2024 CVEs (page 74)
Page 74 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11910 | Medium | 6.4 | 2024-12-13 | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including… |
CVE-2024-11832 | Medium | 6.4 | 2024-12-13 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JavaScript row settings in all ver… |
CVE-2024-11754 | Medium | 6.4 | 2024-12-13 | The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trafftbooking' shortcode in all versions up to, a… |
CVE-2024-11275 | Medium | 4.3 | 2024-12-13 | The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a… |
CVE-2024-55918 | Medium | 5.3 | 2024-12-13 | An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl. There is an ambiguity between modules and filenames that can lead to HTML in… |
CVE-2024-12581 | Medium | 4.4 | 2024-12-13 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all… |
CVE-2024-11839 | High | 7.5 | 2024-12-13 | Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexT… |
CVE-2024-11838 | Critical | 9.8 | 2024-12-13 | External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects Plex… |
CVE-2024-11837 | Critical | 9.8 | 2024-12-13 | Improper Neutralization of Special Elements used in an N1QL Command ('N1QL Injection') vulnerability in PlexTrac allows N1QL Injection.This issue affects Plex… |
CVE-2024-11836 | High | 7.5 | 2024-12-13 | Server-Side Request Forgery (SSRF) vulnerability in PlexTrac allowing requests to internal system resources.This issue affects PlexTrac: from 1.61.3 before 2.8… |
CVE-2024-11835 | High | 7.5 | 2024-12-13 | Uncontrolled Resource Consumption vulnerability in PlexTrac allows WebSocket DoS.This issue affects PlexTrac: from 1.61.3 before 2.8.1. |
CVE-2024-11834 | Critical | 9.1 | 2024-12-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTr… |
CVE-2024-11833 | Critical | 9.1 | 2024-12-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTr… |
CVE-2024-10939 | Medium | 4.8 | 2024-12-13 | The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privilege users such as… |
CVE-2024-10678 | Medium | 5.4 | 2024-12-13 | The Ultimate Blocks WordPress plugin before 3.2.4 does not validate and escape some of its block options before outputting them back in a page/post where the… |
CVE-2024-21544 | High | 8.6 | 2024-12-13 | Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An at… |
CVE-2024-21543 | High | 7.1 | 2024-12-13 | Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls ba… |
CVE-2024-12579 | Medium | 5.3 | 2024-12-13 | The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to… |
CVE-2024-12574 | Medium | 5.4 | 2024-12-13 | The SVG Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to ins… |
CVE-2024-11809 | Medium | 6.1 | 2024-12-13 | The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'img_src' parameter in all versions up to, and i… |
CVE-2024-11767 | Medium | 6.4 | 2024-12-13 | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'newsman_subscribe_widget' shortcode in all versions up to, a… |
CVE-2024-12572 | Medium | 6.1 | 2024-12-13 | The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing… |
CVE-2024-12300 | Low | 3.7 | 2024-12-13 | The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_i… |
CVE-2024-12603 | Critical | 9.8 | 2024-12-13 | A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password. |
CVE-2024-9508 | High | 7.8 | 2024-12-13 | Horner Automation Cscape contains a memory corruption vulnerability, which could allow an attacker to disclose information and execute arbitrary code. |
CVE-2024-12212 | High | 7.8 | 2024-12-13 | The vulnerability occurs in the parsing of CSP files. The issues result from the lack of proper validation of user-supplied data, which could allow reading p… |
CVE-2024-12289 | Medium | 5.9 | 2024-12-12 | Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which ma… |
CVE-2024-55888 | High | 7.1 | 2024-12-12 | Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been… |
CVE-2024-55886 | Medium | 6.9 | 2024-12-12 | OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists… |
CVE-2024-55885 | High | 7.5 | 2024-12-12 | beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer consid… |
CVE-2024-55879 | Critical | 9.1 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary rem… |
CVE-2024-55878 | Medium | 6.8 | 2024-12-12 | SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended… |
CVE-2024-55877 | Critical | 9.9 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perfor… |
CVE-2024-55876 | Medium | 5.4 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main w… |
CVE-2024-55875 | Critical | 9.8 | 2024-12-12 | http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability… |
CVE-2024-55663 | Critical | 9.8 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering o… |
CVE-2024-54811 | Critical | 9.8 | 2024-12-12 | A SQL injection vulnerability in /index.php in PHPGurukul Park Ticketing Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "l… |
CVE-2024-49147 | Critical | 9.3 | 2024-12-12 | Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver. |
CVE-2024-49071 | Medium | 6.5 | 2024-12-12 | Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose… |
CVE-2024-55662 | Critical | 9.9 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Reposito… |
CVE-2024-54810 | Critical | 9.8 | 2024-12-12 | A SQL Injection vulnerability was found in /preschool/admin/password-recovery.php in PHPGurukul Pre-School Enrollment System Project v1.0, which allows remote… |
CVE-2024-47238 | High | 7.5 | 2024-12-12 | Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acces… |
CVE-2024-31670 | Medium | 6.3 | 2024-12-12 | rizin before v0.6.3 is vulnerable to Buffer Overflow via create_cache_bins, read_cache_accel, and rz_dyldcache_new_buf functions in librz/bin/format/mach0/dyld… |
CVE-2024-55099 | Critical | 9.8 | 2024-12-12 | A SQL Injection vulnerability was found in /admin/index.php in phpgurukul Online Nurse Hiring System v1.0, which allows remote attackers to execute arbitrary S… |
CVE-2024-52901 | Medium | 6.5 | 2024-12-12 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to GUI to not load or stop working due to improper input validation. |
CVE-2024-55633 | Medium | 6.5 | 2024-12-12 | Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML s… |
CVE-2024-54842 | Critical | 9.8 | 2024-12-12 | A SQL injection vulnerability was found in phpgurukul Online Nurse Hiring System v1.0 in /admin/password-recovery.php via the mobileno parameter. |
CVE-2024-21575 | High | 8.6 | 2024-12-12 | ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/uplo… |
CVE-2024-50584 | Medium | 4.4 | 2024-12-12 | An authenticated attacker with the user/role "Poweruser" can perform an SQL injection by accessing the /class/template_io.php file and supplying malicious GET… |
CVE-2024-28146 | High | 8.4 | 2024-12-12 | The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allo… |
CVE-2024-28145 | Medium | 5.9 | 2024-12-12 | An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. The HTTP GET parame… |
CVE-2024-28144 | Medium | 5.5 | 2024-12-12 | An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session managem… |
CVE-2024-28143 | High | 8.4 | 2024-12-12 | The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attack… |
CVE-2024-54122 | Medium | 6.2 | 2024-12-12 | Concurrent variable access vulnerability in the ability module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2024-54119 | Medium | 6.2 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-47947 | Medium | 4.7 | 2024-12-12 | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit D… |
CVE-2024-36498 | Medium | 4.7 | 2024-12-12 | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit D… |
CVE-2024-36494 | Medium | 4.7 | 2024-12-12 | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login p… |
CVE-2024-28142 | Medium | 4.7 | 2024-12-12 | Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "File N… |
CVE-2024-12271 | Medium | 4.4 | 2024-12-12 | The 360 Javascript Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ref’ parameter in all versions up to, and including, 1.7.2… |
CVE-2024-9387 | Medium | 6.4 | 2024-12-12 | An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potential… |
CVE-2024-9367 | Medium | 4.3 | 2024-12-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an att… |
CVE-2024-8647 | Medium | 5.4 | 2024-12-12 | An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it w… |
CVE-2024-8233 | High | 7.5 | 2024-12-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could cause… |
CVE-2024-8179 | Medium | 5.4 | 2024-12-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. Improper output encodi… |
CVE-2024-54117 | Medium | 6.2 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54116 | Medium | 4.3 | 2024-12-12 | Out-of-bounds read vulnerability in the M3U8 module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2024-54115 | Medium | 4.3 | 2024-12-12 | Out-of-bounds read vulnerability in the DASH module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54114 | Medium | 4.4 | 2024-12-12 | Out-of-bounds access vulnerability in playback in the DASH module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54113 | Medium | 6.5 | 2024-12-12 | Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect power consumption. |
CVE-2024-54112 | Medium | 5.5 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54111 | Medium | 5.7 | 2024-12-12 | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54110 | Medium | 6.2 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54109 | Medium | 6.5 | 2024-12-12 | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54108 | Medium | 6.5 | 2024-12-12 | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54107 | High | 7.1 | 2024-12-12 | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54106 | High | 7.1 | 2024-12-12 | Null pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54105 | Medium | 5.1 | 2024-12-12 | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54104 | Medium | 6.2 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54103 | Medium | 6.1 | 2024-12-12 | Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54102 | Medium | 6.1 | 2024-12-12 | Race condition vulnerability in the DDR module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54101 | Medium | 6.2 | 2024-12-12 | Denial of service (DoS) vulnerability in the installation module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54100 | Medium | 6.2 | 2024-12-12 | Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features to perform abnorma… |
CVE-2024-54099 | Medium | 6.7 | 2024-12-12 | File replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2024-54098 | High | 8.5 | 2024-12-12 | Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service integrity. |
CVE-2024-54097 | High | 7.3 | 2024-12-12 | Security vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and integrity. |
CVE-2024-54096 | Medium | 5.3 | 2024-12-12 | Vulnerability of improper access control in the MTP module Impact: Successful exploitation of this vulnerability may affect integrity and accuracy. |
CVE-2024-12570 | Medium | 6.7 | 2024-12-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6… |
CVE-2024-12292 | Medium | 4.0 | 2024-12-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 p… |
CVE-2024-11274 | High | 8.7 | 2024-12-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 p… |
CVE-2024-10043 | Low | 3.1 | 2024-12-12 | An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions s… |
CVE-2024-21574 | Critical | 10.0 | 2024-12-12 | The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is add… |
CVE-2024-12401 | Medium | 4.4 | 2024-12-12 | A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resour… |
CVE-2024-12397 | High | 7.4 | 2024-12-12 | A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an att… |
CVE-2024-12333 | Medium | 6.5 | 2024-12-12 | The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowi… |
CVE-2024-12160 | Medium | 6.1 | 2024-12-12 | The Seraphinite Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without app… |
CVE-2024-11760 | Medium | 6.4 | 2024-12-12 | The Currency Converter Widget ⚡ PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'currency-converter-widget-pro' shortcod… |
CVE-2024-12564 | | 2024-12-12 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Ser… | |
CVE-2024-12329 | Medium | 4.3 | 2024-12-12 | The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in al… |
CVE-2024-12312 | High | 8.1 | 2024-12-12 | The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via deserialization of untr… |