2024 CVEs (page 68)
Page 68 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12331 | Medium | 4.3 | 2024-12-19 | The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_install_… |
CVE-2024-11616 | | 2024-12-19 | Netskope was made aware of a security vulnerability in Netskope Endpoint DLP’s Content Control Driver where a double-fetch issue leads to heap overflow. The vu… | |
CVE-2024-12569 | High | 7.8 | 2024-12-19 | Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras, allows an attacker to read camera credential… |
CVE-2024-4230 | High | 7.8 | 2024-12-19 | External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers… |
CVE-2024-4229 | High | 7.8 | 2024-12-19 | Incorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers version… |
CVE-2024-12560 | Medium | 4.3 | 2024-12-19 | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… |
CVE-2024-11768 | Medium | 5.3 | 2024-12-19 | The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the check… |
CVE-2024-11740 | High | 7.3 | 2024-12-19 | The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the s… |
CVE-2024-11984 | High | 8.8 | 2024-12-19 | A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote aut… |
CVE-2024-51532 | High | 7.1 | 2024-12-19 | Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with lo… |
CVE-2024-35141 | High | 7.8 | 2024-12-19 | IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges. |
CVE-2024-12121 | Medium | 5.4 | 2024-12-19 | The Broken Link Checker | Finder plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the 'm… |
CVE-2024-10548 | Medium | 6.5 | 2024-12-19 | The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via the Project Task L… |
CVE-2024-55603 | Medium | 6.5 | 2024-12-19 | Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has e… |
CVE-2024-56319 | High | 7.5 | 2024-12-18 | In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before e3277eb, unlimited user label appends in a userlabel cluster can lead to a denial of ser… |
CVE-2024-56318 | High | 7.5 | 2024-12-18 | In raw\TCP.cpp in Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before 27ca6ec, there is a NULL pointer dereference in TCPBase::ProcessSingleMes… |
CVE-2024-56317 | High | 7.5 | 2024-12-18 | In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0, the WriteAcl function deletes all existing ACL entries first, and then attempts to recreate th… |
CVE-2024-56116 | High | 8.8 | 2024-12-18 | A Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to create an administrator account. |
CVE-2024-56115 | Medium | 6.1 | 2024-12-18 | A vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to neutralize special elements. It allows remote attackers to conduct a Cr… |
CVE-2024-55506 | High | 8.8 | 2024-12-18 | An IDOR vulnerability in CodeAstro's Complaint Management System v1.0 (version with 0 updates) enables an attacker to execute arbitrary code and obtain sensiti… |
CVE-2024-55461 | Critical | 9.8 | 2024-12-18 | SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext(). |
CVE-2024-55239 | Medium | 5.4 | 2024-12-18 | A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious… |
CVE-2024-53580 | High | 7.5 | 2024-12-18 | iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function. |
CVE-2024-43106 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft Excel 16.83 for macOS. A specially crafted library can leverage Excel's access privileges, leading to a p… |
CVE-2024-42220 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. A specially crafted library can leverage Outlook's access privileges, leading… |
CVE-2024-42004 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's a… |
CVE-2024-41165 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft Word 16.83 for macOS. A specially crafted library can leverage Word's access privileges, leading to a per… |
CVE-2024-41159 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS. A specially crafted library can leverage OneNote's access privileges, leading to… |
CVE-2024-41145 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted… |
CVE-2024-41138 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for mac… |
CVE-2024-39804 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft PowerPoint 16.83 for macOS. A specially crafted library can leverage PowerPoint's access privileges, lead… |
CVE-2024-37649 | Medium | 4.6 | 2024-12-18 | Insecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before allows a physically proximate attacker to obtain sensitive infor… |
CVE-2024-55505 | High | 8.8 | 2024-12-18 | An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the mess-view.php component. |
CVE-2024-55232 | Medium | 5.4 | 2024-12-18 | An IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to delete notes belong… |
CVE-2024-55231 | Medium | 4.3 | 2024-12-18 | An IDOR vulnerability in the edit-notes.php module of PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to modify notes belongin… |
CVE-2024-12695 | High | 8.8 | 2024-12-18 | Out of bounds write in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2024-12694 | High | 8.8 | 2024-12-18 | Use after free in Compositing in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2024-12693 | High | 8.8 | 2024-12-18 | Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2024-12692 | High | 8.8 | 2024-12-18 | Type Confusion in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2024-56145 | Critical | 9.8 | 2024-12-18 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerabi… |
CVE-2024-56140 | Medium | 5.9 | 2024-12-18 | Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. W… |
CVE-2024-45338 | Medium | 5.3 | 2024-12-18 | An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. Thi… |
CVE-2024-12686 | Medium | 6.6 | 2024-12-18 | A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileg… |
CVE-2024-53271 | High | 7.1 | 2024-12-18 | Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This c… |
CVE-2024-53270 | High | 7.5 | 2024-12-18 | Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active request exists when… |
CVE-2024-53269 | Medium | 4.5 | 2024-12-18 | Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm wil… |
CVE-2024-52593 | Medium | 5.3 | 2024-12-18 | Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPe… |
CVE-2024-52592 | Medium | 5.3 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an attacker to modify the… |
CVE-2024-52591 | Critical | 9.3 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.get… |
CVE-2024-52590 | Medium | 6.5 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows an attacker to creat… |
CVE-2024-52579 | Medium | 6.4 | 2024-12-18 | Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allo… |
CVE-2024-51470 | Medium | 6.5 | 2024-12-18 | IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could a… |
CVE-2024-49363 | High | 7.4 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in github.com/misskey-dev/misskey 2024.10.1 or… |
CVE-2024-36694 | High | 7.2 | 2024-12-18 | OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function. |
CVE-2024-12741 | High | 7.8 | 2024-12-18 | A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacke… |
CVE-2024-56057 | Critical | 9.9 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56055 | High | 8.5 | 2024-12-18 | Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2. |
CVE-2024-56054 | Critical | 9.1 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56053 | High | 7.6 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This i… |
CVE-2024-56052 | Critical | 9.9 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56051 | High | 8.5 | 2024-12-18 | Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Code Injection.This issue affects WPLMS: from n… |
CVE-2024-56050 | Critical | 9.9 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56049 | High | 8.5 | 2024-12-18 | Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2. |
CVE-2024-56048 | High | 8.8 | 2024-12-18 | Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS… |
CVE-2024-56047 | High | 8.5 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This i… |
CVE-2024-55953 | High | 8.1 | 2024-12-18 | DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When c… |
CVE-2024-55952 | High | 8.8 | 2024-12-18 | DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jd… |
CVE-2024-54383 | Critical | 9.8 | 2024-12-18 | Incorrect Privilege Assignment vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Privilege Escalation.This issue affects WooComme… |
CVE-2024-54381 | High | 7.1 | 2024-12-18 | Missing Authorization vulnerability in Dotstore Advance Menu Manager advance-menu-manager.This issue affects Advance Menu Manager: from n/a through <= 3.1.1. |
CVE-2024-49202 | High | 7.6 | 2024-12-18 | Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3… |
CVE-2024-49201 | Medium | 4.3 | 2024-12-18 | Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the… |
CVE-2024-47040 | High | 7.8 | 2024-12-18 | There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User… |
CVE-2024-47039 | Medium | 5.5 | 2024-12-18 | In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information discl… |
CVE-2024-47038 | High | 7.8 | 2024-12-18 | In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead to localcescalation… |
CVE-2024-55089 | Medium | 4.1 | 2024-12-18 | Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external enti… |
CVE-2024-55088 | High | 8.8 | 2024-12-18 | GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module. |
CVE-2024-55492 | Medium | 6.1 | 2024-12-18 | Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS). |
CVE-2024-55086 | High | 7.2 | 2024-12-18 | In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management sy… |
CVE-2024-45082 | Medium | 6.8 | 2024-12-18 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack… |
CVE-2024-41752 | Medium | 5.4 | 2024-12-18 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which… |
CVE-2024-25042 | Medium | 5.4 | 2024-12-18 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is potentially vulnerable to Cross Site Scripting (XSS). A remote attacker could execu… |
CVE-2024-52361 | Medium | 5.7 | 2024-12-18 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 stores user credentials in plain text which can be read by an authenticated user with access… |
CVE-2024-49576 | High | 8.8 | 2024-12-18 | A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. A specially crafted Javascript code inside a… |
CVE-2024-47810 | High | 8.8 | 2024-12-18 | A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. A specially crafted Javascript code inside a malicious P… |
CVE-2024-47119 | Medium | 5.9 | 2024-12-18 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity… |
CVE-2024-12373 | | 2024-12-18 | A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a buffer-overflow, potentially causing den… | |
CVE-2024-12372 | | 2024-12-18 | A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corrupt… | |
CVE-2024-12371 | | 2024-12-18 | A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user withou… | |
CVE-2024-56128 | Medium | 5.3 | 2024-12-18 | Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challe… |
CVE-2024-50570 | Medium | 5.0 | 2024-12-18 | A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and F… |
CVE-2024-48889 | High | 7.2 | 2024-12-18 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiManager version 7.6.0, version 7.4… |
CVE-2024-56059 | Critical | 9.8 | 2024-12-18 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection… |
CVE-2024-56058 | Critical | 9.8 | 2024-12-18 | Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a… |
CVE-2024-56016 | High | 7.1 | 2024-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maartenhemmes Image Mapper image-mapper allows Reflected… |
CVE-2024-56010 | High | 7.1 | 2024-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Device Detector device-detector allows Refl… |
CVE-2024-56008 | High | 7.5 | 2024-12-18 | Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This… |
CVE-2024-55997 | Medium | 6.5 | 2024-12-18 | Missing Authorization vulnerability in webchunky Order Delivery & Pickup Location Date Time order-delivery-pickup-location-date-time-free-version allows Exploi… |
CVE-2024-55985 | High | 8.5 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ydesignservices YDS Support Ticket System yds-support-tic… |
CVE-2024-55984 | High | 8.5 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susheelhbti Saksh Escrow System saksh-escrow-system allow… |
CVE-2024-55983 | High | 8.5 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PowerFormBuilder PowerFormBuilder power-forms-builder all… |