2024 CVEs (page 81)
Page 81 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55601 | | 2024-12-09 | Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed be… | |
CVE-2024-50628 | High | 8.8 | 2024-12-09 | An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. It allows an attacker on the local area network to achieve unauthorized mani… |
CVE-2024-50627 | High | 8.8 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It allows an attacker on… |
CVE-2024-50626 | High | 8.8 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal vulnerability exists in WebFS. This allows an attacker on the local area n… |
CVE-2024-50625 | High | 8.0 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file pat… |
CVE-2024-12174 | Low | 2.7 | 2024-12-09 | An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages s… |
CVE-2024-54151 | High | 7.5 | 2024-12-09 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKE… |
CVE-2024-54149 | High | 8.4 | 2024-12-09 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow… |
CVE-2024-46455 | Critical | 9.8 | 2024-12-09 | unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser. |
CVE-2024-12369 | Medium | 4.2 | 2024-12-09 | A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authori… |
CVE-2024-53441 | Critical | 9.1 | 2024-12-09 | An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack. |
CVE-2024-54938 | High | 7.5 | 2024-12-09 | A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via… |
CVE-2024-54934 | Critical | 9.8 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class.php. |
CVE-2024-54932 | Critical | 9.8 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_department.php. |
CVE-2024-54931 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL com… |
CVE-2024-54928 | High | 7.2 | 2024-12-09 | kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_teacher.php, |
CVE-2024-54927 | High | 7.2 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_users.php. |
CVE-2024-54925 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL co… |
CVE-2024-54924 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL com… |
CVE-2024-54923 | Critical | 9.8 | 2024-12-09 | A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arb… |
CVE-2024-54921 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /student_signup.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command… |
CVE-2024-54918 | Critical | 9.8 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher_avatar.php. |
CVE-2024-54147 | Medium | 6.8 | 2024-12-09 | Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-i… |
CVE-2024-53847 | | 2024-12-09 | The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. A… | |
CVE-2024-52599 | Medium | 5.4 | 2024-12-09 | Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tu… |
CVE-2024-52586 | Medium | 5.4 | 2024-12-09 | eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to version 5.1.0 that a… |
CVE-2024-48956 | Critical | 9.8 | 2024-12-09 | Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a service endpoint r… |
CVE-2024-46547 | High | 7.5 | 2024-12-09 | A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access sensitive informati… |
CVE-2024-12057 | | 2024-12-09 | User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with t… | |
CVE-2024-54935 | Medium | 5.4 | 2024-12-09 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message_teacher_to_student.php of kashipara E-learning Management System v1.0. This vulner… |
CVE-2024-54933 | High | 7.2 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_content.php. |
CVE-2024-54930 | High | 7.2 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_student.php. |
CVE-2024-54922 | High | 7.2 | 2024-12-09 | A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL comman… |
CVE-2024-11608 | High | 7.8 | 2024-12-09 | A maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vu… |
CVE-2024-11454 | High | 7.8 | 2024-12-09 | A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context o… |
CVE-2024-11268 | Medium | 5.5 | 2024-12-09 | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read. A malicious actor can leverage this vulnerability to cause… |
CVE-2024-54926 | High | 8.8 | 2024-12-09 | A SQL Injection vulnerability was found in /search_class.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary… |
CVE-2024-53450 | High | 7.5 | 2024-12-09 | RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents. |
CVE-2024-45761 | Medium | 5.4 | 2024-12-09 | Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user… |
CVE-2024-45760 | Medium | 4.3 | 2024-12-09 | Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper access control vulnerability. A remote low privileged user could potent… |
CVE-2024-40583 | Critical | 9.1 | 2024-12-09 | Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials. |
CVE-2024-40582 | High | 7.5 | 2024-12-09 | Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information. |
CVE-2024-54920 | Critical | 9.8 | 2024-12-09 | A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitra… |
CVE-2024-54919 | Medium | 5.4 | 2024-12-09 | A Stored Cross Site Scripting (XSS ) was found in /teacher_avatar.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attacker… |
CVE-2024-49603 | Medium | 4.3 | 2024-12-09 | Dell PowerScale OneFS Versions 8.2.2.x through 9.9.0.x contain an incorrect specified argument vulnerability. A remote low privileged legitimate user could pot… |
CVE-2024-49602 | Medium | 6.5 | 2024-12-09 | Dell PowerScale OneFS Versions 8.2.2.x through 9.8.0.x contain an improper resource unlocking vulnerability. A remote low privileged attacker could potentially… |
CVE-2024-49600 | High | 7.8 | 2024-12-09 | Dell Power Manager (DPM), versions prior to 3.17, contain an improper access control vulnerability. A low privileged attacker with local access could potential… |
CVE-2024-42426 | Medium | 4.3 | 2024-12-09 | Dell PowerScale OneFS Versions 9.5.0.x through 9.8.0.x contain an uncontrolled resource consumption vulnerability. A low privilege remote attacker could potent… |
CVE-2024-38485 | Medium | 4.3 | 2024-12-09 | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerabil… |
CVE-2024-11991 | Medium | 5.6 | 2024-12-09 | Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vu… |
CVE-2024-8259 | Critical | 9.8 | 2024-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Manage… |
CVE-2024-54937 | Medium | 5.3 | 2024-12-09 | A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via… |
CVE-2024-54936 | Medium | 5.4 | 2024-12-09 | A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message.php of Kashipara E-learning Management System v1.0. This vulnerability allows remo… |
CVE-2024-54929 | High | 7.2 | 2024-12-09 | KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_subject.php. |
CVE-2024-54218 | Medium | 6.5 | 2024-12-09 | Missing Authorization vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Contact: from n/a through <= 2.8.1. |
CVE-2024-53949 | Medium | 6.5 | 2024-12-09 | Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use thi… |
CVE-2024-53948 | Medium | 5.3 | 2024-12-09 | Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recomme… |
CVE-2024-53947 | Critical | 9.8 | 2024-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific fu… |
CVE-2024-53814 | Medium | 6.5 | 2024-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Adnan Analytify wp-analytify.This issue affects Analytify: from n/a… |
CVE-2024-52480 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Astoundify Jobify jobify.This issue affects Jobify: from n/a through < 4.3.0. |
CVE-2024-52391 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3. |
CVE-2024-52385 | Medium | 4.3 | 2024-12-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpmart Team Member team-showcase-supre… |
CVE-2024-54260 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-… |
CVE-2024-54255 | Medium | 4.7 | 2024-12-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in aviplugins.com Login Widget With Shortcode login-sidebar-widget allows Phishing.This issue… |
CVE-2024-54254 | Medium | 6.3 | 2024-12-09 | Missing Authorization vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter.This issue affects Message Filter for Contact Form 7: f… |
CVE-2024-54253 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons.This iss… |
CVE-2024-54251 | Medium | 6.5 | 2024-12-09 | Missing Authorization vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2024-54247 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABCBiz ABCBiz Addons and Templates for Elementor allows S… |
CVE-2024-54232 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RRDevs RRAddons for Elementor rrdevs-for-elementor allows… |
CVE-2024-54230 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masud Hasan Unlock Addons for Elementor unlock-addons-for… |
CVE-2024-54228 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Wot Elementor Widgets wot-… |
CVE-2024-54227 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Dotstore Minimum and Maximum Quantity for WooCommerce min-and-max-quantity-for-woocommerce allows Exploiting Incorrectly… |
CVE-2024-54226 | High | 7.1 | 2024-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in karlkiesinger Country Blocker country-blocker allows Stored XSS.This issue affects Country Blocker: from n/a… |
CVE-2024-54225 | High | 7.5 | 2024-12-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codegearthemes Designer designer allow… |
CVE-2024-54224 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quomodosoft ElementsReady Addons for Elementor element-re… |
CVE-2024-54223 | Medium | 5.3 | 2024-12-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allo… |
CVE-2024-54220 | High | 7.1 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Services Booking fat-services-booking allows… |
CVE-2024-54219 | High | 7.1 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Cont… |
CVE-2024-54217 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.1. |
CVE-2024-54215 | Critical | 9.3 | 2024-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy.This issue affects Revy: from n/a throu… |
CVE-2024-53822 | Critical | 10.0 | 2024-12-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3. |
CVE-2024-53819 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices.This issue affects Client Invoicing by Sprout Invoices: fro… |
CVE-2024-53818 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from… |
CVE-2024-53816 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.This issue affects Tutor LMS Elementor Addons: from n/a th… |
CVE-2024-53798 | Medium | 5.4 | 2024-12-09 | Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion.This issue affects FloristPress: from n/a through <= 7.3.0. |
CVE-2024-53791 | Medium | 6.5 | 2024-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core all… |
CVE-2024-53790 | High | 7.5 | 2024-12-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows PH… |
CVE-2024-53785 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Alexander Volkov Chatter.This issue affects Chatter: from n/a through 1.0.1. |
CVE-2024-43222 | Critical | 9.8 | 2024-12-09 | Missing Authorization vulnerability in SeventhQueen Sweet Date sweetdate allows Privilege Escalation.This issue affects Sweet Date: from n/a through <= 3.7.3. |
CVE-2024-46901 | Low | 3.1 | 2024-12-09 | Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit… |
CVE-2024-12307 | Medium | 4.3 | 2024-12-09 | A function-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows teachers to modify student personal data… |
CVE-2024-12306 | Medium | 4.3 | 2024-12-09 | Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of s… |
CVE-2024-12305 | Medium | 4.3 | 2024-12-09 | An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades. A m… |
CVE-2024-9651 | Medium | 6.1 | 2024-12-09 | The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-12360 | Medium | 6.3 | 2024-12-09 | A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been rated as critical. This issue affects some unknown processi… |
CVE-2024-12359 | Low | 3.5 | 2024-12-09 | A vulnerability was found in code-projects Admin Dashboard 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /vendo… |
CVE-2024-12358 | Medium | 6.3 | 2024-12-09 | A vulnerability was found in WeiYe-Jing datax-web 2.1.1. It has been classified as critical. This affects an unknown part of the file /api/job/add/. The manipu… |
CVE-2024-12357 | Medium | 4.3 | 2024-12-09 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this issue is some unknown funct… |
CVE-2024-53285 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM… |
CVE-2024-53284 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in Synology Router Man… |