2024 CVEs (page 74)
Page 74 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24902 | Medium | 6.6 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains an Improper access control vulnerability. A low privileged local attacker could potentially exploit this… |
CVE-2024-55889 | Medium | 4.9 | 2024-12-13 | phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can tri… |
CVE-2024-48008 | Medium | 5.3 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains a OS Command Injection vulnerability. An Low privileged remote attacker could potentially exploit this vu… |
CVE-2024-48007 | Medium | 5.3 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. A Remote unauthenticated attacker could potentially exploit… |
CVE-2024-38488 | Medium | 6.5 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability where a Network attack… |
CVE-2024-22461 | High | 8.8 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote attacker could potentially exploit this vu… |
CVE-2024-11986 | Critical | 9.6 | 2024-12-13 | Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the log… |
CVE-2024-9608 | Medium | 6.1 | 2024-12-13 | The MyParcel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in al… |
CVE-2024-21577 | Critical | 10.0 | 2024-12-13 | ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary user-contro… |
CVE-2024-21576 | Critical | 10.0 | 2024-12-13 | ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour c… |
CVE-2024-11827 | Medium | 6.4 | 2024-12-13 | The Out of the Block: OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ootb_query shortcode in all versions up… |
CVE-2024-52066 | High | 7.8 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service) allows Overflow Variables an… |
CVE-2024-52065 | High | 7.1 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Bu… |
CVE-2024-52064 | High | 7.1 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and… |
CVE-2024-52063 | High | 8.6 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Routing Service) allows Overf… |
CVE-2024-52062 | High | 7.8 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and… |
CVE-2024-52061 | Critical | 9.8 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording Se… |
CVE-2024-52060 | High | 7.8 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing S… |
CVE-2024-52059 | High | 7.8 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext… |
CVE-2024-52058 | High | 7.8 | 2024-12-13 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext Professional (System Designer) allows O… |
CVE-2024-9290 | Critical | 9.8 | 2024-12-13 | The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing… |
CVE-2024-52057 | Critical | 9.8 | 2024-12-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Professional (Queuing Service) allows SQL Inj… |
CVE-2024-11012 | Medium | 6.3 | 2024-12-13 | The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njt_nofi_text AJAX action in all versi… |
CVE-2024-10783 | High | 8.1 | 2024-12-13 | The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missi… |
CVE-2024-12465 | Medium | 6.4 | 2024-12-13 | The Property Hive Stamp Duty Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stamp_duty_calculator_scotland' sho… |
CVE-2024-12421 | Medium | 6.5 | 2024-12-13 | The The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-12420 | Medium | 6.5 | 2024-12-13 | The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includ… |
CVE-2024-12417 | Medium | 6.5 | 2024-12-13 | The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.5. This is due to t… |
CVE-2024-12414 | Medium | 4.3 | 2024-12-13 | The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing… |
CVE-2024-12309 | Medium | 5.3 | 2024-12-13 | The Rate My Post – Star Rating Plugin by FeedbackWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including… |
CVE-2024-12042 | Medium | 5.4 | 2024-12-13 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload… |
CVE-2024-11911 | Medium | 4.3 | 2024-12-13 | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin(… |
CVE-2024-11910 | Medium | 6.4 | 2024-12-13 | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including… |
CVE-2024-11832 | Medium | 6.4 | 2024-12-13 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JavaScript row settings in all ver… |
CVE-2024-11754 | Medium | 6.4 | 2024-12-13 | The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trafftbooking' shortcode in all versions up to, a… |
CVE-2024-11275 | Medium | 4.3 | 2024-12-13 | The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a… |
CVE-2024-55918 | Medium | 5.3 | 2024-12-13 | An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl. There is an ambiguity between modules and filenames that can lead to HTML in… |
CVE-2024-12581 | Medium | 4.4 | 2024-12-13 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all… |
CVE-2024-11839 | High | 7.5 | 2024-12-13 | Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexT… |
CVE-2024-11838 | Critical | 9.8 | 2024-12-13 | External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects Plex… |
CVE-2024-11837 | Critical | 9.8 | 2024-12-13 | Improper Neutralization of Special Elements used in an N1QL Command ('N1QL Injection') vulnerability in PlexTrac allows N1QL Injection.This issue affects Plex… |
CVE-2024-11836 | High | 7.5 | 2024-12-13 | Server-Side Request Forgery (SSRF) vulnerability in PlexTrac allowing requests to internal system resources.This issue affects PlexTrac: from 1.61.3 before 2.8… |
CVE-2024-11835 | High | 7.5 | 2024-12-13 | Uncontrolled Resource Consumption vulnerability in PlexTrac allows WebSocket DoS.This issue affects PlexTrac: from 1.61.3 before 2.8.1. |
CVE-2024-11834 | Critical | 9.1 | 2024-12-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTr… |
CVE-2024-11833 | Critical | 9.1 | 2024-12-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTr… |
CVE-2024-10939 | Medium | 4.8 | 2024-12-13 | The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privilege users such as… |
CVE-2024-10678 | Medium | 5.4 | 2024-12-13 | The Ultimate Blocks WordPress plugin before 3.2.4 does not validate and escape some of its block options before outputting them back in a page/post where the… |
CVE-2024-21544 | High | 8.6 | 2024-12-13 | Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An at… |
CVE-2024-21543 | High | 7.1 | 2024-12-13 | Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls ba… |
CVE-2024-12579 | Medium | 5.3 | 2024-12-13 | The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to… |
CVE-2024-12574 | Medium | 5.4 | 2024-12-13 | The SVG Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to ins… |
CVE-2024-11809 | Medium | 6.1 | 2024-12-13 | The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'img_src' parameter in all versions up to, and i… |
CVE-2024-11767 | Medium | 6.4 | 2024-12-13 | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'newsman_subscribe_widget' shortcode in all versions up to, a… |
CVE-2024-12572 | Medium | 6.1 | 2024-12-13 | The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing… |
CVE-2024-12300 | Low | 3.7 | 2024-12-13 | The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_i… |
CVE-2024-12603 | Critical | 9.8 | 2024-12-13 | A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password. |
CVE-2024-9508 | High | 7.8 | 2024-12-13 | Horner Automation Cscape contains a memory corruption vulnerability, which could allow an attacker to disclose information and execute arbitrary code. |
CVE-2024-12212 | High | 7.8 | 2024-12-13 | The vulnerability occurs in the parsing of CSP files. The issues result from the lack of proper validation of user-supplied data, which could allow reading p… |
CVE-2024-12289 | Medium | 5.9 | 2024-12-12 | Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which ma… |
CVE-2024-55888 | High | 7.1 | 2024-12-12 | Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been… |
CVE-2024-55886 | Medium | 6.9 | 2024-12-12 | OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists… |
CVE-2024-55885 | High | 7.5 | 2024-12-12 | beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer consid… |
CVE-2024-55879 | Critical | 9.1 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary rem… |
CVE-2024-55878 | Medium | 6.8 | 2024-12-12 | SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended… |
CVE-2024-55877 | Critical | 9.9 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perfor… |
CVE-2024-55876 | Medium | 5.4 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main w… |
CVE-2024-55875 | Critical | 9.8 | 2024-12-12 | http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability… |
CVE-2024-55663 | Critical | 9.8 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering o… |
CVE-2024-54811 | Critical | 9.8 | 2024-12-12 | A SQL injection vulnerability in /index.php in PHPGurukul Park Ticketing Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "l… |
CVE-2024-49147 | Critical | 9.3 | 2024-12-12 | Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver. |
CVE-2024-49071 | Medium | 6.5 | 2024-12-12 | Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose… |
CVE-2024-55662 | Critical | 9.9 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Reposito… |
CVE-2024-54810 | Critical | 9.8 | 2024-12-12 | A SQL Injection vulnerability was found in /preschool/admin/password-recovery.php in PHPGurukul Pre-School Enrollment System Project v1.0, which allows remote… |
CVE-2024-47238 | High | 7.5 | 2024-12-12 | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acces… |
CVE-2024-31670 | Medium | 6.3 | 2024-12-12 | rizin before v0.6.3 is vulnerable to Buffer Overflow via create_cache_bins, read_cache_accel, and rz_dyldcache_new_buf functions in librz/bin/format/mach0/dyld… |
CVE-2024-55099 | Critical | 9.8 | 2024-12-12 | A SQL Injection vulnerability was found in /admin/index.php in phpgurukul Online Nurse Hiring System v1.0, which allows remote attackers to execute arbitrary S… |
CVE-2024-52901 | Medium | 6.5 | 2024-12-12 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to GUI to not load or stop working due to improper input validation. |
CVE-2024-55633 | Medium | 6.5 | 2024-12-12 | Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML s… |
CVE-2024-54842 | Critical | 9.8 | 2024-12-12 | A SQL injection vulnerability was found in phpgurukul Online Nurse Hiring System v1.0 in /admin/password-recovery.php via the mobileno parameter. |
CVE-2024-21575 | High | 8.6 | 2024-12-12 | ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/uplo… |
CVE-2024-50584 | Medium | 4.4 | 2024-12-12 | An authenticated attacker with the user/role "Poweruser" can perform an SQL injection by accessing the /class/template_io.php file and supplying malicious GET… |
CVE-2024-28146 | High | 8.4 | 2024-12-12 | The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allo… |
CVE-2024-28145 | Medium | 5.9 | 2024-12-12 | An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. The HTTP GET parame… |
CVE-2024-28144 | Medium | 5.5 | 2024-12-12 | An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session managem… |
CVE-2024-28143 | High | 8.4 | 2024-12-12 | The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attack… |
CVE-2024-54122 | Medium | 6.2 | 2024-12-12 | Concurrent variable access vulnerability in the ability module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-54119 | Medium | 6.2 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-47947 | Medium | 4.7 | 2024-12-12 | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit D… |
CVE-2024-36498 | Medium | 4.7 | 2024-12-12 | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit D… |
CVE-2024-36494 | Medium | 4.7 | 2024-12-12 | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login p… |
CVE-2024-28142 | Medium | 4.7 | 2024-12-12 | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "File N… |
CVE-2024-12271 | Medium | 4.4 | 2024-12-12 | The 360 Javascript Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ref’ parameter in all versions up to, and including, 1.7.2… |
CVE-2024-9387 | Medium | 6.4 | 2024-12-12 | An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potential… |
CVE-2024-9367 | Medium | 4.3 | 2024-12-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an att… |
CVE-2024-8647 | Medium | 5.4 | 2024-12-12 | An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it w… |
CVE-2024-8233 | High | 7.5 | 2024-12-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could cause… |
CVE-2024-8179 | Medium | 5.4 | 2024-12-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. Improper output encodi… |
CVE-2024-54117 | Medium | 6.2 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54116 | Medium | 4.3 | 2024-12-12 | Out-of-bounds read vulnerability in the M3U8 module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-54115 | Medium | 4.3 | 2024-12-12 | Out-of-bounds read vulnerability in the DASH module Impact: Successful exploitation of this vulnerability will affect availability. |