2024 CVEs (page 70)
Page 70 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50379 | Critical | 9.8 | 2024-12-17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when th… |
CVE-2024-10356 | Medium | 4.3 | 2024-12-17 | The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.8 in inc/… |
CVE-2024-9654 | Low | 3.7 | 2024-12-17 | The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient vali… |
CVE-2024-8475 | Medium | 6.5 | 2024-12-17 | Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables. This iss… |
CVE-2024-8429 | Medium | 4.3 | 2024-12-17 | Improper Restriction of Excessive Authentication Attempts vulnerability in Digital Operation Services WiFiBurada allows Use of Known Domain Credentials. This… |
CVE-2024-52542 | Medium | 4.4 | 2024-12-17 | Dell AppSync, version 4.6.0.x, contain a Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit… |
CVE-2024-12601 | Medium | 5.3 | 2024-12-17 | The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited heigh… |
CVE-2024-12395 | Medium | 6.1 | 2024-12-17 | The WooCommerce Additional Fees On Checkout (Free) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versi… |
CVE-2024-11280 | Medium | 5.3 | 2024-12-17 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.5 via the Word… |
CVE-2024-8326 | High | 8.8 | 2024-12-17 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensiti… |
CVE-2024-12469 | Medium | 6.1 | 2024-12-17 | The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘status’ parameter in all… |
CVE-2024-12127 | Medium | 6.1 | 2024-12-17 | The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Script… |
CVE-2024-12024 | High | 7.2 | 2024-12-17 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_category_data and em… |
CVE-2024-12293 | High | 8.8 | 2024-12-17 | The User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.64.3. This is due to missing or i… |
CVE-2024-11294 | Medium | 5.3 | 2024-12-17 | The Memberful plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.73.9 via the WordPress core search f… |
CVE-2024-12220 | Medium | 6.1 | 2024-12-17 | The SMS for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or… |
CVE-2024-12219 | Medium | 6.1 | 2024-12-17 | The Stop Registration Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23. This is due to missing… |
CVE-2024-11999 | High | 8.8 | 2024-12-17 | CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs m… |
CVE-2024-9624 | High | 7.6 | 2024-12-17 | The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protect… |
CVE-2024-54125 | Low | 3.3 | 2024-12-17 | Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker to lead a user to ac… |
CVE-2024-38499 | High | 8.8 | 2024-12-17 | CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access th… |
CVE-2024-55864 | Medium | 4.8 | 2024-12-17 | Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative user customizes the adm… |
CVE-2024-12356 | Critical | 9.8 | 2024-12-17 | A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to… |
CVE-2024-12239 | Medium | 6.1 | 2024-12-17 | The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the navigate parameter in all versions up to, an… |
CVE-2024-10205 | Critical | 9.4 | 2024-12-17 | Authentication Bypass vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hitachi Infrastructure… |
CVE-2024-11906 | Medium | 6.4 | 2024-12-17 | The TPG Get Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpg_get_posts' shortcode in all versions up to, and inclu… |
CVE-2024-11905 | Medium | 6.4 | 2024-12-17 | The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animatedcounte' shortcode in all versions up to, and… |
CVE-2024-11902 | Medium | 6.4 | 2024-12-17 | The Slope Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slope-reservations' shortcode in all versions up to, and… |
CVE-2024-11900 | Medium | 6.4 | 2024-12-17 | The Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'port… |
CVE-2024-56017 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Tom Royal Stop Registration Spam allows Stored XSS.This issue affects Stop Registration Spam: from n/a throu… |
CVE-2024-55452 | Medium | 5.4 | 2024-12-16 | A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulner… |
CVE-2024-55451 | Medium | 4.8 | 2024-12-16 | A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises fr… |
CVE-2024-55085 | Critical | 9.8 | 2024-12-16 | GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an att… |
CVE-2024-35230 | Medium | 5.3 | 2024-12-16 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about pag… |
CVE-2024-12443 | Medium | 6.4 | 2024-12-16 | The CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin… |
CVE-2024-55554 | Medium | 5.4 | 2024-12-16 | Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet. |
CVE-2024-52949 | High | 7.5 | 2024-12-16 | iptraf-ng 1.2.1 has a stack-based buffer overflow. In src/ifaces.c, the strcpy function consistently fails to control the size, and it is consequently possible… |
CVE-2024-37776 | Medium | 4.8 | 2024-12-16 | A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in so… |
CVE-2024-37775 | High | 7.5 | 2024-12-16 | Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC check. |
CVE-2024-37774 | High | 8.0 | 2024-12-16 | A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an Administrator user… |
CVE-2024-37773 | Medium | 4.8 | 2024-12-16 | An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to inject arbitrary HTML code in an admin screen. |
CVE-2024-29671 | Critical | 9.8 | 2024-12-16 | Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component. |
CVE-2024-55557 | Critical | 9.8 | 2024-12-16 | ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials. |
CVE-2024-55104 | High | 7.2 | 2024-12-16 | Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and email… |
CVE-2024-55103 | High | 7.2 | 2024-12-16 | Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname parameter. |
CVE-2024-55100 | Medium | 4.8 | 2024-12-16 | A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to execute arbitrary… |
CVE-2024-55951 | | 2024-12-16 | Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field fi… | |
CVE-2024-55949 | | 2024-12-16 | MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, a… | |
CVE-2024-12687 | Critical | 9.8 | 2024-12-16 | Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. This issue affects Ple… |
CVE-2024-12667 | Low | 3.7 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices… |
CVE-2024-12666 | Medium | 4.7 | 2024-12-16 | A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?… |
CVE-2024-12665 | Low | 3.5 | 2024-12-16 | A vulnerability, which was classified as problematic, was found in ruifang-tech Rebuild 3.8.5. Affected is an unknown function of the component Task Comment At… |
CVE-2024-12664 | Low | 3.5 | 2024-12-16 | A vulnerability, which was classified as problematic, has been found in ruifang-tech Rebuild 3.8.5. This issue affects some unknown processing of the component… |
CVE-2024-12663 | Low | 3.7 | 2024-12-16 | A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the comp… |
CVE-2024-12662 | Medium | 5.5 | 2024-12-16 | A vulnerability classified as problematic has been found in IObit Advanced SystemCare Utimate up to 17.0.0. This affects the function 0x8001E040 in the library… |
CVE-2024-12661 | Medium | 5.5 | 2024-12-16 | A vulnerability was found in IObit Advanced SystemCare Utimate up to 17.0.0. It has been rated as problematic. Affected by this issue is the function 0x8001E02… |
CVE-2024-12660 | Medium | 5.5 | 2024-12-16 | A vulnerability was found in IObit Advanced SystemCare Utimate up to 17.0.0. It has been declared as problematic. Affected by this vulnerability is the functio… |
CVE-2024-12659 | Medium | 5.5 | 2024-12-16 | A vulnerability was found in IObit Advanced SystemCare Utimate up to 17.0.0. It has been classified as problematic. Affected is the function 0x8001E004 in the… |
CVE-2024-12658 | Medium | 5.5 | 2024-12-16 | A vulnerability was found in IObit Advanced SystemCare Utimate up to 17.0.0 and classified as problematic. This issue affects the function 0x8001E01C in the li… |
CVE-2024-8058 | High | 7.6 | 2024-12-16 | An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary files on the device… |
CVE-2024-6001 | High | 8.1 | 2024-12-16 | An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an update request to a r… |
CVE-2024-4762 | High | 7.8 | 2024-12-16 | An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to escalate privileges. |
CVE-2024-12657 | Medium | 5.5 | 2024-12-16 | A vulnerability has been found in IObit Advanced SystemCare Utimate up to 17.0.0 and classified as problematic. This vulnerability affects the function 0x8001E… |
CVE-2024-12656 | Medium | 5.5 | 2024-12-16 | A vulnerability, which was classified as problematic, was found in FabulaTech USB over Network 6.0.6.1. This affects the function 0x220448 in the library ftusb… |
CVE-2024-12655 | Medium | 5.5 | 2024-12-16 | A vulnerability, which was classified as problematic, has been found in FabulaTech USB over Network 6.0.6.1. Affected by this issue is the function 0x220420 in… |
CVE-2024-11358 | Medium | 5.7 | 2024-12-16 | Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an attacker with local access to access files via file… |
CVE-2024-11144 | High | 7.5 | 2024-12-16 | The server lacks thread safety and can be crashed by anomalous data sent by an anonymous user from a remote network. The crash causes the FTP service to become… |
CVE-2024-10095 | High | 8.4 | 2024-12-16 | In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-56003 | Medium | 4.3 | 2024-12-16 | Missing Authorization vulnerability in David Cramer Caldera SMTP Mailer caldera-smtp-mailer.This issue affects Caldera SMTP Mailer: from n/a through <= 1.0.1. |
CVE-2024-55999 | Medium | 5.3 | 2024-12-16 | Missing Authorization vulnerability in Marco Giannini XML Multilanguage Sitemap Generator xml-multilanguage-sitemap-generator.This issue affects XML Multilangu… |
CVE-2024-54376 | High | 7.5 | 2024-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Spider Themes EazyDocs eazydocs allows… |
CVE-2024-54357 | Medium | 4.3 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10. |
CVE-2024-54348 | Medium | 6.5 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yaycommerce Brand brand allows Stored XSS.This issue affe… |
CVE-2024-54285 | Critical | 9.1 | 2024-12-16 | Unrestricted Upload of File with Dangerous Type vulnerability in SeedProd LLC SeedProd Pro allows Upload a Web Shell to a Web Server.This issue affects SeedPro… |
CVE-2024-54284 | High | 7.6 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue… |
CVE-2024-54283 | High | 7.6 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue… |
CVE-2024-54280 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This… |
CVE-2024-54279 | High | 7.5 | 2024-12-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tobias Keller WP-NERD Toolkit wp-nerd-toolkit.This issue affects WP… |
CVE-2024-54257 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Molefed allows Reflected XSS.This issue affects tydskrif… |
CVE-2024-54249 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Advanced Options Editor allows Reflected XSS… |
CVE-2024-54229 | Critical | 9.8 | 2024-12-16 | Incorrect Privilege Assignment vulnerability in straightvisions GmbH SV100 Companion sv100-companion allows Privilege Escalation.This issue affects SV100 Compa… |
CVE-2024-43234 | Critical | 9.8 | 2024-12-16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: fr… |
CVE-2024-12654 | Medium | 5.5 | 2024-12-16 | A vulnerability classified as problematic was found in FabulaTech USB over Network 6.0.6.1. Affected by this vulnerability is the function 0x220408 in the libr… |
CVE-2024-12653 | Medium | 5.5 | 2024-12-16 | A vulnerability classified as problematic has been found in FabulaTech USB over Network 6.0.6.1. Affected is the function 0x22040C in the library ftusbbus2.sys… |
CVE-2024-56015 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in John Godley Tidy Up allows Reflected XSS.This issue affects Tidy Up: from n/a through 1.3. |
CVE-2024-56013 | High | 8.8 | 2024-12-16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in wovax Wovax IDX wovax-idx allows Authentication Bypass.This issue affects Wovax IDX… |
CVE-2024-56012 | Critical | 9.8 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Flash News / Post (Responsive) flashnews-fading-effect-pearlbells allows Privilege Escalation.This i… |
CVE-2024-56011 | Medium | 6.5 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ilja Zaglov Responsive Google Maps | by imbaa responsive-… |
CVE-2024-56009 | Medium | 5.3 | 2024-12-16 | Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This… |
CVE-2024-56007 | Medium | 4.3 | 2024-12-16 | Missing Authorization vulnerability in leader codes Leader leader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Le… |
CVE-2024-56005 | Medium | 6.5 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Posti Posti Shipping posti-shipping allows Cross Site Request Forgery.This issue affects Posti Shipping: fro… |
CVE-2024-56004 | Medium | 5.4 | 2024-12-16 | Missing Authorization vulnerability in awfowler Easy Site Importer easy-site-importer allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2024-56001 | Medium | 6.5 | 2024-12-16 | Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2024-55998 | Medium | 5.4 | 2024-12-16 | Missing Authorization vulnerability in Eric Sloan Popup Surveys & Polls for WordPress (Mare.io) popup-surveys allows Exploiting Incorrectly Configured Access C… |
CVE-2024-55996 | Medium | 6.1 | 2024-12-16 | Missing Authorization vulnerability in dreamfox Dreamfox Media Payment gateway per Product for Woocommerce woocommerce-product-payments allows Exploiting Incor… |
CVE-2024-55994 | Medium | 4.3 | 2024-12-16 | Missing Authorization vulnerability in sohu 畅言评论系统 changyan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 畅言评论系统… |
CVE-2024-55993 | Medium | 5.3 | 2024-12-16 | Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-55992 | Medium | 5.4 | 2024-12-16 | Missing Authorization vulnerability in Open Tools WooCommerce Basic Ordernumbers woocommerce-basic-ordernumbers allows Exploiting Incorrectly Configured Access… |
CVE-2024-55990 | High | 7.6 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tsjippy Mollie for Contact Form 7 cf7-mollie allows Blind… |
CVE-2024-55989 | High | 7.6 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kyle M Brown WP Simple Pay Lite Manager stripe-manager al… |