2024 CVEs (page 69)
Page 69 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-56169 | Medium | 5.3 | 2024-12-18 | A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintain a backup cache of… |
CVE-2024-12698 | Medium | 6.5 | 2024-12-18 | An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated stream… |
CVE-2024-12596 | Medium | 4.3 | 2024-12-18 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check… |
CVE-2024-12449 | Medium | 6.4 | 2024-12-18 | The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_player… |
CVE-2024-12432 | High | 8.1 | 2024-12-18 | The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including… |
CVE-2024-12259 | High | 8.8 | 2024-12-18 | The CRM WordPress Plugin – RepairBuddy plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3… |
CVE-2024-12250 | Medium | 5.3 | 2024-12-18 | The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via… |
CVE-2024-12061 | Medium | 4.3 | 2024-12-18 | The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via the naevents_elemento… |
CVE-2024-12025 | High | 7.5 | 2024-12-18 | The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST AP… |
CVE-2024-11254 | Medium | 6.1 | 2024-12-18 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqus_name parameter in all versions up… |
CVE-2024-47480 | High | 7.8 | 2024-12-18 | Dell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privilege attacker with… |
CVE-2024-12513 | Medium | 6.4 | 2024-12-18 | The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RF_CONTEST' shortcode in all versions up to, a… |
CVE-2024-12500 | Medium | 6.4 | 2024-12-18 | The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in a… |
CVE-2024-11881 | Medium | 6.4 | 2024-12-18 | The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easywaveformplayer' shortcode in all versions up t… |
CVE-2024-11748 | Medium | 6.4 | 2024-12-18 | The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'taeggie-feed' shortcode in all versions up to, and includi… |
CVE-2024-11439 | Medium | 6.4 | 2024-12-18 | The ScanCircle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'scancircle' shortcode in all versions up to, and including… |
CVE-2024-9779 | High | 7.5 | 2024-12-17 | A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The c… |
CVE-2024-10973 | Medium | 5.7 | 2024-12-17 | A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is alway… |
CVE-2024-56142 | Medium | 6.5 | 2024-12-17 | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. A vulnerability has been discovered that could allow… |
CVE-2024-52792 | Medium | 6.5 | 2024-12-17 | LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affected versions LAM… |
CVE-2024-51175 | High | 7.5 | 2024-12-17 | An issue in H3C switch h3c-S1526 allows a remote attacker to obtain sensitive information via the S1526.cfg component. |
CVE-2024-31668 | Critical | 9.1 | 2024-12-17 | rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis/meta. |
CVE-2024-29646 | Critical | 9.8 | 2024-12-17 | Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields. |
CVE-2024-55059 | Medium | 6.1 | 2024-12-17 | A stored HTML Injection vulnerability was identified in PHPGurukul Online Birth Certificate System v1.0 in /user/certificate-form.php. |
CVE-2024-55058 | Medium | 4.3 | 2024-12-17 | An insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0. This vulnerability resides in the v… |
CVE-2024-55057 | Medium | 5.4 | 2024-12-17 | Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts. |
CVE-2024-55056 | Medium | 5.4 | 2024-12-17 | A stored cross-site scripting (XSS) vulnerability was identified in Phpgurukul Online Birth Certificate System 1.0 in /user/certificate-form.php via the full n… |
CVE-2024-12539 | Medium | 6.5 | 2024-12-17 | An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security… |
CVE-2024-11993 | Medium | 6.1 | 2024-12-17 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers t… |
CVE-2024-55516 | Critical | 9.1 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 v3.90. The component affected by this issue is /upload_sysconfig.php on the web i… |
CVE-2024-55515 | Critical | 9.8 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_ipslib.php on the web inter… |
CVE-2024-55514 | Medium | 6.3 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_sfmig.php on the web interf… |
CVE-2024-55513 | Critical | 9.1 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_netaction.php on the web in… |
CVE-2024-49194 | High | 7.3 | 2024-12-17 | Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulne… |
CVE-2024-56139 | | 2024-12-17 | pdftools is a high level tools to convert PDF files to ePUB formats. In versions up to and including 0.5.0 maliciously crafted epub files can cause a stack ove… | |
CVE-2024-51479 | High | 7.5 | 2024-12-17 | Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware… |
CVE-2024-55496 | Critical | 9.1 | 2024-12-17 | A vulnerability has been found in the 1000projects Bookstore Management System PHP MySQL Project 1.0. This issue affects some unknown functionality of add_comp… |
CVE-2024-54662 | Critical | 9.1 | 2024-12-17 | Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod. |
CVE-2024-49820 | Low | 3.7 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure t… |
CVE-2024-49819 | Medium | 4.1 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a commun… |
CVE-2024-49818 | Medium | 4.3 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information when a detailed techni… |
CVE-2024-49817 | Medium | 4.4 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores user credentials in configuration files which can be read by a local privileged… |
CVE-2024-49816 | Medium | 4.9 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores potentially sensitive information in log files that could be read by a local pr… |
CVE-2024-42194 | Low | 3.1 | 2024-12-17 | An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only account can possibly ch… |
CVE-2024-53144 | High | 8.8 | 2024-12-17 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE This aligned BR/EDR JUST_WOR… |
CVE-2024-12671 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12670 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can lever… |
CVE-2024-12669 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can lever… |
CVE-2024-12200 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12199 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12198 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12197 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12194 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vuln… |
CVE-2024-12193 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12192 | High | 7.8 | 2024-12-17 | A maliciously crafted DWF file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vu… |
CVE-2024-12191 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this v… |
CVE-2024-12179 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can lever… |
CVE-2024-12178 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vuln… |
CVE-2024-11422 | High | 7.8 | 2024-12-17 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this v… |
CVE-2024-10476 | High | 8.0 | 2024-12-17 | Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, in… |
CVE-2024-37607 | Medium | 6.5 | 2024-12-17 | A Buffer overflow vulnerability in D-Link DAP-2555 REVA_FIRMWARE_1.20 allows remote attackers to cause a Denial of Service (DoS) via a crafted HTTP request. |
CVE-2024-37606 | Medium | 6.5 | 2024-12-17 | A Stack overflow vulnerability in D-Link DCS-932L REVB_FIRMWARE_2.18.01 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. |
CVE-2024-37605 | Medium | 6.5 | 2024-12-17 | A NULL pointer dereference in D-Link DIR-860L REVB_FIRMWARE_2.04.B04_ic5b allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. |
CVE-2024-36832 | High | 7.5 | 2024-12-17 | A NULL pointer dereference in D-Link DAP-1513 REVA_FIRMWARE_1.01 allows attackers to cause a Denial of Service (DoS) via a crafted web request without authenti… |
CVE-2024-36831 | Medium | 5.3 | 2024-12-17 | A NULL pointer dereference in the plugins_call_handle_uri_clean function of D-Link DAP-1520 REVA_FIRMWARE_1.10B04_BETA02_HOTFIX allows attackers to cause a Den… |
CVE-2024-8972 | Critical | 9.8 | 2024-12-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobil365 Informatics Saha365 App allows SQL Injection. T… |
CVE-2024-9819 | Medium | 6.5 | 2024-12-17 | Authorization Bypass Through User-Controlled Key vulnerability in NextGeography NG Analyser allows Functionality Misuse. This issue affects NG Analyser: befor… |
CVE-2024-54677 | Medium | 5.3 | 2024-12-17 | Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apa… |
CVE-2024-50379 | Critical | 9.8 | 2024-12-17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when th… |
CVE-2024-10356 | Medium | 4.3 | 2024-12-17 | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.8 in inc/… |
CVE-2024-9654 | Low | 3.7 | 2024-12-17 | The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient vali… |
CVE-2024-8475 | Medium | 6.5 | 2024-12-17 | Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables. This iss… |
CVE-2024-8429 | Medium | 4.3 | 2024-12-17 | Improper Restriction of Excessive Authentication Attempts vulnerability in Digital Operation Services WiFiBurada allows Use of Known Domain Credentials. This… |
CVE-2024-52542 | Medium | 4.4 | 2024-12-17 | Dell AppSync, version 4.6.0.x, contain a Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit… |
CVE-2024-12601 | Medium | 5.3 | 2024-12-17 | The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited heigh… |
CVE-2024-12395 | Medium | 6.1 | 2024-12-17 | The WooCommerce Additional Fees On Checkout (Free) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versi… |
CVE-2024-11280 | Medium | 5.3 | 2024-12-17 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.5 via the Word… |
CVE-2024-8326 | High | 8.8 | 2024-12-17 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensiti… |
CVE-2024-12469 | Medium | 6.1 | 2024-12-17 | The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘status’ parameter in all… |
CVE-2024-12127 | Medium | 6.1 | 2024-12-17 | The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Script… |
CVE-2024-12024 | High | 7.2 | 2024-12-17 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_category_data and em… |
CVE-2024-12293 | High | 8.8 | 2024-12-17 | The User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.64.3. This is due to missing or i… |
CVE-2024-11294 | Medium | 5.3 | 2024-12-17 | The Memberful plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.73.9 via the WordPress core search f… |
CVE-2024-12220 | Medium | 6.1 | 2024-12-17 | The SMS for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or… |
CVE-2024-12219 | Medium | 6.1 | 2024-12-17 | The Stop Registration Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23. This is due to missing… |
CVE-2024-11999 | High | 8.8 | 2024-12-17 | CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs m… |
CVE-2024-9624 | High | 7.6 | 2024-12-17 | The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protect… |
CVE-2024-54125 | Low | 3.3 | 2024-12-17 | Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker to lead a user to ac… |
CVE-2024-38499 | High | 8.8 | 2024-12-17 | CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access th… |
CVE-2024-55864 | Medium | 4.8 | 2024-12-17 | Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative user customizes the adm… |
CVE-2024-12356 | Critical | 9.8 | 2024-12-17 | A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to… |
CVE-2024-12239 | Medium | 6.1 | 2024-12-17 | The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the navigate parameter in all versions up to, an… |
CVE-2024-10205 | Critical | 9.4 | 2024-12-17 | Authentication Bypass vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hitachi Infrastructure… |
CVE-2024-11906 | Medium | 6.4 | 2024-12-17 | The TPG Get Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpg_get_posts' shortcode in all versions up to, and inclu… |
CVE-2024-11905 | Medium | 6.4 | 2024-12-17 | The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animatedcounte' shortcode in all versions up to, and… |
CVE-2024-11902 | Medium | 6.4 | 2024-12-17 | The Slope Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slope-reservations' shortcode in all versions up to, and… |
CVE-2024-11900 | Medium | 6.4 | 2024-12-17 | The Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'port… |
CVE-2024-56017 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Tom Royal Stop Registration Spam allows Stored XSS.This issue affects Stop Registration Spam: from n/a throu… |
CVE-2024-55452 | Medium | 5.4 | 2024-12-16 | A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulner… |
CVE-2024-55451 | Medium | 4.8 | 2024-12-16 | A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises fr… |