2024 CVEs (page 71)
Page 71 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-54424 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ilya_compman Like in Vk.com like-on-vkontakte allows Stor… |
CVE-2024-54423 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Jesse Overright Social Media Sharing social-media-sharing allows Stored XSS.This issue affects Social Media… |
CVE-2024-54422 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tgw365 Evernote Sync evernote-sync allows Reflected XSS.T… |
CVE-2024-54421 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Sanjay_Negi Floating Video Player floating-player allows Stored XSS.This issue affects Floating Video Player… |
CVE-2024-54420 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Aleksandr Novikov Metrika metrika allows Cross Site Request Forgery.This issue affects Metrika: from n/a thr… |
CVE-2024-54419 | Medium | 5.4 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in chenyenming Ui Slider Filter By Price ui-slider-filter-by-price allows Cross Site Request Forgery.This issue… |
CVE-2024-54418 | Medium | 5.4 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Diversified Technology Corp. DTC Documents dtc-documents allows Cross Site Request Forgery.This issue affect… |
CVE-2024-54417 | Medium | 5.3 | 2024-12-16 | Missing Authorization vulnerability in pixelgrade PixProof pixproof allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PixProof… |
CVE-2024-54416 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Navdeep Wp Login with Ajax wp-login-with-ajax allows Stored XSS.This issue affects Wp Login with Ajax: from… |
CVE-2024-54415 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in cconoly WP-HideThat wp-hide-that allows Stored XSS.This issue affects WP-HideThat: from n/a through <= 1.2. |
CVE-2024-54414 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in geoWP Geoportail Shortcode geoportail-shortcode allows Stored XSS.This issue affects Geoportail Shortcode: f… |
CVE-2024-54413 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in brandt-net Display Future Posts display-future-posts allows Stored XSS.This issue affects Display Future Pos… |
CVE-2024-54412 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Product Carousel ect-product-carousel allows Stored XSS.This issue affects ECT Product Carous… |
CVE-2024-54411 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in hosting.io WP Controller wp-management-controller allows Stored XSS.This issue affects WP Controller: from n… |
CVE-2024-54410 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in eagerterrier SOPA Blackout sopa-blackout allows Stored XSS.This issue affects SOPA Blackout: from n/a throug… |
CVE-2024-54409 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in fzmaster XPD Reduce Image Filesize xpd-reduce-image-filesize allows Stored XSS.This issue affects XPD Reduce… |
CVE-2024-54408 | Medium | 6.5 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for-youtube-businesses allows Exploiting Incorrectly C… |
CVE-2024-54407 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in a328496647 CK and SyntaxHighlighter ck-and-syntaxhighlighter allows Stored XSS.This issue affects CK and Syn… |
CVE-2024-54406 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moallemi Comments On Feed comments-on-feed allows Reflect… |
CVE-2024-54405 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Social Share ect-social-share allows Stored XSS.This issue affects ECT Social Share: from n/a… |
CVE-2024-54404 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Nazmul Ahsan MDC Comment Toolbar mdc-comment-toolbar allows Stored XSS.This issue affects MDC Comment Toolba… |
CVE-2024-54403 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oktoberfive Visual Recent Posts visual-recent-posts allow… |
CVE-2024-54402 | Medium | 4.3 | 2024-12-16 | Missing Authorization vulnerability in Mohamed Abd Elhalim Arabic Webfonts arabic-webfonts allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2024-54401 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Turcu Advanced Fancybox advanced-fancybox allows Stored XSS.This issue affects Advanced Fancybox: fr… |
CVE-2024-54400 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in meloniq AppMaps appmaps allows Stored XSS.This issue affects AppMaps: from n/a through <= 1.1. |
CVE-2024-54399 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab CRUDLab Google Plus Button crudlab-google-plus allows Stored XSS.This issue affects CRUDLab Google P… |
CVE-2024-54398 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in jcaruso001 Flaming Forms flaming-forms allows Stored XSS.This issue affects Flaming Forms: from n/a through… |
CVE-2024-54397 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in antonio.gocaj Go Animate goanimate allows Stored XSS.This issue affects Go Animate: from n/a through <= 1.0. |
CVE-2024-54396 | Medium | 4.3 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in elmervillanueva Bet sport Free bet-sport-free allows Cross Site Request Forgery.This issue affects Bet sport… |
CVE-2024-54395 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in preblogging Increase Sociability increase-sociability all… |
CVE-2024-54394 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in khubbaib Mandrill WP email-form-under-post allows Stored XSS.This issue affects Mandrill WP: from n/a throug… |
CVE-2024-54393 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Sheikh Heera WP Fiddle wp-fiddle allows Stored XSS.This issue affects WP Fiddle: from n/a through <= 1.0. |
CVE-2024-54392 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in midoks WP微信机器人 wp-weixin-robot allows Stored XSS.This issue affects WP微信机器人: from n/a through <= 5.3.5. |
CVE-2024-54391 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in mattwalters WordPress Filter wordpress-filter allows Stored XSS.This issue affects WordPress Filter: from n/… |
CVE-2024-54390 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bouzid Nazim Zitouni TagGator taggator allows Reflected X… |
CVE-2024-54389 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Eduardo addWeather myweather allows Cross Site Request Forgery.This issue affects addWeather: from n/a throu… |
CVE-2024-54388 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects M… |
CVE-2024-54387 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jaytesh Barange Posts Date Ranges posts-date-ranges allow… |
CVE-2024-54386 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in pushmonkey Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart push-monkey-desktop-push-… |
CVE-2024-54385 | High | 7.2 | 2024-12-16 | Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: f… |
CVE-2024-54384 | Medium | 4.3 | 2024-12-16 | Missing Authorization vulnerability in Anh Tran Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2024-54382 | Medium | 4.9 | 2024-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Path Trav… |
CVE-2024-54380 | High | 7.5 | 2024-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Filippo Bodei WP Cookies Enabler wp-cookies-enabler allows PHP… |
CVE-2024-54379 | High | 8.8 | 2024-12-16 | Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Privilege Escalation.This issue affects Minterpress: from n/a through <= 1.0.5. |
CVE-2024-54378 | High | 8.8 | 2024-12-16 | Missing Authorization vulnerability in Quietly Quietly Insights quietly-insights allows Privilege Escalation.This issue affects Quietly Insights: from n/a thro… |
CVE-2024-54375 | High | 7.5 | 2024-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Woolook woolook allows PHP Local File Inclusion.This issu… |
CVE-2024-54374 | High | 7.5 | 2024-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Sogrid sogrid allows PHP Local File Inclusion.This issue… |
CVE-2024-54373 | High | 7.5 | 2024-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chris Gardenberg EduAdmin Booking eduadmin-booking allows PHP L… |
CVE-2024-54372 | Critical | 9.6 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Sourov Amin Insertify insertify allows Code Injection.This issue affects Insertify: from n/a through <= 1.1… |
CVE-2024-54370 | Critical | 9.9 | 2024-12-16 | Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Uplo… |
CVE-2024-54369 | Critical | 9.1 | 2024-12-16 | Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue a… |
CVE-2024-54368 | Critical | 9.6 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in rubengarzajr GitSync git-sync allows Code Injection.This issue affects GitSync: from n/a through <= 1.1.0. |
CVE-2024-54367 | Critical | 9.8 | 2024-12-16 | Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1… |
CVE-2024-54366 | Medium | 5.3 | 2024-12-16 | Generation of Error Message Containing Sensitive Information vulnerability in videogallery Vimeography vimeography allows Retrieve Embedded Sensitive Data.This… |
CVE-2024-54365 | High | 8.8 | 2024-12-16 | Incorrect Privilege Assignment vulnerability in Knowhalim KH Easy User Settings kh-easy-user-settings allows Privilege Escalation.This issue affects KH Easy Us… |
CVE-2024-54364 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spartac Feedpress Generator feedpress-generator allows Re… |
CVE-2024-54363 | Critical | 9.8 | 2024-12-16 | Incorrect Privilege Assignment vulnerability in saiful.total Wp NssUser Register wp-nssuser-register allows Privilege Escalation.This issue affects Wp NssUser… |
CVE-2024-54361 | Critical | 9.3 | 2024-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tenteeglobal Instant Appointment instant-appointment allo… |
CVE-2024-54360 | Medium | 6.5 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in premila Gutensee gutensee allows DOM-Based XSS.This issue… |
CVE-2024-54359 | High | 8.2 | 2024-12-16 | Missing Authorization vulnerability in Saul Morales Pacheco Banner System banner-system allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-54358 | High | 7.1 | 2024-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Enrico Cantori 3D Avatar User Profile 3d-avatar-user-prof… |
CVE-2024-54356 | Medium | 5.4 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Si… |
CVE-2024-54355 | Medium | 4.3 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in brandtoss WP Mailster wp-mailster allows Cross Site Request Forgery.This issue affects WP Mailster: from n/a… |
CVE-2024-54354 | Medium | 6.5 | 2024-12-16 | Missing Authorization vulnerability in beat.k Termin-Kalender termin-kalender allows Stored XSS.This issue affects Termin-Kalender: from n/a through <= 0.99.47. |
CVE-2024-54353 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in wpgear Hack-Info hack-info allows Stored XSS.This issue affects Hack-Info: from n/a through <= 3.17. |
CVE-2024-54352 | High | 8.8 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Sabri Sogrid sogrid allows Privilege Escalation.This issue affects Sogrid: from n/a through <= 1.5.2. |
CVE-2024-54332 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in WPFactory WP Currency Exchange Rates wp-currency-exchange-rates allows Stored XSS.This issue affects WP Curr… |
CVE-2024-54331 | High | 7.1 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Micha I Plant A Tree i-plant-a-tree allows Stored XSS.This issue affects I Plant A Tree: from n/a through <=… |
CVE-2024-49775 | Critical | 9.8 | 2024-12-16 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Q… |
CVE-2024-37251 | Medium | 4.3 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in WPENGINE, INC. Advanced Custom Fields PRO.This issue affects Advanced Custom Fields PRO: from n/a before 6.3… |
CVE-2024-12668 | High | 8.2 | 2024-12-16 | Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into w… |
CVE-2024-12092 | High | 8.7 | 2024-12-16 | A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execut… |
CVE-2024-12091 | High | 8.7 | 2024-12-16 | A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIEN… |
CVE-2024-12090 | High | 8.7 | 2024-12-16 | A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execut… |
CVE-2024-12089 | High | 8.7 | 2024-12-16 | A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIEN… |
CVE-2024-10972 | High | 7.3 | 2024-12-16 | Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a… |
CVE-2024-12478 | Medium | 6.3 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index… |
CVE-2024-12362 | Medium | 4.3 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The… |
CVE-2024-54682 | Medium | 6.5 | 2024-12-16 | Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allow… |
CVE-2024-54083 | Medium | 6.5 | 2024-12-16 | Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user t… |
CVE-2024-48872 | Medium | 4.8 | 2024-12-16 | Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed log… |
CVE-2024-9679 | Medium | 5.3 | 2024-12-16 | A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user credentials. |
CVE-2024-9678 | Medium | 4.9 | 2024-12-16 | An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arbitrary SQL queries potentially leading… |
CVE-2024-12646 | High | 8.1 | 2024-12-16 | The topm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for commu… |
CVE-2024-12645 | Medium | 6.5 | 2024-12-16 | The topm-client from Chunghwa Telecom has an Arbitrary File Read vulnerability. The application sets up a simple local web server and provides APIs for communi… |
CVE-2024-12644 | High | 7.1 | 2024-12-16 | The tbm-client from Chunghwa Telecom has an Arbitrary File vulnerability. The application sets up a simple local web server and provides APIs for communication… |
CVE-2024-12643 | High | 8.1 | 2024-12-16 | The tbm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for commun… |
CVE-2024-12642 | High | 8.1 | 2024-12-16 | TenderDocTransfer from Chunghwa Telecom has an Arbitrary File Write vulnerability. The application sets up a simple local web server and provides APIs for comm… |
CVE-2024-12641 | Critical | 9.6 | 2024-12-16 | TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs… |
CVE-2024-5333 | Medium | 5.3 | 2024-12-16 | The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about pa… |
CVE-2024-56112 | Medium | 6.1 | 2024-12-16 | CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php. |
CVE-2024-56087 | Medium | 5.9 | 2024-12-16 | An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while querying Search Template Dashboard. These are executed, leading… |
CVE-2024-56086 | High | 7.1 | 2024-12-16 | An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads in Report Templates. These are executed when the backup process is in… |
CVE-2024-56085 | Medium | 5.9 | 2024-12-16 | An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Template Dashboard. These are executed, leading… |
CVE-2024-56084 | High | 7.1 | 2024-12-16 | An issue was discovered in Logpoint UniversalNormalizer before 5.7.0. Authenticated users can inject payloads while creating Universal Normalizer. These are ex… |
CVE-2024-11841 | Medium | 5.4 | 2024-12-16 | The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |
CVE-2024-8650 | Medium | 5.3 | 2024-12-16 | An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-membe… |
CVE-2024-8116 | Medium | 5.3 | 2024-12-16 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific Gr… |
CVE-2024-53376 | High | 8.8 | 2024-12-16 | CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/subm… |
CVE-2024-56083 | High | 8.1 | 2024-12-16 | Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomly_generated_string.devinapps.com URL (ak… |