2024 CVEs (page 69)
Page 69 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55975 | High | 8.5 | 2024-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rohit Urane Dr Affiliate dr-affiliate allows SQL Injectio… |
CVE-2024-54350 | High | 7.1 | 2024-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hjyl hmd hmd allows Stored XSS.This issue affects hmd: fr… |
CVE-2024-54270 | High | 8.1 | 2024-12-18 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axeptio Axeptio axeptio-sdk-integratio… |
CVE-2024-52485 | Medium | 6.5 | 2024-12-18 | Missing Authorization vulnerability in Yudiz Solutions Ltd. WP Menu Image wp-menu-image allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-51646 | High | 7.1 | 2024-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saoshyant1994 Saoshyant Element saoshyant-element allows… |
CVE-2024-4996 | Critical | 9.8 | 2024-12-18 | Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data… |
CVE-2024-4995 | Critical | 9.8 | 2024-12-18 | Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data int… |
CVE-2024-49677 | High | 7.1 | 2024-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Cramer Bootstrap Buttons bootstrap-buttons allows R… |
CVE-2024-11926 | Medium | 6.5 | 2024-12-18 | The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '__stPartner… |
CVE-2024-11912 | High | 7.5 | 2024-12-18 | The Travel Booking WordPress Theme theme for WordPress is vulnerable to blind time-based SQL Injection via the ‘order_id’ parameter in all versions up to, and… |
CVE-2024-11291 | Medium | 5.3 | 2024-12-18 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Informatio… |
CVE-2024-47104 | Medium | 6.8 | 2024-12-18 | IBM i 7.4 and 7.5 is vulnerable to an authenticated user gaining elevated privilege to a physical file. A user with authority to a view can alter the based-on… |
CVE-2024-12554 | Medium | 5.4 | 2024-12-18 | The Peter’s Custom Anti-Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missi… |
CVE-2024-12454 | Medium | 6.1 | 2024-12-18 | The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23… |
CVE-2024-12340 | Medium | 4.3 | 2024-12-18 | The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 're… |
CVE-2024-11614 | High | 7.4 | 2024-12-18 | An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash t… |
CVE-2024-54457 | High | 7.2 | 2024-12-18 | Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlie… |
CVE-2024-53688 | High | 7.2 | 2024-12-18 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in AE1021 firmware versions 2.0.10 and earlier and AE10… |
CVE-2024-47397 | High | 7.5 | 2024-12-18 | Weak authentication issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier. If this vulnerability is exp… |
CVE-2024-39703 | High | 8.8 | 2024-12-18 | In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafted request to an API endpoint. |
CVE-2024-1610 | Critical | 9.8 | 2024-12-18 | In OPPO Store APP, there's a possible escalation of privilege due to improper input validation. |
CVE-2024-12287 | Critical | 9.8 | 2024-12-18 | The Biagiotti Membership plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.0.2. This is due to the plugin not… |
CVE-2024-11295 | Medium | 5.3 | 2024-12-18 | The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.29 via the Wo… |
CVE-2024-56175 | Medium | 6.1 | 2024-12-18 | In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS… |
CVE-2024-56174 | High | 8.1 | 2024-12-18 | In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS… |
CVE-2024-56173 | Medium | 4.7 | 2024-12-18 | In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS… |
CVE-2024-4464 | High | 7.5 | 2024-12-18 | Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows… |
CVE-2024-21548 | High | 7.5 | 2024-12-18 | Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit th… |
CVE-2024-21547 | High | 7.5 | 2024-12-18 | Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check c… |
CVE-2024-21546 | Critical | 9.8 | 2024-12-18 | Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting th… |
CVE-2024-10892 | Medium | 5.4 | 2024-12-18 | The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users… |
CVE-2024-56170 | Medium | 5.3 | 2024-12-18 | A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients are supposed to veri… |
CVE-2024-56169 | Medium | 5.3 | 2024-12-18 | A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintain a backup cache of… |
CVE-2024-12698 | Medium | 6.5 | 2024-12-18 | An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated stream… |
CVE-2024-12596 | Medium | 4.3 | 2024-12-18 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check… |
CVE-2024-12449 | Medium | 6.4 | 2024-12-18 | The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_player… |
CVE-2024-12432 | High | 8.1 | 2024-12-18 | The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including… |
CVE-2024-12259 | High | 8.8 | 2024-12-18 | The CRM WordPress Plugin – RepairBuddy plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3… |
CVE-2024-12250 | Medium | 5.3 | 2024-12-18 | The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via… |
CVE-2024-12061 | Medium | 4.3 | 2024-12-18 | The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via the naevents_elemento… |
CVE-2024-12025 | High | 7.5 | 2024-12-18 | The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST AP… |
CVE-2024-11254 | Medium | 6.1 | 2024-12-18 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqus_name parameter in all versions up… |
CVE-2024-47480 | High | 7.8 | 2024-12-18 | Dell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privilege attacker with… |
CVE-2024-12513 | Medium | 6.4 | 2024-12-18 | The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RF_CONTEST' shortcode in all versions up to, a… |
CVE-2024-12500 | Medium | 6.4 | 2024-12-18 | The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in a… |
CVE-2024-11881 | Medium | 6.4 | 2024-12-18 | The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easywaveformplayer' shortcode in all versions up t… |
CVE-2024-11748 | Medium | 6.4 | 2024-12-18 | The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'taeggie-feed' shortcode in all versions up to, and includi… |
CVE-2024-11439 | Medium | 6.4 | 2024-12-18 | The ScanCircle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'scancircle' shortcode in all versions up to, and including… |
CVE-2024-9779 | High | 7.5 | 2024-12-17 | A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The c… |
CVE-2024-10973 | Medium | 5.7 | 2024-12-17 | A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is alway… |
CVE-2024-56142 | Medium | 6.5 | 2024-12-17 | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. A vulnerability has been discovered that could allow… |
CVE-2024-52792 | Medium | 6.5 | 2024-12-17 | LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affected versions LAM… |
CVE-2024-51175 | High | 7.5 | 2024-12-17 | An issue in H3C switch h3c-S1526 allows a remote attacker to obtain sensitive information via the S1526.cfg component. |
CVE-2024-31668 | Critical | 9.1 | 2024-12-17 | rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis/meta. |
CVE-2024-29646 | Critical | 9.8 | 2024-12-17 | Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields. |
CVE-2024-55059 | Medium | 6.1 | 2024-12-17 | A stored HTML Injection vulnerability was identified in PHPGurukul Online Birth Certificate System v1.0 in /user/certificate-form.php. |
CVE-2024-55058 | Medium | 4.3 | 2024-12-17 | An insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0. This vulnerability resides in the v… |
CVE-2024-55057 | Medium | 5.4 | 2024-12-17 | Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts. |
CVE-2024-55056 | Medium | 5.4 | 2024-12-17 | A stored cross-site scripting (XSS) vulnerability was identified in Phpgurukul Online Birth Certificate System 1.0 in /user/certificate-form.php via the full n… |
CVE-2024-12539 | Medium | 6.5 | 2024-12-17 | An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security… |
CVE-2024-11993 | Medium | 6.1 | 2024-12-17 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers t… |
CVE-2024-55516 | Critical | 9.1 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 v3.90. The component affected by this issue is /upload_sysconfig.php on the web i… |
CVE-2024-55515 | Critical | 9.8 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_ipslib.php on the web inter… |
CVE-2024-55514 | Medium | 6.3 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_sfmig.php on the web interf… |
CVE-2024-55513 | Critical | 9.1 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_netaction.php on the web in… |
CVE-2024-49194 | High | 7.3 | 2024-12-17 | Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulne… |
CVE-2024-56139 | | 2024-12-17 | pdftools is a high level tools to convert PDF files to ePUB formats. In versions up to and including 0.5.0 maliciously crafted epub files can cause a stack ove… | |
CVE-2024-51479 | High | 7.5 | 2024-12-17 | Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware… |
CVE-2024-55496 | Critical | 9.1 | 2024-12-17 | A vulnerability has been found in the 1000projects Bookstore Management System PHP MySQL Project 1.0. This issue affects some unknown functionality of add_comp… |
CVE-2024-54662 | Critical | 9.1 | 2024-12-17 | Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod. |
CVE-2024-49820 | Low | 3.7 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure t… |
CVE-2024-49819 | Medium | 4.1 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a commun… |
CVE-2024-49818 | Medium | 4.3 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information when a detailed techni… |
CVE-2024-49817 | Medium | 4.4 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores user credentials in configuration files which can be read by a local privileged… |
CVE-2024-49816 | Medium | 4.9 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores potentially sensitive information in log files that could be read by a local pr… |
CVE-2024-42194 | Low | 3.1 | 2024-12-17 | An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only account can possibly ch… |
CVE-2024-53144 | High | 8.8 | 2024-12-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE This aligned BR/EDR JUST_WOR… |
CVE-2024-12671 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12670 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can lever… |
CVE-2024-12669 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can lever… |
CVE-2024-12200 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12199 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12198 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12197 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12194 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vuln… |
CVE-2024-12193 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12192 | High | 7.8 | 2024-12-17 | A maliciously crafted DWF file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vu… |
CVE-2024-12191 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12179 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can lever… |
CVE-2024-12178 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vuln… |
CVE-2024-11422 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this v… |
CVE-2024-10476 | High | 8.0 | 2024-12-17 | Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, in… |
CVE-2024-37607 | Medium | 6.5 | 2024-12-17 | A Buffer overflow vulnerability in D-Link DAP-2555 REVA_FIRMWARE_1.20 allows remote attackers to cause a Denial of Service (DoS) via a crafted HTTP request. |
CVE-2024-37606 | Medium | 6.5 | 2024-12-17 | A Stack overflow vulnerability in D-Link DCS-932L REVB_FIRMWARE_2.18.01 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. |
CVE-2024-37605 | Medium | 6.5 | 2024-12-17 | A NULL pointer dereference in D-Link DIR-860L REVB_FIRMWARE_2.04.B04_ic5b allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. |
CVE-2024-36832 | High | 7.5 | 2024-12-17 | A NULL pointer dereference in D-Link DAP-1513 REVA_FIRMWARE_1.01 allows attackers to cause a Denial of Service (DoS) via a crafted web request without authenti… |
CVE-2024-36831 | Medium | 5.3 | 2024-12-17 | A NULL pointer dereference in the plugins_call_handle_uri_clean function of D-Link DAP-1520 REVA_FIRMWARE_1.10B04_BETA02_HOTFIX allows attackers to cause a Den… |
CVE-2024-8972 | Critical | 9.8 | 2024-12-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobil365 Informatics Saha365 App allows SQL Injection. T… |
CVE-2024-9819 | Medium | 6.5 | 2024-12-17 | Authorization Bypass Through User-Controlled Key vulnerability in NextGeography NG Analyser allows Functionality Misuse. This issue affects NG Analyser: befor… |
CVE-2024-54677 | Medium | 5.3 | 2024-12-17 | Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apa… |