2024 CVEs (page 81)
Page 81 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-54922 | High | 7.2 | 2024-12-09 | A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL comman… |
CVE-2024-11608 | High | 7.8 | 2024-12-09 | A maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vu… |
CVE-2024-11454 | High | 7.8 | 2024-12-09 | A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context o… |
CVE-2024-11268 | Medium | 5.5 | 2024-12-09 | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read. A malicious actor can leverage this vulnerability to cause… |
CVE-2024-54926 | High | 8.8 | 2024-12-09 | A SQL Injection vulnerability was found in /search_class.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary… |
CVE-2024-53450 | High | 7.5 | 2024-12-09 | RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents. |
CVE-2024-45761 | Medium | 5.4 | 2024-12-09 | Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user… |
CVE-2024-45760 | Medium | 4.3 | 2024-12-09 | Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper access control vulnerability. A remote low privileged user could potent… |
CVE-2024-40583 | Critical | 9.1 | 2024-12-09 | Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials. |
CVE-2024-40582 | High | 7.5 | 2024-12-09 | Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information. |
CVE-2024-54920 | Critical | 9.8 | 2024-12-09 | A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitra… |
CVE-2024-54919 | Medium | 5.4 | 2024-12-09 | A Stored Cross Site Scripting (XSS ) was found in /teacher_avatar.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attacker… |
CVE-2024-49603 | Medium | 4.3 | 2024-12-09 | Dell PowerScale OneFS Versions 8.2.2.x through 9.9.0.x contain an incorrect specified argument vulnerability. A remote low privileged legitimate user could pot… |
CVE-2024-49602 | Medium | 6.5 | 2024-12-09 | Dell PowerScale OneFS Versions 8.2.2.x through 9.8.0.x contain an improper resource unlocking vulnerability. A remote low privileged attacker could potentially… |
CVE-2024-49600 | High | 7.8 | 2024-12-09 | Dell Power Manager (DPM), versions prior to 3.17, contain an improper access control vulnerability. A low privileged attacker with local access could potential… |
CVE-2024-42426 | Medium | 4.3 | 2024-12-09 | Dell PowerScale OneFS Versions 9.5.0.x through 9.8.0.x contain an uncontrolled resource consumption vulnerability. A low privilege remote attacker could potent… |
CVE-2024-38485 | Medium | 4.3 | 2024-12-09 | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerabil… |
CVE-2024-11991 | Medium | 5.6 | 2024-12-09 | Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vu… |
CVE-2024-8259 | Critical | 9.8 | 2024-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Manage… |
CVE-2024-54937 | Medium | 5.3 | 2024-12-09 | A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via… |
CVE-2024-54936 | Medium | 5.4 | 2024-12-09 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message.php of Kashipara E-learning Management System v1.0. This vulnerability allows remo… |
CVE-2024-54929 | High | 7.2 | 2024-12-09 | KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_subject.php. |
CVE-2024-54218 | Medium | 6.5 | 2024-12-09 | Missing Authorization vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Contact: from n/a through <= 2.8.1. |
CVE-2024-53949 | Medium | 6.5 | 2024-12-09 | Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use thi… |
CVE-2024-53948 | Medium | 5.3 | 2024-12-09 | Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recomme… |
CVE-2024-53947 | Critical | 9.8 | 2024-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific fu… |
CVE-2024-53814 | Medium | 6.5 | 2024-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Adnan Analytify wp-analytify.This issue affects Analytify: from n/a… |
CVE-2024-52480 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Astoundify Jobify jobify.This issue affects Jobify: from n/a through < 4.3.0. |
CVE-2024-52391 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3. |
CVE-2024-52385 | Medium | 4.3 | 2024-12-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpmart Team Member team-showcase-supre… |
CVE-2024-54260 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-… |
CVE-2024-54255 | Medium | 4.7 | 2024-12-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in aviplugins.com Login Widget With Shortcode login-sidebar-widget allows Phishing.This issue… |
CVE-2024-54254 | Medium | 6.3 | 2024-12-09 | Missing Authorization vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter.This issue affects Message Filter for Contact Form 7: f… |
CVE-2024-54253 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons.This iss… |
CVE-2024-54251 | Medium | 6.5 | 2024-12-09 | Missing Authorization vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2024-54247 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABCBiz ABCBiz Addons and Templates for Elementor allows S… |
CVE-2024-54232 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RRDevs RRAddons for Elementor rrdevs-for-elementor allows… |
CVE-2024-54230 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masud Hasan Unlock Addons for Elementor unlock-addons-for… |
CVE-2024-54228 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Wot Elementor Widgets wot-… |
CVE-2024-54227 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Dotstore Minimum and Maximum Quantity for WooCommerce min-and-max-quantity-for-woocommerce allows Exploiting Incorrectly… |
CVE-2024-54226 | High | 7.1 | 2024-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in karlkiesinger Country Blocker country-blocker allows Stored XSS.This issue affects Country Blocker: from n/a… |
CVE-2024-54225 | High | 7.5 | 2024-12-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codegearthemes Designer designer allow… |
CVE-2024-54224 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quomodosoft ElementsReady Addons for Elementor element-re… |
CVE-2024-54223 | Medium | 5.3 | 2024-12-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allo… |
CVE-2024-54220 | High | 7.1 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Services Booking fat-services-booking allows… |
CVE-2024-54219 | High | 7.1 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Cont… |
CVE-2024-54217 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.1. |
CVE-2024-54215 | Critical | 9.3 | 2024-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy.This issue affects Revy: from n/a throu… |
CVE-2024-53822 | Critical | 10.0 | 2024-12-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3. |
CVE-2024-53819 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices.This issue affects Client Invoicing by Sprout Invoices: fro… |
CVE-2024-53818 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from… |
CVE-2024-53816 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.This issue affects Tutor LMS Elementor Addons: from n/a th… |
CVE-2024-53798 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion.This issue affects FloristPress: from n/a through <= 7.3.0. |
CVE-2024-53791 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core all… |
CVE-2024-53790 | High | 7.5 | 2024-12-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows PH… |
CVE-2024-53785 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Alexander Volkov Chatter.This issue affects Chatter: from n/a through 1.0.1. |
CVE-2024-43222 | Critical | 9.8 | 2024-12-09 | Missing Authorization vulnerability in SeventhQueen Sweet Date sweetdate allows Privilege Escalation.This issue affects Sweet Date: from n/a through <= 3.7.3. |
CVE-2024-46901 | Low | 3.1 | 2024-12-09 | Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit… |
CVE-2024-12307 | Medium | 4.3 | 2024-12-09 | A function-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows teachers to modify student personal data… |
CVE-2024-12306 | Medium | 4.3 | 2024-12-09 | Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of s… |
CVE-2024-12305 | Medium | 4.3 | 2024-12-09 | An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades. A m… |
CVE-2024-9651 | Medium | 6.1 | 2024-12-09 | The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-12360 | Medium | 6.3 | 2024-12-09 | A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been rated as critical. This issue affects some unknown processi… |
CVE-2024-12359 | Low | 3.5 | 2024-12-09 | A vulnerability was found in code-projects Admin Dashboard 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /vendo… |
CVE-2024-12358 | Medium | 6.3 | 2024-12-09 | A vulnerability was found in WeiYe-Jing datax-web 2.1.1. It has been classified as critical. This affects an unknown part of the file /api/job/add/. The manipu… |
CVE-2024-12357 | Medium | 4.3 | 2024-12-09 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this issue is some unknown funct… |
CVE-2024-53285 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM… |
CVE-2024-53284 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in Synology Router Man… |
CVE-2024-53283 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in Synology Router Mana… |
CVE-2024-53282 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter functionality in Synology Router… |
CVE-2024-53281 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in Synology Router Manager (SRM… |
CVE-2024-53280 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functionality in Synology Rou… |
CVE-2024-53279 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SR… |
CVE-2024-55582 | Medium | 5.7 | 2024-12-09 | Oxide before 6 has unencrypted Control Plane datastores. |
CVE-2024-55580 | High | 7.5 | 2024-12-09 | An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. Unprivileged users with network access may be able to execute remote comm… |
CVE-2024-55579 | High | 8.8 | 2024-12-09 | An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able to create connection… |
CVE-2024-55578 | Medium | 4.3 | 2024-12-09 | Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files. |
CVE-2024-55566 | Medium | 6.6 | 2024-12-09 | ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG). The impact can be overwriting fi… |
CVE-2024-55565 | Medium | 4.3 | 2024-12-09 | nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version. |
CVE-2024-55564 | Critical | 9.8 | 2024-12-09 | The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow. |
CVE-2024-12355 | Low | 3.3 | 2024-12-09 | A vulnerability has been found in SourceCodester Phone Contact Manager System 1.0 and classified as problematic. Affected by this vulnerability is the function… |
CVE-2024-12354 | Medium | 5.3 | 2024-12-09 | A vulnerability, which was classified as critical, was found in SourceCodester Phone Contact Manager System 1.0. Affected is the function UserInterface::MenuDi… |
CVE-2024-12353 | Low | 3.3 | 2024-12-09 | A vulnerability, which was classified as problematic, has been found in SourceCodester Phone Contact Manager System 1.0. This issue affects the function UserIn… |
CVE-2024-12352 | Medium | 4.3 | 2024-12-09 | A vulnerability classified as problematic was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function sub_40662C of the file… |
CVE-2024-55563 | Medium | 5.3 | 2024-12-09 | Bitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913. For example, the outcome of an… |
CVE-2024-12351 | Medium | 6.3 | 2024-12-09 | A vulnerability classified as critical has been found in JFinalCMS 1.0. This affects the function findPage of the file src\main\java\com\cms\entity\ContentMode… |
CVE-2024-12350 | Medium | 6.3 | 2024-12-09 | A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\con… |
CVE-2024-12349 | Medium | 4.3 | 2024-12-09 | A vulnerability was found in JFinalCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/… |
CVE-2024-12348 | Low | 3.5 | 2024-12-09 | A vulnerability was found in Guizhou Xiaoma Technology jpress 5.1.2. It has been classified as problematic. Affected is the function AttachmentUtils.isUnSafe o… |
CVE-2024-12347 | Medium | 5.3 | 2024-12-09 | A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing o… |
CVE-2024-12346 | Low | 3.5 | 2024-12-09 | A vulnerability has been found in Talentera up to 20241128 and classified as problematic. This vulnerability affects unknown code of the file /app/control/byt_… |
CVE-2024-55560 | Critical | 9.8 | 2024-12-08 | MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installation. |
CVE-2024-12344 | Medium | 6.3 | 2024-12-08 | A vulnerability, which was classified as critical, was found in TP-Link VN020 F3v(T) TT_V6.2.1021. This affects an unknown part of the component FTP USER Comma… |
CVE-2024-12343 | Medium | 6.5 | 2024-12-08 | A vulnerability classified as critical has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected is an unknown function of the file /control/WANIPConnectio… |
CVE-2024-12342 | Medium | 6.5 | 2024-12-08 | A vulnerability was found in TP-Link VN020 F3v(T) TT_V6.2.1021. It has been rated as critical. This issue affects some unknown processing of the file /control/… |
CVE-2024-12209 | Critical | 9.8 | 2024-12-08 | The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via… |
CVE-2024-53473 | High | 7.5 | 2024-12-07 | WeGIA 3.2.0 before 3998672 does not verify permission to change a password. |
CVE-2024-47107 | Medium | 6.4 | 2024-12-07 | IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web U… |
CVE-2024-41762 | Medium | 5.3 | 2024-12-07 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certa… |
CVE-2024-47115 | High | 7.8 | 2024-12-07 | IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input. |