2024 CVEs (page 68)
Page 68 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55505 | High | 8.8 | 2024-12-18 | An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the mess-view.php component. |
CVE-2024-55232 | Medium | 5.4 | 2024-12-18 | An IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to delete notes belong… |
CVE-2024-55231 | Medium | 4.3 | 2024-12-18 | An IDOR vulnerability in the edit-notes.php module of PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to modify notes belongin… |
CVE-2024-12695 | High | 8.8 | 2024-12-18 | Out of bounds write in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2024-12694 | High | 8.8 | 2024-12-18 | Use after free in Compositing in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-12693 | High | 8.8 | 2024-12-18 | Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2024-12692 | High | 8.8 | 2024-12-18 | Type Confusion in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2024-56145 | Critical | 9.8 | 2024-12-18 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerabi… |
CVE-2024-56140 | Medium | 5.9 | 2024-12-18 | Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. W… |
CVE-2024-45338 | Medium | 5.3 | 2024-12-18 | An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. Thi… |
CVE-2024-12686 | Medium | 6.6 | 2024-12-18 | A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileg… |
CVE-2024-53271 | High | 7.1 | 2024-12-18 | Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This c… |
CVE-2024-53270 | High | 7.5 | 2024-12-18 | Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active request exists when… |
CVE-2024-53269 | Medium | 4.5 | 2024-12-18 | Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm wil… |
CVE-2024-52593 | Medium | 5.3 | 2024-12-18 | Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPe… |
CVE-2024-52592 | Medium | 5.3 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an attacker to modify the… |
CVE-2024-52591 | Critical | 9.3 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.get… |
CVE-2024-52590 | Medium | 6.5 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows an attacker to creat… |
CVE-2024-52579 | Medium | 6.4 | 2024-12-18 | Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allo… |
CVE-2024-51470 | Medium | 6.5 | 2024-12-18 | IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could a… |
CVE-2024-49363 | High | 7.4 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in github.com/misskey-dev/misskey 2024.10.1 or… |
CVE-2024-36694 | High | 7.2 | 2024-12-18 | OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function. |
CVE-2024-12741 | High | 7.8 | 2024-12-18 | A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacke… |
CVE-2024-56057 | Critical | 9.9 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56055 | High | 8.5 | 2024-12-18 | Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2. |
CVE-2024-56054 | Critical | 9.1 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56053 | High | 7.6 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This i… |
CVE-2024-56052 | Critical | 9.9 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56051 | High | 8.5 | 2024-12-18 | Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Code Injection.This issue affects WPLMS: from n… |
CVE-2024-56050 | Critical | 9.9 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56049 | High | 8.5 | 2024-12-18 | Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2. |
CVE-2024-56048 | High | 8.8 | 2024-12-18 | Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS… |
CVE-2024-56047 | High | 8.5 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This i… |
CVE-2024-55953 | High | 8.1 | 2024-12-18 | DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When c… |
CVE-2024-55952 | High | 8.8 | 2024-12-18 | DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jd… |
CVE-2024-54383 | Critical | 9.8 | 2024-12-18 | Incorrect Privilege Assignment vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Privilege Escalation.This issue affects WooComme… |
CVE-2024-54381 | High | 7.1 | 2024-12-18 | Missing Authorization vulnerability in Dotstore Advance Menu Manager advance-menu-manager.This issue affects Advance Menu Manager: from n/a through <= 3.1.1. |
CVE-2024-49202 | High | 7.6 | 2024-12-18 | Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3… |
CVE-2024-49201 | Medium | 4.3 | 2024-12-18 | Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the… |
CVE-2024-47040 | High | 7.8 | 2024-12-18 | There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User… |
CVE-2024-47039 | Medium | 5.5 | 2024-12-18 | In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information discl… |
CVE-2024-47038 | High | 7.8 | 2024-12-18 | In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead to localcescalation… |
CVE-2024-55089 | Medium | 4.1 | 2024-12-18 | Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external enti… |
CVE-2024-55088 | High | 8.8 | 2024-12-18 | GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module. |
CVE-2024-55492 | Medium | 6.1 | 2024-12-18 | Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS). |
CVE-2024-55086 | High | 7.2 | 2024-12-18 | In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management sy… |
CVE-2024-45082 | Medium | 6.8 | 2024-12-18 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack… |
CVE-2024-41752 | Medium | 5.4 | 2024-12-18 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which… |
CVE-2024-25042 | Medium | 5.4 | 2024-12-18 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is potentially vulnerable to Cross Site Scripting (XSS). A remote attacker could execu… |
CVE-2024-52361 | Medium | 5.7 | 2024-12-18 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 stores user credentials in plain text which can be read by an authenticated user with access… |
CVE-2024-49576 | High | 8.8 | 2024-12-18 | A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. A specially crafted Javascript code inside a… |
CVE-2024-47810 | High | 8.8 | 2024-12-18 | A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. A specially crafted Javascript code inside a malicious P… |
CVE-2024-47119 | Medium | 5.9 | 2024-12-18 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity… |
CVE-2024-12373 | | 2024-12-18 | A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a buffer-overflow, potentially causing den… | |
CVE-2024-12372 | | 2024-12-18 | A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corrupt… | |
CVE-2024-12371 | | 2024-12-18 | A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user withou… | |
CVE-2024-56128 | Medium | 5.3 | 2024-12-18 | Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challe… |
CVE-2024-50570 | Medium | 5.0 | 2024-12-18 | A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and F… |
CVE-2024-48889 | High | 7.2 | 2024-12-18 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiManager version 7.6.0, version 7.4… |
CVE-2024-56059 | Critical | 9.8 | 2024-12-18 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection… |
CVE-2024-56058 | Critical | 9.8 | 2024-12-18 | Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a… |
CVE-2024-56016 | High | 7.1 | 2024-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maartenhemmes Image Mapper image-mapper allows Reflected… |
CVE-2024-56010 | High | 7.1 | 2024-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Device Detector device-detector allows Refl… |
CVE-2024-56008 | High | 7.5 | 2024-12-18 | Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This… |
CVE-2024-55997 | Medium | 6.5 | 2024-12-18 | Missing Authorization vulnerability in webchunky Order Delivery & Pickup Location Date Time order-delivery-pickup-location-date-time-free-version allows Exploi… |
CVE-2024-55985 | High | 8.5 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ydesignservices YDS Support Ticket System yds-support-tic… |
CVE-2024-55984 | High | 8.5 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susheelhbti Saksh Escrow System saksh-escrow-system allow… |
CVE-2024-55983 | High | 8.5 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PowerFormBuilder PowerFormBuilder power-forms-builder all… |
CVE-2024-55975 | High | 8.5 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rohit Urane Dr Affiliate dr-affiliate allows SQL Injectio… |
CVE-2024-54350 | High | 7.1 | 2024-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hjyl hmd hmd allows Stored XSS.This issue affects hmd: fr… |
CVE-2024-54270 | High | 8.1 | 2024-12-18 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axeptio Axeptio axeptio-sdk-integratio… |
CVE-2024-52485 | Medium | 6.5 | 2024-12-18 | Missing Authorization vulnerability in Yudiz Solutions Ltd. WP Menu Image wp-menu-image allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-51646 | High | 7.1 | 2024-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saoshyant1994 Saoshyant Element saoshyant-element allows… |
CVE-2024-4996 | Critical | 9.8 | 2024-12-18 | Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data… |
CVE-2024-4995 | Critical | 9.8 | 2024-12-18 | Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data int… |
CVE-2024-49677 | High | 7.1 | 2024-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Cramer Bootstrap Buttons bootstrap-buttons allows R… |
CVE-2024-11926 | Medium | 6.5 | 2024-12-18 | The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '__stPartner… |
CVE-2024-11912 | High | 7.5 | 2024-12-18 | The Travel Booking WordPress Theme theme for WordPress is vulnerable to blind time-based SQL Injection via the ‘order_id’ parameter in all versions up to, and… |
CVE-2024-11291 | Medium | 5.3 | 2024-12-18 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Informatio… |
CVE-2024-47104 | Medium | 6.8 | 2024-12-18 | IBM i 7.4 and 7.5 is vulnerable to an authenticated user gaining elevated privilege to a physical file. A user with authority to a view can alter the based-on… |
CVE-2024-12554 | Medium | 5.4 | 2024-12-18 | The Peter’s Custom Anti-Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missi… |
CVE-2024-12454 | Medium | 6.1 | 2024-12-18 | The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23… |
CVE-2024-12340 | Medium | 4.3 | 2024-12-18 | The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 're… |
CVE-2024-11614 | High | 7.4 | 2024-12-18 | An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash t… |
CVE-2024-54457 | High | 7.2 | 2024-12-18 | Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlie… |
CVE-2024-53688 | High | 7.2 | 2024-12-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in AE1021 firmware versions 2.0.10 and earlier and AE10… |
CVE-2024-47397 | High | 7.5 | 2024-12-18 | Weak authentication issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier. If this vulnerability is exp… |
CVE-2024-39703 | High | 8.8 | 2024-12-18 | In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafted request to an API endpoint. |
CVE-2024-1610 | Critical | 9.8 | 2024-12-18 | In OPPO Store APP, there's a possible escalation of privilege due to improper input validation. |
CVE-2024-12287 | Critical | 9.8 | 2024-12-18 | The Biagiotti Membership plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.0.2. This is due to the plugin not… |
CVE-2024-11295 | Medium | 5.3 | 2024-12-18 | The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.29 via the Wo… |
CVE-2024-56175 | Medium | 6.1 | 2024-12-18 | In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS… |
CVE-2024-56174 | High | 8.1 | 2024-12-18 | In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS… |
CVE-2024-56173 | Medium | 4.7 | 2024-12-18 | In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS… |
CVE-2024-4464 | High | 7.5 | 2024-12-18 | Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows… |
CVE-2024-21548 | High | 7.5 | 2024-12-18 | Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit th… |
CVE-2024-21547 | High | 7.5 | 2024-12-18 | Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check c… |
CVE-2024-21546 | Critical | 9.8 | 2024-12-18 | Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting th… |
CVE-2024-10892 | Medium | 5.4 | 2024-12-18 | The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users… |
CVE-2024-56170 | Medium | 5.3 | 2024-12-18 | A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients are supposed to veri… |