2024 CVEs (page 72)
Page 72 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-49775 | Critical | 9.8 | 2024-12-16 | A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Q… |
CVE-2024-37251 | Medium | 4.3 | 2024-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in WPENGINE, INC. Advanced Custom Fields PRO.This issue affects Advanced Custom Fields PRO: from n/a before 6.3… |
CVE-2024-12668 | High | 8.2 | 2024-12-16 | Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into w… |
CVE-2024-12092 | High | 8.7 | 2024-12-16 | A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execut… |
CVE-2024-12091 | High | 8.7 | 2024-12-16 | A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIEN… |
CVE-2024-12090 | High | 8.7 | 2024-12-16 | A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execut… |
CVE-2024-12089 | High | 8.7 | 2024-12-16 | A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIEN… |
CVE-2024-10972 | High | 7.3 | 2024-12-16 | Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a… |
CVE-2024-12478 | Medium | 6.3 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index… |
CVE-2024-12362 | Medium | 4.3 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The… |
CVE-2024-54682 | Medium | 6.5 | 2024-12-16 | Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allow… |
CVE-2024-54083 | Medium | 6.5 | 2024-12-16 | Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user t… |
CVE-2024-48872 | Medium | 4.8 | 2024-12-16 | Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed log… |
CVE-2024-9679 | Medium | 5.3 | 2024-12-16 | A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user credentials. |
CVE-2024-9678 | Medium | 4.9 | 2024-12-16 | An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arbitrary SQL queries potentially leading… |
CVE-2024-12646 | High | 8.1 | 2024-12-16 | The topm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for commu… |
CVE-2024-12645 | Medium | 6.5 | 2024-12-16 | The topm-client from Chunghwa Telecom has an Arbitrary File Read vulnerability. The application sets up a simple local web server and provides APIs for communi… |
CVE-2024-12644 | High | 7.1 | 2024-12-16 | The tbm-client from Chunghwa Telecom has an Arbitrary File vulnerability. The application sets up a simple local web server and provides APIs for communication… |
CVE-2024-12643 | High | 8.1 | 2024-12-16 | The tbm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for commun… |
CVE-2024-12642 | High | 8.1 | 2024-12-16 | TenderDocTransfer from Chunghwa Telecom has an Arbitrary File Write vulnerability. The application sets up a simple local web server and provides APIs for comm… |
CVE-2024-12641 | Critical | 9.6 | 2024-12-16 | TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs… |
CVE-2024-5333 | Medium | 5.3 | 2024-12-16 | The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about pa… |
CVE-2024-56112 | Medium | 6.1 | 2024-12-16 | CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php. |
CVE-2024-56087 | Medium | 5.9 | 2024-12-16 | An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while querying Search Template Dashboard. These are executed, leading… |
CVE-2024-56086 | High | 7.1 | 2024-12-16 | An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads in Report Templates. These are executed when the backup process is in… |
CVE-2024-56085 | Medium | 5.9 | 2024-12-16 | An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Template Dashboard. These are executed, leading… |
CVE-2024-56084 | High | 7.1 | 2024-12-16 | An issue was discovered in Logpoint UniversalNormalizer before 5.7.0. Authenticated users can inject payloads while creating Universal Normalizer. These are ex… |
CVE-2024-11841 | Medium | 5.4 | 2024-12-16 | The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |
CVE-2024-8650 | Medium | 5.3 | 2024-12-16 | An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-membe… |
CVE-2024-8116 | Medium | 5.3 | 2024-12-16 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific Gr… |
CVE-2024-53376 | High | 8.8 | 2024-12-16 | CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/subm… |
CVE-2024-56083 | High | 8.1 | 2024-12-16 | Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomly_generated_string.devinapps.com URL (ak… |
CVE-2024-8798 | High | 7.5 | 2024-12-16 | No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. |
CVE-2024-11858 | High | 8.6 | 2024-12-15 | A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. M… |
CVE-2024-7701 | High | 7.5 | 2024-12-15 | Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona… |
CVE-2024-56082 | Low | 3.5 | 2024-12-15 | ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true. |
CVE-2024-56074 | Medium | 5.5 | 2024-12-15 | gitingest before 9996a06 mishandles symbolic links that point outside of the base directory. |
CVE-2024-55969 | Critical | 9.1 | 2024-12-15 | DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML… |
CVE-2024-56073 | High | 7.5 | 2024-12-15 | An issue was discovered in FastNetMon Community Edition through 1.2.7. Zero-length templates for Netflow v9 allow remote attackers to cause a denial of service… |
CVE-2024-56072 | High | 7.5 | 2024-12-15 | An issue was discovered in FastNetMon Community Edition through 1.2.7. The sFlow v5 plugin allows remote attackers to cause a denial of service (application cr… |
CVE-2024-55970 | High | 7.5 | 2024-12-15 | File Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue that is related to the request parameter, aka I644734. |
CVE-2024-31892 | High | 7.5 | 2024-12-14 | IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized actions after intercepting and modifying a… |
CVE-2024-31891 | High | 7.8 | 2024-12-14 | IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 contains a local privilege escalation vulnerability. A malicious actor with command… |
CVE-2024-11721 | High | 8.1 | 2024-12-14 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insuff… |
CVE-2024-11720 | High | 7.2 | 2024-12-14 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3… |
CVE-2024-12628 | Medium | 4.4 | 2024-12-14 | The bodi0`s Easy cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cache-folder' parameter in all versions up to, and including… |
CVE-2024-12446 | Medium | 6.4 | 2024-12-14 | The Post to Pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gmptp_single_post' shortcode in all versions up to, and inc… |
CVE-2024-11715 | Medium | 4.8 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access due to a missing c… |
CVE-2024-11714 | Medium | 4.9 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'ff' parameter o… |
CVE-2024-11713 | Medium | 4.9 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'page_id' parame… |
CVE-2024-11712 | Medium | 5.3 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a m… |
CVE-2024-11711 | High | 7.5 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'resumeid' param… |
CVE-2024-11710 | Medium | 4.9 | 2024-12-14 | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'fieldfor', 'vis… |
CVE-2024-12501 | Medium | 6.4 | 2024-12-14 | The Simple Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.0.3 du… |
CVE-2024-12474 | Medium | 6.4 | 2024-12-14 | The GeoDataSource Country Region DropDown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gds-country-dropdown' shortcode i… |
CVE-2024-12459 | Medium | 6.4 | 2024-12-14 | The Ganohrs Toggle Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode in all versions up to, and i… |
CVE-2024-12422 | Medium | 6.1 | 2024-12-14 | The Import Eventbrite Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including… |
CVE-2024-11752 | Medium | 6.4 | 2024-12-14 | The Eveeno plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eveeno' shortcode in all versions up to, and including, 1.7 due… |
CVE-2024-10690 | Medium | 4.3 | 2024-12-14 | The Shortcodes for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.4 via the 'SHORTCODE_ELEMENTO… |
CVE-2024-10646 | High | 7.2 | 2024-12-14 | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-9698 | High | 7.2 | 2024-12-14 | The Crafthemes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'process_uploaded_files' fun… |
CVE-2024-12578 | Medium | 5.3 | 2024-12-14 | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.5.4.8 via the 'ticke… |
CVE-2024-12555 | Medium | 6.1 | 2024-12-14 | The SIP Calculator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce val… |
CVE-2024-12523 | Medium | 6.4 | 2024-12-14 | The States Map US plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'states_map' shortcode in all versions up to, and includin… |
CVE-2024-12517 | Medium | 6.4 | 2024-12-14 | The WooCommerce Cart Count Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cart_button' shortcode in all versions… |
CVE-2024-12502 | Medium | 6.4 | 2024-12-14 | The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-landing' shortcode in all versions up t… |
CVE-2024-12458 | Medium | 6.4 | 2024-12-14 | The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and in… |
CVE-2024-12448 | Medium | 6.4 | 2024-12-14 | The Posts and Products Views for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'papvfwc_views' shortcode in al… |
CVE-2024-12447 | Medium | 4.3 | 2024-12-14 | The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the 'post-c… |
CVE-2024-12411 | Medium | 6.1 | 2024-12-14 | The WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' p… |
CVE-2024-11894 | Medium | 6.4 | 2024-12-14 | The The Permalinker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'permalink' shortcode in all versions up to, and includi… |
CVE-2024-11889 | Medium | 6.4 | 2024-12-14 | The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-search' shortcode in all versions up to… |
CVE-2024-11888 | Medium | 6.4 | 2024-12-14 | The IDer Login for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ider_login_button' shortcode in all versions u… |
CVE-2024-11884 | Medium | 6.4 | 2024-12-14 | The Wp photo text slider 50 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-photo-slider' shortcode in all versions up t… |
CVE-2024-11883 | Medium | 6.4 | 2024-12-14 | The Connatix Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cnx_script_code' shortcode in all versions up to… |
CVE-2024-11877 | Medium | 6.4 | 2024-12-14 | The Cricket Live Score plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cricket_score' shortcode in all versions up to, and… |
CVE-2024-11876 | Medium | 6.4 | 2024-12-14 | The Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the p… |
CVE-2024-11873 | Medium | 6.4 | 2024-12-14 | The glomex oEmbed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'glomex_integration' shortcode in all versions up to, and… |
CVE-2024-11869 | Medium | 6.4 | 2024-12-14 | The Buk for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buk' shortcode in all versions up to, and including… |
CVE-2024-11867 | Medium | 6.4 | 2024-12-14 | The Companion Portfolio – Responsive Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'companion-portfolio'… |
CVE-2024-11865 | Medium | 6.4 | 2024-12-14 | The Tabs Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0 due to insufficient input sanitization a… |
CVE-2024-11855 | Medium | 6.4 | 2024-12-14 | The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all vers… |
CVE-2024-11770 | Medium | 6.4 | 2024-12-14 | The Post Carousel & Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-cs' shortcode in all versions up to, and in… |
CVE-2024-11763 | Medium | 6.4 | 2024-12-14 | The Plezi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'plezi' shortcode in all versions up to, and including, 1.0.6 due… |
CVE-2024-11759 | Medium | 6.4 | 2024-12-14 | The Bukza plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bukza' shortcode in all versions up to, and including, 2.0.0 due… |
CVE-2024-11755 | Medium | 6.4 | 2024-12-14 | The IMS Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown post settings in all versions up to, and including, 1.3.5… |
CVE-2024-11751 | Medium | 6.4 | 2024-12-14 | The TCBD Popover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbd-popover-image ' shortcode in all versions up to, and… |
CVE-2024-11462 | Medium | 6.1 | 2024-12-14 | The Filestack Official plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fstab' and 'filestack_options' parameters in all versions… |
CVE-2024-11095 | Medium | 6.4 | 2024-12-14 | The Visualmodo Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1… |
CVE-2024-12553 | Medium | 6.5 | 2024-12-13 | GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information… |
CVE-2024-12552 | High | 7.8 | 2024-12-13 | Wacom Center WTabletServicePro Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on aff… |
CVE-2024-55956 | Critical | 9.8 | 2024-12-13 | In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerS… |
CVE-2024-55946 | | 2024-12-13 | Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifica… | |
CVE-2024-55890 | | 2024-12-13 | D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing a… | |
CVE-2024-47892 | High | 7.8 | 2024-12-13 | Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. |
CVE-2024-46971 | High | 7.8 | 2024-12-13 | Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. |
CVE-2024-9945 | Medium | 5.3 | 2024-12-13 | An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in ce… |
CVE-2024-55887 | High | 8.6 | 2024-12-13 | Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML exte… |
CVE-2024-55661 | High | 8.8 | 2024-12-13 | Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pul… |
CVE-2024-54139 | High | 7.9 | 2024-12-13 | Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulne… |