2024 CVEs (page 82)
Page 82 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53283 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in Synology Router Mana… |
CVE-2024-53282 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter functionality in Synology Router… |
CVE-2024-53281 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in Synology Router Manager (SRM… |
CVE-2024-53280 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functionality in Synology Rou… |
CVE-2024-53279 | Medium | 5.9 | 2024-12-09 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SR… |
CVE-2024-55582 | Medium | 5.7 | 2024-12-09 | Oxide before 6 has unencrypted Control Plane datastores. |
CVE-2024-55580 | High | 7.5 | 2024-12-09 | An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. Unprivileged users with network access may be able to execute remote comm… |
CVE-2024-55579 | High | 8.8 | 2024-12-09 | An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able to create connection… |
CVE-2024-55578 | Medium | 4.3 | 2024-12-09 | Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files. |
CVE-2024-55566 | Medium | 6.6 | 2024-12-09 | ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG). The impact can be overwriting fi… |
CVE-2024-55565 | Medium | 4.3 | 2024-12-09 | nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version. |
CVE-2024-55564 | Critical | 9.8 | 2024-12-09 | The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow. |
CVE-2024-12355 | Low | 3.3 | 2024-12-09 | A vulnerability has been found in SourceCodester Phone Contact Manager System 1.0 and classified as problematic. Affected by this vulnerability is the function… |
CVE-2024-12354 | Medium | 5.3 | 2024-12-09 | A vulnerability, which was classified as critical, was found in SourceCodester Phone Contact Manager System 1.0. Affected is the function UserInterface::MenuDi… |
CVE-2024-12353 | Low | 3.3 | 2024-12-09 | A vulnerability, which was classified as problematic, has been found in SourceCodester Phone Contact Manager System 1.0. This issue affects the function UserIn… |
CVE-2024-12352 | Medium | 4.3 | 2024-12-09 | A vulnerability classified as problematic was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function sub_40662C of the file… |
CVE-2024-55563 | Medium | 5.3 | 2024-12-09 | Bitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913. For example, the outcome of an… |
CVE-2024-12351 | Medium | 6.3 | 2024-12-09 | A vulnerability classified as critical has been found in JFinalCMS 1.0. This affects the function findPage of the file src\main\java\com\cms\entity\ContentMode… |
CVE-2024-12350 | Medium | 6.3 | 2024-12-09 | A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\con… |
CVE-2024-12349 | Medium | 4.3 | 2024-12-09 | A vulnerability was found in JFinalCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/… |
CVE-2024-12348 | Low | 3.5 | 2024-12-09 | A vulnerability was found in Guizhou Xiaoma Technology jpress 5.1.2. It has been classified as problematic. Affected is the function AttachmentUtils.isUnSafe o… |
CVE-2024-12347 | Medium | 5.3 | 2024-12-09 | A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing o… |
CVE-2024-12346 | Low | 3.5 | 2024-12-09 | A vulnerability has been found in Talentera up to 20241128 and classified as problematic. This vulnerability affects unknown code of the file /app/control/byt_… |
CVE-2024-55560 | Critical | 9.8 | 2024-12-08 | MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installation. |
CVE-2024-12344 | Medium | 6.3 | 2024-12-08 | A vulnerability, which was classified as critical, was found in TP-Link VN020 F3v(T) TT_V6.2.1021. This affects an unknown part of the component FTP USER Comma… |
CVE-2024-12343 | Medium | 6.5 | 2024-12-08 | A vulnerability classified as critical has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected is an unknown function of the file /control/WANIPConnectio… |
CVE-2024-12342 | Medium | 6.5 | 2024-12-08 | A vulnerability was found in TP-Link VN020 F3v(T) TT_V6.2.1021. It has been rated as critical. This issue affects some unknown processing of the file /control/… |
CVE-2024-12209 | Critical | 9.8 | 2024-12-08 | The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via… |
CVE-2024-53473 | High | 7.5 | 2024-12-07 | WeGIA 3.2.0 before 3998672 does not verify permission to change a password. |
CVE-2024-47107 | Medium | 6.4 | 2024-12-07 | IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web U… |
CVE-2024-41762 | Medium | 5.3 | 2024-12-07 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certa… |
CVE-2024-47115 | High | 7.8 | 2024-12-07 | IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input. |
CVE-2024-37071 | Medium | 5.3 | 2024-12-07 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user to cause a denial of service with a sp… |
CVE-2024-11501 | High | 8.8 | 2024-12-07 | The Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input from wd… |
CVE-2024-11464 | Medium | 6.1 | 2024-12-07 | The Easy Code Snippets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0… |
CVE-2024-11457 | Medium | 6.1 | 2024-12-07 | The Feedpress Generator – External RSS Frontend Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all… |
CVE-2024-11380 | Medium | 6.4 | 2024-12-07 | The Mini Program API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'qvideo' shortcode in all versions up to, and including… |
CVE-2024-12270 | High | 7.5 | 2024-12-07 | The Beautiful taxonomy filters plugin for WordPress is vulnerable to SQL Injection via the 'selects[0][term]' parameter in all versions up to, and including, 2… |
CVE-2024-12253 | Medium | 5.4 | 2024-12-07 | The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability c… |
CVE-2024-12128 | Medium | 6.1 | 2024-12-07 | The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘monthly_s… |
CVE-2024-11374 | Medium | 6.1 | 2024-12-07 | The TWChat – Send or receive messages from users plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg withou… |
CVE-2024-11367 | Medium | 6.1 | 2024-12-07 | The Smoove connector for Elementor forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropria… |
CVE-2024-11010 | High | 7.2 | 2024-12-07 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and includi… |
CVE-2024-53143 | High | 7.8 | 2024-12-07 | In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix ordering of iput() and watched_objects decrement Ensure the superblock is k… |
CVE-2024-11183 | Medium | 4.8 | 2024-12-07 | The Simple Side Tab WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-8679 | Medium | 6.8 | 2024-12-07 | The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the ‘value' parameter of the owt_lib_han… |
CVE-2024-7894 | Medium | 5.3 | 2024-12-07 | The If Menu plugin for WordPress is vulnerable to unauthorized modification of the plugin's license key due to a missing capability check on the 'actions' func… |
CVE-2024-12257 | Medium | 6.1 | 2024-12-07 | The CardGate Payments for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and… |
CVE-2024-12167 | Medium | 6.1 | 2024-12-07 | The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to… |
CVE-2024-12166 | Medium | 6.1 | 2024-12-07 | The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and… |
CVE-2024-12165 | Medium | 6.1 | 2024-12-07 | The Mollie for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and includin… |
CVE-2024-12115 | Medium | 4.3 | 2024-12-07 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-12026 | Medium | 4.3 | 2024-12-07 | The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveFilt… |
CVE-2024-11943 | Medium | 6.1 | 2024-12-07 | The 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() function without approp… |
CVE-2024-11904 | Medium | 6.4 | 2024-12-07 | The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'msntt_add_plus_talk' shortcode in all versions up to, and incl… |
CVE-2024-11451 | Medium | 6.4 | 2024-12-07 | The Zooom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zooom' shortcode in all versions up to, and including, 1.1.0 due… |
CVE-2024-11436 | Medium | 6.1 | 2024-12-07 | The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Refl… |
CVE-2024-11353 | Medium | 4.3 | 2024-12-07 | The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_message(… |
CVE-2024-11329 | Medium | 6.1 | 2024-12-07 | The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without app… |
CVE-2024-10046 | Medium | 6.1 | 2024-12-07 | The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg withou… |
CVE-2024-54138 | Medium | 6.1 | 2024-12-06 | NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown con… |
CVE-2024-44856 | High | 7.5 | 2024-12-06 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_smac_planner(). |
CVE-2024-44855 | High | 7.5 | 2024-12-06 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_navfn_planner(). |
CVE-2024-44854 | High | 7.5 | 2024-12-06 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component smoothPlan(). |
CVE-2024-44853 | High | 7.5 | 2024-12-06 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component computeControl(). |
CVE-2024-44852 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation via the component theta_star::ThetaStar… |
CVE-2024-41650 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41649 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41648 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41647 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41646 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41645 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41644 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the d… |
CVE-2024-38927 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38926 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38925 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38924 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38923 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38922 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2_amcl process. This vulnerability… |
CVE-2024-38921 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-7875 | | 2024-12-06 | Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpScreenResolutionWidth param… | |
CVE-2024-7874 | | 2024-12-06 | Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpConnectionId parameter mani… | |
CVE-2024-12326 | Medium | 6.1 | 2024-12-06 | Jirafeau normally prevents browser preview for SVG files due to the possibility that manipulated SVG files could be exploited for cross site scripting. This wa… |
CVE-2024-0139 | Medium | 4.4 | 2024-12-06 | NVIDIA Base Command Manager and Bright Cluster Manager for Linux contain an insecure temporary file vulnerability. A successful exploit of this vulnerability m… |
CVE-2024-0130 | High | 8.8 | 2024-12-06 | NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malform… |
CVE-2024-52324 | Critical | 9.8 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT m… |
CVE-2024-48874 | Critical | 9.8 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the at… |
CVE-2024-47791 | High | 7.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and rec… |
CVE-2024-47146 | Medium | 6.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial number if physically adjacent and sniffin… |
CVE-2024-46874 | High | 8.1 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. A… |
CVE-2024-45722 | High | 7.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentia… |
CVE-2024-52558 | Medium | 5.3 | 2024-12-06 | The affected product is vulnerable to an integer underflow. An unauthenticated attacker could send a malformed HTTP request, which could allow the attacker to… |
CVE-2024-52320 | Critical | 9.8 | 2024-12-06 | The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result… |
CVE-2024-51727 | Medium | 6.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and c… |
CVE-2024-48871 | Critical | 9.8 | 2024-12-06 | The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails t… |
CVE-2024-48703 | Medium | 4.8 | 2024-12-06 | PhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/search-medicalcard.php via the searchdata parameter. |
CVE-2024-47547 | Critical | 9.4 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication… |
CVE-2024-47043 | High | 7.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's phone number and p… |
CVE-2024-42494 | Medium | 6.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensit… |
CVE-2024-11220 | High | 7.8 | 2024-12-06 | A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server syste… |