2024 CVEs (page 82)
Page 82 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37071 | Medium | 5.3 | 2024-12-07 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user to cause a denial of service with a sp… |
CVE-2024-11501 | High | 8.8 | 2024-12-07 | The Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input from wd… |
CVE-2024-11464 | Medium | 6.1 | 2024-12-07 | The Easy Code Snippets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0… |
CVE-2024-11457 | Medium | 6.1 | 2024-12-07 | The Feedpress Generator – External RSS Frontend Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all… |
CVE-2024-11380 | Medium | 6.4 | 2024-12-07 | The Mini Program API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'qvideo' shortcode in all versions up to, and including… |
CVE-2024-12270 | High | 7.5 | 2024-12-07 | The Beautiful taxonomy filters plugin for WordPress is vulnerable to SQL Injection via the 'selects[0][term]' parameter in all versions up to, and including, 2… |
CVE-2024-12253 | Medium | 5.4 | 2024-12-07 | The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability c… |
CVE-2024-12128 | Medium | 6.1 | 2024-12-07 | The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘monthly_s… |
CVE-2024-11374 | Medium | 6.1 | 2024-12-07 | The TWChat – Send or receive messages from users plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg withou… |
CVE-2024-11367 | Medium | 6.1 | 2024-12-07 | The Smoove connector for Elementor forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria… |
CVE-2024-11010 | High | 7.2 | 2024-12-07 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and includi… |
CVE-2024-53143 | High | 7.8 | 2024-12-07 | In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix ordering of iput() and watched_objects decrement Ensure the superblock is k… |
CVE-2024-11183 | Medium | 4.8 | 2024-12-07 | The Simple Side Tab WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-8679 | Medium | 6.8 | 2024-12-07 | The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the ‘value' parameter of the owt_lib_han… |
CVE-2024-7894 | Medium | 5.3 | 2024-12-07 | The If Menu plugin for WordPress is vulnerable to unauthorized modification of the plugin's license key due to a missing capability check on the 'actions' func… |
CVE-2024-12257 | Medium | 6.1 | 2024-12-07 | The CardGate Payments for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and… |
CVE-2024-12167 | Medium | 6.1 | 2024-12-07 | The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to… |
CVE-2024-12166 | Medium | 6.1 | 2024-12-07 | The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and… |
CVE-2024-12165 | Medium | 6.1 | 2024-12-07 | The Mollie for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and includin… |
CVE-2024-12115 | Medium | 4.3 | 2024-12-07 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-12026 | Medium | 4.3 | 2024-12-07 | The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveFilt… |
CVE-2024-11943 | Medium | 6.1 | 2024-12-07 | The 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() function without approp… |
CVE-2024-11904 | Medium | 6.4 | 2024-12-07 | The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'msntt_add_plus_talk' shortcode in all versions up to, and incl… |
CVE-2024-11451 | Medium | 6.4 | 2024-12-07 | The Zooom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zooom' shortcode in all versions up to, and including, 1.1.0 due… |
CVE-2024-11436 | Medium | 6.1 | 2024-12-07 | The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Refl… |
CVE-2024-11353 | Medium | 4.3 | 2024-12-07 | The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_message(… |
CVE-2024-11329 | Medium | 6.1 | 2024-12-07 | The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without app… |
CVE-2024-10046 | Medium | 6.1 | 2024-12-07 | The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg withou… |
CVE-2024-54138 | Medium | 6.1 | 2024-12-06 | NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown con… |
CVE-2024-44856 | High | 7.5 | 2024-12-06 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_smac_planner(). |
CVE-2024-44855 | High | 7.5 | 2024-12-06 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_navfn_planner(). |
CVE-2024-44854 | High | 7.5 | 2024-12-06 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component smoothPlan(). |
CVE-2024-44853 | High | 7.5 | 2024-12-06 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component computeControl(). |
CVE-2024-44852 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation via the component theta_star::ThetaStar… |
CVE-2024-41650 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41649 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41648 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41647 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41646 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41645 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41644 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the d… |
CVE-2024-38927 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38926 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38925 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38924 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38923 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38922 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2_amcl process. This vulnerability… |
CVE-2024-38921 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-7875 | | 2024-12-06 | Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpScreenResolutionWidth param… | |
CVE-2024-7874 | | 2024-12-06 | Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpConnectionId parameter mani… | |
CVE-2024-12326 | Medium | 6.1 | 2024-12-06 | Jirafeau normally prevents browser preview for SVG files due to the possibility that manipulated SVG files could be exploited for cross site scripting. This wa… |
CVE-2024-0139 | Medium | 4.4 | 2024-12-06 | NVIDIA Base Command Manager and Bright Cluster Manager for Linux contain an insecure temporary file vulnerability. A successful exploit of this vulnerability m… |
CVE-2024-0130 | High | 8.8 | 2024-12-06 | NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malform… |
CVE-2024-52324 | Critical | 9.8 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT m… |
CVE-2024-48874 | Critical | 9.8 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the at… |
CVE-2024-47791 | High | 7.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and rec… |
CVE-2024-47146 | Medium | 6.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial number if physically adjacent and sniffin… |
CVE-2024-46874 | High | 8.1 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. A… |
CVE-2024-45722 | High | 7.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentia… |
CVE-2024-52558 | Medium | 5.3 | 2024-12-06 | The affected product is vulnerable to an integer underflow. An unauthenticated attacker could send a malformed HTTP request, which could allow the attacker to… |
CVE-2024-52320 | Critical | 9.8 | 2024-12-06 | The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result… |
CVE-2024-51727 | Medium | 6.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and c… |
CVE-2024-48871 | Critical | 9.8 | 2024-12-06 | The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails t… |
CVE-2024-48703 | Medium | 4.8 | 2024-12-06 | PhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/search-medicalcard.php via the searchdata parameter. |
CVE-2024-47547 | Critical | 9.4 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication… |
CVE-2024-47043 | High | 7.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's phone number and p… |
CVE-2024-42494 | Medium | 6.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensit… |
CVE-2024-11220 | High | 7.8 | 2024-12-06 | A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server syste… |
CVE-2024-55268 | Medium | 6.1 | 2024-12-06 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /covidtms/registered-user-testing.php in PHPGurukul COVID 19 Testing Management System 1.0 wh… |
CVE-2024-54749 | High | 7.5 | 2024-12-06 | Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: this is dis… |
CVE-2024-54143 | | 2024-12-06 | openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This si… | |
CVE-2024-53691 | High | 8.8 | 2024-12-06 | A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-50404 | High | 8.8 | 2024-12-06 | A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user acc… |
CVE-2024-50403 | High | 7.2 | 2024-12-06 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50402 | High | 7.2 | 2024-12-06 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50393 | Critical | 9.8 | 2024-12-06 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-50389 | Critical | 9.8 | 2024-12-06 | A SQL injection vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to inject malicious code. We… |
CVE-2024-50388 | Critical | 9.8 | 2024-12-06 | An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to exe… |
CVE-2024-50387 | Critical | 9.8 | 2024-12-06 | A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-48868 | High | 7.5 | 2024-12-06 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-48867 | High | 7.5 | 2024-12-06 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-48866 | Medium | 5.3 | 2024-12-06 | An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnera… |
CVE-2024-48865 | High | 7.5 | 2024-12-06 | An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allo… |
CVE-2024-48863 | Critical | 9.8 | 2024-12-06 | A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to execute arbitrary… |
CVE-2024-48859 | Critical | 9.1 | 2024-12-06 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-54750 | Critical | 9.8 | 2024-12-06 | Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: In Ubiquiti'… |
CVE-2024-54747 | Critical | 9.8 | 2024-12-06 | WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-54745 | Critical | 9.8 | 2024-12-06 | WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-54137 | High | 7.4 | 2024-12-06 | liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in… |
CVE-2024-54136 | Critical | 9.8 | 2024-12-06 | ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerabilit… |
CVE-2024-54135 | Critical | 9.8 | 2024-12-06 | ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulner… |
CVE-2024-50677 | Medium | 6.1 | 2024-12-06 | A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int… |
CVE-2024-30129 | Medium | 5.3 | 2024-12-06 | The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be se… |
CVE-2024-12254 | High | 7.5 | 2024-12-06 | Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer… |
CVE-2024-54141 | High | 8.6 | 2024-12-06 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgr… |
CVE-2024-42196 | Medium | 6.2 | 2024-12-06 | HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs. |
CVE-2024-11738 | Medium | 5.3 | 2024-12-06 | A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message. |
CVE-2024-54216 | High | 7.7 | 2024-12-06 | Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2. |
CVE-2024-54214 | Critical | 10.0 | 2024-12-06 | Unrestricted Upload of File with Dangerous Type vulnerability in roninwp Revy revy allows Upload a Web Shell to a Web Server.This issue affects Revy: from n/a… |
CVE-2024-54213 | Medium | 6.5 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zionbuilder ZionBuilder zionbuilder allows Stored XSS.Thi… |