2024 CVEs (page 70)
Page 70 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55085 | Critical | 9.8 | 2024-12-16 | GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an att… |
CVE-2024-35230 | Medium | 5.3 | 2024-12-16 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about pag… |
CVE-2024-12443 | Medium | 6.4 | 2024-12-16 | The CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin… |
CVE-2024-55554 | Medium | 5.4 | 2024-12-16 | Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet. |
CVE-2024-52949 | High | 7.5 | 2024-12-16 | iptraf-ng 1.2.1 has a stack-based buffer overflow. In src/ifaces.c, the strcpy function consistently fails to control the size, and it is consequently possible… |
CVE-2024-37776 | Medium | 4.8 | 2024-12-16 | A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in so… |
CVE-2024-37775 | High | 7.5 | 2024-12-16 | Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC check. |
CVE-2024-37774 | High | 8.0 | 2024-12-16 | A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an Administrator user… |
CVE-2024-37773 | Medium | 4.8 | 2024-12-16 | An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to inject arbitrary HTML code in an admin screen. |
CVE-2024-29671 | Critical | 9.8 | 2024-12-16 | Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component. |
CVE-2024-55557 | Critical | 9.8 | 2024-12-16 | ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials. |
CVE-2024-55104 | High | 7.2 | 2024-12-16 | Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and email… |
CVE-2024-55103 | High | 7.2 | 2024-12-16 | Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname parameter. |
CVE-2024-55100 | Medium | 4.8 | 2024-12-16 | A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to execute arbitrary… |
CVE-2024-55951 | | 2024-12-16 | Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field fi… | |
CVE-2024-55949 | | 2024-12-16 | MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, a… | |
CVE-2024-12687 | Critical | 9.8 | 2024-12-16 | Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. This issue affects Ple… |
CVE-2024-12667 | Low | 3.7 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices… |
CVE-2024-12666 | Medium | 4.7 | 2024-12-16 | A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?… |
CVE-2024-12665 | Low | 3.5 | 2024-12-16 | A vulnerability, which was classified as problematic, was found in ruifang-tech Rebuild 3.8.5. Affected is an unknown function of the component Task Comment At… |
CVE-2024-12664 | Low | 3.5 | 2024-12-16 | A vulnerability, which was classified as problematic, has been found in ruifang-tech Rebuild 3.8.5. This issue affects some unknown processing of the component… |
CVE-2024-12663 | Low | 3.7 | 2024-12-16 | A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the comp… |
CVE-2024-12662 | Medium | 5.5 | 2024-12-16 | A vulnerability classified as problematic has been found in IObit Advanced SystemCare Utimate up to 17.0.0. This affects the function 0x8001E040 in the library… |
CVE-2024-12661 | Medium | 5.5 | 2024-12-16 | A vulnerability was found in IObit Advanced SystemCare Utimate up to 17.0.0. It has been rated as problematic. Affected by this issue is the function 0x8001E02… |
CVE-2024-12660 | Medium | 5.5 | 2024-12-16 | A vulnerability was found in IObit Advanced SystemCare Utimate up to 17.0.0. It has been declared as problematic. Affected by this vulnerability is the functio… |
CVE-2024-12659 | Medium | 5.5 | 2024-12-16 | A vulnerability was found in IObit Advanced SystemCare Utimate up to 17.0.0. It has been classified as problematic. Affected is the function 0x8001E004 in the… |
CVE-2024-12658 | Medium | 5.5 | 2024-12-16 | A vulnerability was found in IObit Advanced SystemCare Utimate up to 17.0.0 and classified as problematic. This issue affects the function 0x8001E01C in the li… |
CVE-2024-8058 | High | 7.6 | 2024-12-16 | An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary files on the device… |
CVE-2024-6001 | High | 8.1 | 2024-12-16 | An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an update request to a r… |
CVE-2024-4762 | High | 7.8 | 2024-12-16 | An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to escalate privileges. |
CVE-2024-12657 | Medium | 5.5 | 2024-12-16 | A vulnerability has been found in IObit Advanced SystemCare Utimate up to 17.0.0 and classified as problematic. This vulnerability affects the function 0x8001E… |
CVE-2024-12656 | Medium | 5.5 | 2024-12-16 | A vulnerability, which was classified as problematic, was found in FabulaTech USB over Network 6.0.6.1. This affects the function 0x220448 in the library ftusb… |
CVE-2024-12655 | Medium | 5.5 | 2024-12-16 | A vulnerability, which was classified as problematic, has been found in FabulaTech USB over Network 6.0.6.1. Affected by this issue is the function 0x220420 in… |
CVE-2024-11358 | Medium | 5.7 | 2024-12-16 | Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an attacker with local access to access files via file… |
CVE-2024-11144 | High | 7.5 | 2024-12-16 | The server lacks thread safety and can be crashed by anomalous data sent by an anonymous user from a remote network. The crash causes the FTP service to become… |
CVE-2024-10095 | High | 8.4 | 2024-12-16 | In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-56003 | Medium | 4.3 | 2024-12-16 | Missing Authorization vulnerability in David Cramer Caldera SMTP Mailer caldera-smtp-mailer.This issue affects Caldera SMTP Mailer: from n/a through <= 1.0.1. |
CVE-2024-55999 | Medium | 5.3 | 2024-12-16 | Missing Authorization vulnerability in Marco Giannini XML Multilanguage Sitemap Generator xml-multilanguage-sitemap-generator.This issue affects XML Multilangu… |
CVE-2024-54376 | High | 7.5 | 2024-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Spider Themes EazyDocs eazydocs allows… |
CVE-2024-54357 | Medium | 4.3 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10. |
CVE-2024-54348 | Medium | 6.5 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yaycommerce Brand brand allows Stored XSS.This issue affe… |
CVE-2024-54285 | Critical | 9.1 | 2024-12-16 | Unrestricted Upload of File with Dangerous Type vulnerability in SeedProd LLC SeedProd Pro allows Upload a Web Shell to a Web Server.This issue affects SeedPro… |
CVE-2024-54284 | High | 7.6 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue… |
CVE-2024-54283 | High | 7.6 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue… |
CVE-2024-54280 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This… |
CVE-2024-54279 | High | 7.5 | 2024-12-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tobias Keller WP-NERD Toolkit wp-nerd-toolkit.This issue affects WP… |
CVE-2024-54257 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Molefed allows Reflected XSS.This issue affects tydskrif… |
CVE-2024-54249 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Advanced Options Editor allows Reflected XSS… |
CVE-2024-54229 | Critical | 9.8 | 2024-12-16 | Incorrect Privilege Assignment vulnerability in straightvisions GmbH SV100 Companion sv100-companion allows Privilege Escalation.This issue affects SV100 Compa… |
CVE-2024-43234 | Critical | 9.8 | 2024-12-16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: fr… |
CVE-2024-12654 | Medium | 5.5 | 2024-12-16 | A vulnerability classified as problematic was found in FabulaTech USB over Network 6.0.6.1. Affected by this vulnerability is the function 0x220408 in the libr… |
CVE-2024-12653 | Medium | 5.5 | 2024-12-16 | A vulnerability classified as problematic has been found in FabulaTech USB over Network 6.0.6.1. Affected is the function 0x22040C in the library ftusbbus2.sys… |
CVE-2024-56015 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in John Godley Tidy Up allows Reflected XSS.This issue affects Tidy Up: from n/a through 1.3. |
CVE-2024-56013 | High | 8.8 | 2024-12-16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in wovax Wovax IDX wovax-idx allows Authentication Bypass.This issue affects Wovax IDX… |
CVE-2024-56012 | Critical | 9.8 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Flash News / Post (Responsive) flashnews-fading-effect-pearlbells allows Privilege Escalation.This i… |
CVE-2024-56011 | Medium | 6.5 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ilja Zaglov Responsive Google Maps | by imbaa responsive-… |
CVE-2024-56009 | Medium | 5.3 | 2024-12-16 | Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This… |
CVE-2024-56007 | Medium | 4.3 | 2024-12-16 | Missing Authorization vulnerability in leader codes Leader leader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Le… |
CVE-2024-56005 | Medium | 6.5 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Posti Posti Shipping posti-shipping allows Cross Site Request Forgery.This issue affects Posti Shipping: fro… |
CVE-2024-56004 | Medium | 5.4 | 2024-12-16 | Missing Authorization vulnerability in awfowler Easy Site Importer easy-site-importer allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2024-56001 | Medium | 6.5 | 2024-12-16 | Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2024-55998 | Medium | 5.4 | 2024-12-16 | Missing Authorization vulnerability in Eric Sloan Popup Surveys & Polls for WordPress (Mare.io) popup-surveys allows Exploiting Incorrectly Configured Access C… |
CVE-2024-55996 | Medium | 6.1 | 2024-12-16 | Missing Authorization vulnerability in dreamfox Dreamfox Media Payment gateway per Product for Woocommerce woocommerce-product-payments allows Exploiting Incor… |
CVE-2024-55994 | Medium | 4.3 | 2024-12-16 | Missing Authorization vulnerability in sohu 畅言评论系统 changyan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 畅言评论系统… |
CVE-2024-55993 | Medium | 5.3 | 2024-12-16 | Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-55992 | Medium | 5.4 | 2024-12-16 | Missing Authorization vulnerability in Open Tools WooCommerce Basic Ordernumbers woocommerce-basic-ordernumbers allows Exploiting Incorrectly Configured Access… |
CVE-2024-55990 | High | 7.6 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tsjippy Mollie for Contact Form 7 cf7-mollie allows Blind… |
CVE-2024-55989 | High | 7.6 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kyle M Brown WP Simple Pay Lite Manager stripe-manager al… |
CVE-2024-55988 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amol Nirmala Waman Navayan CSV Export navayan-csv-export… |
CVE-2024-55987 | High | 8.5 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ritesh Sanap Advanced What should we write next about adv… |
CVE-2024-55986 | High | 8.5 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tiny13 Service service allows Blind SQL Injection.This is… |
CVE-2024-55982 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-butt… |
CVE-2024-55981 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows… |
CVE-2024-55980 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allow… |
CVE-2024-55979 | High | 8.5 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allow… |
CVE-2024-55978 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WalletStation Code Generator Pro code-generator-pro allow… |
CVE-2024-55977 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BinaryCarpenter LaunchPage.app Importer launchpage-app-im… |
CVE-2024-55976 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mikeleembruggen Critical Site Intel critical-site-intel-s… |
CVE-2024-55974 | High | 8.5 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martí Batlles Martinez Mimoos devoluciones-packback allow… |
CVE-2024-55973 | High | 8.5 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rnystrom TSB Occasion Editor tsb-occasion-editor allows S… |
CVE-2024-55972 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection… |
CVE-2024-54443 | Medium | 6.5 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Advanced Data Table For Elementor advanced-da… |
CVE-2024-54442 | Medium | 5.9 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cortesfrau Better WP Login Page better-wp-login-page allo… |
CVE-2024-54441 | Medium | 6.5 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech World Time utech-world-time-for-wp allows Sto… |
CVE-2024-54440 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in blueskyy WP-Ban-User wp-ban-user allows Stored XSS.This issue affects WP-Ban-User: from n/a through <= 1.0. |
CVE-2024-54439 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Alok Tiwari Amazon Product Price amazon-product-price allows Stored XSS.This issue affects Amazon Product Pr… |
CVE-2024-54438 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in gaxx Gaxx Keywords gaxx-keywords allows Stored XSS.This issue affects Gaxx Keywords: from n/a through <= 0.2. |
CVE-2024-54437 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in koolkatwebdesigns jCarousel jcarousel-for-wordpress allow… |
CVE-2024-54436 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in milordk Jet Footer Code jet-footer-code allows Stored XSS.This issue affects Jet Footer Code: from n/a throu… |
CVE-2024-54435 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Thomas Hoefter Onlywire Multi Autosubmitter onlywire-multi-autosubmitter allows Stored XSS.This issue affect… |
CVE-2024-54434 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in BenJemin phZoom phzoom allows Stored XSS.This issue affects phZoom: from n/a through <= 1.2.92. |
CVE-2024-54433 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Marcel CL Simple Booking Widget simple-booking-widget allows Stored XSS.This issue affects Simple Booking Wi… |
CVE-2024-54432 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik WP Flipkart Importer wp-flipkart-importer allows Stored XSS.This issue affects WP Flipkart I… |
CVE-2024-54431 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in phpdevp Admin Customization wpp-customization allows Stored XSS.This issue affects Admin Customization: from… |
CVE-2024-54430 | Medium | 5.4 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Cross Site Request Forgery.This issue affec… |
CVE-2024-54429 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in ivan-ovsyannikov Aphorismus aphorismus allows Stored XSS.This issue affects Aphorismus: from n/a through <=… |
CVE-2024-54428 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in onigetoc Add image to Post add-image-to-post allows Stored XSS.This issue affects Add image to Post: from n/… |
CVE-2024-54427 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in ljmacphee Category of Posts list-one-category-of-posts allows Stored XSS.This issue affects Category of Post… |
CVE-2024-54426 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in crossfitatgg LeaderBoard Plugin leaderboard-lite allows Stored XSS.This issue affects LeaderBoard Plugin: fr… |
CVE-2024-54425 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.com LionScripts: Site Maintenance & Noindex Nofollow Plugin maintenance-and-noindex-nofollow all… |