2024 CVEs (page 72)
Page 72 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8798 | High | 7.5 | 2024-12-16 | No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. |
CVE-2024-11858 | High | 8.6 | 2024-12-15 | A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. M… |
CVE-2024-7701 | High | 7.5 | 2024-12-15 | Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona… |
CVE-2024-56082 | Low | 3.5 | 2024-12-15 | ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true. |
CVE-2024-56074 | Medium | 5.5 | 2024-12-15 | gitingest before 9996a06 mishandles symbolic links that point outside of the base directory. |
CVE-2024-55969 | Critical | 9.1 | 2024-12-15 | DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML… |
CVE-2024-56073 | High | 7.5 | 2024-12-15 | An issue was discovered in FastNetMon Community Edition through 1.2.7. Zero-length templates for Netflow v9 allow remote attackers to cause a denial of service… |
CVE-2024-56072 | High | 7.5 | 2024-12-15 | An issue was discovered in FastNetMon Community Edition through 1.2.7. The sFlow v5 plugin allows remote attackers to cause a denial of service (application cr… |
CVE-2024-55970 | High | 7.5 | 2024-12-15 | File Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue that is related to the request parameter, aka I644734. |
CVE-2024-31892 | High | 7.5 | 2024-12-14 | IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized actions after intercepting and modifying a… |
CVE-2024-31891 | High | 7.8 | 2024-12-14 | IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 contains a local privilege escalation vulnerability. A malicious actor with command… |
CVE-2024-11721 | High | 8.1 | 2024-12-14 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insuff… |
CVE-2024-11720 | High | 7.2 | 2024-12-14 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3… |
CVE-2024-12628 | Medium | 4.4 | 2024-12-14 | The bodi0`s Easy cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cache-folder' parameter in all versions up to, and including… |
CVE-2024-12446 | Medium | 6.4 | 2024-12-14 | The Post to Pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gmptp_single_post' shortcode in all versions up to, and inc… |
CVE-2024-11715 | Medium | 4.8 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access due to a missing c… |
CVE-2024-11714 | Medium | 4.9 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'ff' parameter o… |
CVE-2024-11713 | Medium | 4.9 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'page_id' parame… |
CVE-2024-11712 | Medium | 5.3 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a m… |
CVE-2024-11711 | High | 7.5 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'resumeid' param… |
CVE-2024-11710 | Medium | 4.9 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'fieldfor', 'vis… |
CVE-2024-12501 | Medium | 6.4 | 2024-12-14 | The Simple Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.0.3 du… |
CVE-2024-12474 | Medium | 6.4 | 2024-12-14 | The GeoDataSource Country Region DropDown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gds-country-dropdown' shortcode i… |
CVE-2024-12459 | Medium | 6.4 | 2024-12-14 | The Ganohrs Toggle Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode in all versions up to, and i… |
CVE-2024-12422 | Medium | 6.1 | 2024-12-14 | The Import Eventbrite Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including… |
CVE-2024-11752 | Medium | 6.4 | 2024-12-14 | The Eveeno plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eveeno' shortcode in all versions up to, and including, 1.7 due… |
CVE-2024-10690 | Medium | 4.3 | 2024-12-14 | The Shortcodes for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.4 via the 'SHORTCODE_ELEMENTO… |
CVE-2024-10646 | High | 7.2 | 2024-12-14 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-9698 | High | 7.2 | 2024-12-14 | The Crafthemes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'process_uploaded_files' fun… |
CVE-2024-12578 | Medium | 5.3 | 2024-12-14 | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.5.4.8 via the 'ticke… |
CVE-2024-12555 | Medium | 6.1 | 2024-12-14 | The SIP Calculator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce val… |
CVE-2024-12523 | Medium | 6.4 | 2024-12-14 | The States Map US plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'states_map' shortcode in all versions up to, and includin… |
CVE-2024-12517 | Medium | 6.4 | 2024-12-14 | The WooCommerce Cart Count Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cart_button' shortcode in all versions… |
CVE-2024-12502 | Medium | 6.4 | 2024-12-14 | The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-landing' shortcode in all versions up t… |
CVE-2024-12458 | Medium | 6.4 | 2024-12-14 | The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and in… |
CVE-2024-12448 | Medium | 6.4 | 2024-12-14 | The Posts and Products Views for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'papvfwc_views' shortcode in al… |
CVE-2024-12447 | Medium | 4.3 | 2024-12-14 | The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the 'post-c… |
CVE-2024-12411 | Medium | 6.1 | 2024-12-14 | The WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' p… |
CVE-2024-11894 | Medium | 6.4 | 2024-12-14 | The The Permalinker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'permalink' shortcode in all versions up to, and includi… |
CVE-2024-11889 | Medium | 6.4 | 2024-12-14 | The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-search' shortcode in all versions up to… |
CVE-2024-11888 | Medium | 6.4 | 2024-12-14 | The IDer Login for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ider_login_button' shortcode in all versions u… |
CVE-2024-11884 | Medium | 6.4 | 2024-12-14 | The Wp photo text slider 50 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-photo-slider' shortcode in all versions up t… |
CVE-2024-11883 | Medium | 6.4 | 2024-12-14 | The Connatix Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cnx_script_code' shortcode in all versions up to… |
CVE-2024-11877 | Medium | 6.4 | 2024-12-14 | The Cricket Live Score plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cricket_score' shortcode in all versions up to, and… |
CVE-2024-11876 | Medium | 6.4 | 2024-12-14 | The Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the p… |
CVE-2024-11873 | Medium | 6.4 | 2024-12-14 | The glomex oEmbed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'glomex_integration' shortcode in all versions up to, and… |
CVE-2024-11869 | Medium | 6.4 | 2024-12-14 | The Buk for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buk' shortcode in all versions up to, and including… |
CVE-2024-11867 | Medium | 6.4 | 2024-12-14 | The Companion Portfolio – Responsive Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'companion-portfolio'… |
CVE-2024-11865 | Medium | 6.4 | 2024-12-14 | The Tabs Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0 due to insufficient input sanitization a… |
CVE-2024-11855 | Medium | 6.4 | 2024-12-14 | The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all vers… |
CVE-2024-11770 | Medium | 6.4 | 2024-12-14 | The Post Carousel & Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-cs' shortcode in all versions up to, and in… |
CVE-2024-11763 | Medium | 6.4 | 2024-12-14 | The Plezi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'plezi' shortcode in all versions up to, and including, 1.0.6 due… |
CVE-2024-11759 | Medium | 6.4 | 2024-12-14 | The Bukza plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bukza' shortcode in all versions up to, and including, 2.0.0 due… |
CVE-2024-11755 | Medium | 6.4 | 2024-12-14 | The IMS Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown post settings in all versions up to, and including, 1.3.5… |
CVE-2024-11751 | Medium | 6.4 | 2024-12-14 | The TCBD Popover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbd-popover-image ' shortcode in all versions up to, and… |
CVE-2024-11462 | Medium | 6.1 | 2024-12-14 | The Filestack Official plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fstab' and 'filestack_options' parameters in all versions… |
CVE-2024-11095 | Medium | 6.4 | 2024-12-14 | The Visualmodo Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1… |
CVE-2024-12553 | Medium | 6.5 | 2024-12-13 | GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information… |
CVE-2024-12552 | High | 7.8 | 2024-12-13 | Wacom Center WTabletServicePro Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on aff… |
CVE-2024-55956 | Critical | 9.8 | 2024-12-13 | In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerS… |
CVE-2024-55946 | | 2024-12-13 | Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifica… | |
CVE-2024-55890 | | 2024-12-13 | D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing a… | |
CVE-2024-47892 | High | 7.8 | 2024-12-13 | Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. |
CVE-2024-46971 | High | 7.8 | 2024-12-13 | Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. |
CVE-2024-9945 | Medium | 5.3 | 2024-12-13 | An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in ce… |
CVE-2024-55887 | High | 8.6 | 2024-12-13 | Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML exte… |
CVE-2024-55661 | High | 8.8 | 2024-12-13 | Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pul… |
CVE-2024-54139 | High | 7.9 | 2024-12-13 | Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulne… |
CVE-2024-54351 | High | 7.1 | 2024-12-13 | Cross-Site Request Forgery (CSRF) vulnerability in Thomas K Landis Fancy Roller Scroller fancy-roller-scroller allows Stored XSS.This issue affects Fancy Rolle… |
CVE-2024-54349 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mashiurz Plain Post plain-post allows Stored XSS.This iss… |
CVE-2024-54347 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companio… |
CVE-2024-54346 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 Barter barter allows DOM-Based XSS.This issu… |
CVE-2024-54345 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 Bicycleshop bicycleshop allows DOM-Based XSS… |
CVE-2024-54344 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Quick Shop wp-quick-shop allows Reflecte… |
CVE-2024-54343 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thehowarde Connect Contact Form 7 to Constant Contact con… |
CVE-2024-54342 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in STAGGS STAGGS staggs allows Reflected XSS.This issue affe… |
CVE-2024-54341 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LabelGrid LabelGrid Tools label-grid-tools allows Reflect… |
CVE-2024-54340 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sylviavanos Simple Presenter simple-presenter allows Refl… |
CVE-2024-54339 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jbd7 geoFlickr geoflickr allows Reflected XSS.This issue… |
CVE-2024-54338 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in christer_f Hello Event Widgets For Elementor hello-event-… |
CVE-2024-54337 | High | 7.1 | 2024-12-13 | Cross-Site Request Forgery (CSRF) vulnerability in DevriX DX Dark Site devrix-dark-site allows Stored XSS.This issue affects DX Dark Site: from n/a through <=… |
CVE-2024-54336 | High | 8.8 | 2024-12-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Projectopia Projectopia projectopia-core allows Authentication Bypass.This issue affe… |
CVE-2024-54335 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImmoSoft ImmoToolBox Connect immotoolbox-connect allows R… |
CVE-2024-54334 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeshanb Quran Phrases About Most People Shortcodes quran-… |
CVE-2024-54333 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Check Pincode For Woocommerce check-pinc… |
CVE-2024-54330 | High | 7.2 | 2024-12-13 | Server-Side Request Forgery (SSRF) vulnerability in hurraki Hurrakify hurrakify allows Server Side Request Forgery.This issue affects Hurrakify: from n/a throu… |
CVE-2024-54329 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metup CleverNode Related Content clevernode-related-conte… |
CVE-2024-54328 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in linknacional Invoice Payment for WooCommerce invoice-paym… |
CVE-2024-54327 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in universam UNIVERSAM universam-demo allows Reflected XSS.T… |
CVE-2024-54326 | Medium | 6.5 | 2024-12-13 | Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2024-54325 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DealerTrend CarDealerPress cardealerpress allows Reflecte… |
CVE-2024-54324 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mtomic SMSify smsify allows Reflected XSS.This issue affe… |
CVE-2024-54323 | Medium | 5.4 | 2024-12-13 | Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2024-54322 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader media-downloader allows Ref… |
CVE-2024-54321 | Medium | 4.3 | 2024-12-13 | Cross-Site Request Forgery (CSRF) vulnerability in Hive Support Hive Support hive-support allows Cross Site Request Forgery.This issue affects Hive Support: fr… |
CVE-2024-54320 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icdsoft ICDSoft Reseller Store icdsoft-reseller-store all… |
CVE-2024-54319 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kundgenerator Kundgenerator kundgenerator allows Reflecte… |
CVE-2024-54318 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicejob NiceJob nicejob allows Stored XSS.This issue affe… |
CVE-2024-54317 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Google Web Stories web-stories allows Stored XSS.This iss… |
CVE-2024-54316 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Restaurant & Cafe Addon for Elementor restaur… |