |
CVE-2024-56353 | Medium | 5.5 | 2024-12-20 | In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies |
CVE-2024-56352 | Medium | 4.6 | 2024-12-20 | In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page |
CVE-2024-56351 | Medium | 6.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles |
CVE-2024-56350 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects |
CVE-2024-56349 | Medium | 5.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs |
CVE-2024-56348 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents |
CVE-2024-51466 | Critical | 9.0 | 2024-12-20 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote atta… |
CVE-2024-40695 | High | 8.0 | 2024-12-20 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 could be vulnerable to malicious file upload by not validating the content of the… |
CVE-2024-28767 | Medium | 6.8 | 2024-12-20 | IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on… |
CVE-2024-12014 | | 2024-12-20 | Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access a… | |
CVE-2024-7726 | Medium | 6.8 | 2024-12-20 | There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that… |
CVE-2024-9619 | Medium | 6.4 | 2024-12-20 | The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insuffi… |
CVE-2024-9503 | Medium | 4.3 | 2024-12-20 | The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-12571 | Critical | 9.8 | 2024-12-20 | The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress is vulnerable to Local File Inclusion in version 3.98.9 via the 'sl_engin… |
CVE-2024-12509 | Medium | 6.4 | 2024-12-20 | The Embed Twine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embed_twine' shortcode in all versions up to, and including… |
CVE-2024-12506 | Medium | 6.4 | 2024-12-20 | The NACC WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nacc' shortcode in all versions up to, and includ… |
CVE-2024-11893 | Medium | 6.4 | 2024-12-20 | The Spoki – Chat Buttons and WooCommerce Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spoki_button' shortc… |
CVE-2024-11878 | Medium | 6.4 | 2024-12-20 | The Category Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'category-post-slider' shortcode in all versions up… |
CVE-2024-11812 | Medium | 6.1 | 2024-12-20 | The Wtyczka SeoPilot dla WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.091. This is due to miss… |
CVE-2024-11806 | Medium | 6.1 | 2024-12-20 | The PKT1 Centro de envios plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'success' and 'error' parameters in all versions up to… |
CVE-2024-11784 | Medium | 6.4 | 2024-12-20 | The Sell Tickets Online – TicketSource Ticket Shop for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketshop… |
CVE-2024-11783 | Medium | 6.4 | 2024-12-20 | The Financial Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'finance_calculator' shortcode in all versions up t… |
CVE-2024-11775 | Medium | 6.4 | 2024-12-20 | The Particle Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'particleground' shortcode in all versions up to, an… |
CVE-2024-11774 | Medium | 6.4 | 2024-12-20 | The Outdooractive Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list2go' shortcode in all versions up to, and inclu… |
CVE-2024-11411 | Medium | 6.4 | 2024-12-20 | The Spotlightr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotlightr-v' shortcode in all versions up to, and including… |
CVE-2024-11331 | Medium | 6.1 | 2024-12-20 | The استخراج محصولات ووکامرس برای آیسی plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg w… |
CVE-2024-11297 | Medium | 5.3 | 2024-12-20 | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… |
CVE-2024-8968 | Medium | 4.7 | 2024-12-20 | The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users… |
CVE-2024-5955 | Medium | 5.4 | 2024-12-20 | Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated attacker to craft re… |
CVE-2024-11108 | Medium | 5.4 | 2024-12-20 | The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2024-10706 | Medium | 4.8 | 2024-12-20 | The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10555 | Medium | 4.8 | 2024-12-20 | The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users… |
CVE-2024-21549 | High | 8.6 | 2024-12-20 | Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An att… |
CVE-2024-44298 | Low | 3.3 | 2024-12-20 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access inf… |
CVE-2024-44293 | Medium | 5.5 | 2024-12-20 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. A user may be able to view sensi… |
CVE-2024-44292 | Medium | 5.5 | 2024-12-20 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sen… |
CVE-2024-44231 | Medium | 4.6 | 2024-12-20 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. A person with physical access to a Mac may be able to by… |
CVE-2024-44223 | Medium | 4.6 | 2024-12-20 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access to a Mac may be able to… |
CVE-2024-44211 | Medium | 5.5 | 2024-12-20 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data. |
CVE-2024-44195 | High | 7.5 | 2024-12-20 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to read arbitrary files. |