2024 CVEs (page 83)
Page 83 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55268 | Medium | 6.1 | 2024-12-06 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /covidtms/registered-user-testing.php in PHPGurukul COVID 19 Testing Management System 1.0 wh… |
CVE-2024-54749 | High | 7.5 | 2024-12-06 | Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: this is dis… |
CVE-2024-54143 | | 2024-12-06 | openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This si… | |
CVE-2024-53691 | High | 8.8 | 2024-12-06 | A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-50404 | High | 8.8 | 2024-12-06 | A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user acc… |
CVE-2024-50403 | High | 7.2 | 2024-12-06 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50402 | High | 7.2 | 2024-12-06 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50393 | Critical | 9.8 | 2024-12-06 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-50389 | Critical | 9.8 | 2024-12-06 | A SQL injection vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to inject malicious code. We… |
CVE-2024-50388 | Critical | 9.8 | 2024-12-06 | An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to exe… |
CVE-2024-50387 | Critical | 9.8 | 2024-12-06 | A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-48868 | High | 7.5 | 2024-12-06 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-48867 | High | 7.5 | 2024-12-06 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-48866 | Medium | 5.3 | 2024-12-06 | An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnera… |
CVE-2024-48865 | High | 7.5 | 2024-12-06 | An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allo… |
CVE-2024-48863 | Critical | 9.8 | 2024-12-06 | A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to execute arbitrary… |
CVE-2024-48859 | Critical | 9.1 | 2024-12-06 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-54750 | Critical | 9.8 | 2024-12-06 | Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: In Ubiquiti'… |
CVE-2024-54747 | Critical | 9.8 | 2024-12-06 | WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-54745 | Critical | 9.8 | 2024-12-06 | WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-54137 | High | 7.4 | 2024-12-06 | liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in… |
CVE-2024-54136 | Critical | 9.8 | 2024-12-06 | ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerabilit… |
CVE-2024-54135 | Critical | 9.8 | 2024-12-06 | ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulner… |
CVE-2024-50677 | Medium | 6.1 | 2024-12-06 | A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int… |
CVE-2024-30129 | Medium | 5.3 | 2024-12-06 | The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be se… |
CVE-2024-12254 | High | 7.5 | 2024-12-06 | Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer… |
CVE-2024-54141 | High | 8.6 | 2024-12-06 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgr… |
CVE-2024-42196 | Medium | 6.2 | 2024-12-06 | HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs. |
CVE-2024-11738 | Medium | 5.3 | 2024-12-06 | A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message. |
CVE-2024-54216 | High | 7.7 | 2024-12-06 | Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2. |
CVE-2024-54214 | Critical | 10.0 | 2024-12-06 | Unrestricted Upload of File with Dangerous Type vulnerability in roninwp Revy revy allows Upload a Web Shell to a Web Server.This issue affects Revy: from n/a… |
CVE-2024-54213 | Medium | 6.5 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zionbuilder ZionBuilder zionbuilder allows Stored XSS.Thi… |
CVE-2024-54212 | Medium | 6.5 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for… |
CVE-2024-54211 | Medium | 5.9 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visualmodo Borderless borderless allows Cross-Site Script… |
CVE-2024-54210 | Medium | 6.5 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codexshaper Advanced Element Bucket Addons for Elementor… |
CVE-2024-54209 | High | 7.1 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Awesome Shortcodes awesome-shortcodes allows Re… |
CVE-2024-54208 | High | 7.1 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joni Halabi Block Controller block-controller allows Refl… |
CVE-2024-54207 | Medium | 5.9 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows Stor… |
CVE-2024-54206 | Medium | 5.9 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in URBAN BASE Z-Downloads z-downloads allows Stored XSS.This… |
CVE-2024-54205 | High | 7.1 | 2024-12-06 | Cross-Site Request Forgery (CSRF) vulnerability in Paloma Paloma Widget postman-widget allows Cross Site Request Forgery.This issue affects Paloma Widget: from… |
CVE-2024-53826 | Medium | 5.3 | 2024-12-06 | Missing Authorization vulnerability in WPSight WPCasa wpcasa allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPCasa: from n/… |
CVE-2024-53825 | Medium | 4.7 | 2024-12-06 | Missing Authorization vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-53824 | High | 7.5 | 2024-12-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in all_bootstrap_blocks All Bootstrap Blo… |
CVE-2024-53823 | Medium | 6.5 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite… |
CVE-2024-53821 | High | 7.1 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Genetech Pie Register Premium allows Reflected XSS.This i… |
CVE-2024-53820 | Medium | 6.5 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows… |
CVE-2024-53817 | High | 7.6 | 2024-12-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acowebs Product Labels For Woocommerce aco-product-labels… |
CVE-2024-53815 | High | 8.5 | 2024-12-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows… |
CVE-2024-53813 | Medium | 6.5 | 2024-12-06 | Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-53812 | High | 7.1 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacques Malgrange WP GeoNames wp-geonames allows Reflecte… |
CVE-2024-53811 | Medium | 6.6 | 2024-12-06 | Unrestricted Upload of File with Dangerous Type vulnerability in POSIMYTH WDesignkit wdesignkit allows Upload a Web Shell to a Web Server.This issue affects WD… |
CVE-2024-53810 | Critical | 9.1 | 2024-12-06 | Missing Authorization vulnerability in N-Media Simple User Registration wp-registration allows Accessing Functionality Not Properly Constrained by ACLs.This is… |
CVE-2024-53809 | Medium | 4.3 | 2024-12-06 | Cross-Site Request Forgery (CSRF) vulnerability in Bob Namaste! LMS namaste-lms allows Cross Site Request Forgery.This issue affects Namaste! LMS: from n/a thr… |
CVE-2024-53808 | High | 8.5 | 2024-12-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows… |
CVE-2024-53807 | High | 8.5 | 2024-12-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brandtoss WP Mailster wp-mailster allows Blind SQL Inject… |
CVE-2024-53806 | Medium | 5.4 | 2024-12-06 | Missing Authorization vulnerability in yonifre Maspik – Spam blacklist contact-forms-anti-spam allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-53805 | High | 7.5 | 2024-12-06 | Missing Authorization vulnerability in brandtoss WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2024-53804 | High | 7.5 | 2024-12-06 | Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2024-53803 | Medium | 6.5 | 2024-12-06 | Missing Authorization vulnerability in brandtoss WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2024-53802 | Medium | 6.5 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.T… |
CVE-2024-53801 | Medium | 6.5 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Sto… |
CVE-2024-53799 | Medium | 4.3 | 2024-12-06 | Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2024-53797 | Medium | 6.5 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version… |
CVE-2024-53796 | Medium | 6.5 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-add… |
CVE-2024-53795 | Medium | 5.3 | 2024-12-06 | Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2024-53794 | Medium | 6.5 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks allows Stored XSS.This issu… |
CVE-2024-52335 | Critical | 9.8 | 2024-12-06 | A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF05). The affected application do not properly sanitize input data before sendi… |
CVE-2024-51815 | Critical | 9.0 | 2024-12-06 | Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.This issue affects s2Member… |
CVE-2024-51615 | Critical | 9.3 | 2024-12-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows SQL… |
CVE-2024-4633 | Medium | 6.4 | 2024-12-06 | The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘addExtraMimeType’ function in versions up… |
CVE-2024-21571 | High | 8.1 | 2024-12-06 | Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to execute arbitrary code… |
CVE-2024-11321 | Medium | 5.4 | 2024-12-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hi e-learning Learning Management System (LMS) all… |
CVE-2024-10516 | High | 8.1 | 2024-12-06 | The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' funct… |
CVE-2024-11022 | Medium | 5.6 | 2024-12-06 | The authentication process to the web server uses a challenge response procedure which inludes the nonce and additional information. This challenge can be used… |
CVE-2024-10776 | High | 8.2 | 2024-12-06 | Lua apps can be deployed, removed, started, reloaded or stopped without authorization via AppManager. This allows an attacker to remove legitimate apps creatin… |
CVE-2024-10774 | High | 7.3 | 2024-12-06 | Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication. |
CVE-2024-10773 | Critical | 9.0 | 2024-12-06 | The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with… |
CVE-2024-10772 | High | 8.8 | 2024-12-06 | Since the firmware update is not validated, an attacker can install modified firmware on the device. This has a high impact on the availabilty, integrity and c… |
CVE-2024-10771 | High | 8.8 | 2024-12-06 | Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the… |
CVE-2024-53908 | Critical | 9.8 | 2024-12-06 | An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, w… |
CVE-2024-53907 | High | 7.5 | 2024-12-06 | An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject… |
CVE-2024-11730 | Medium | 6.5 | 2024-12-06 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of the static_data_list… |
CVE-2024-11729 | Medium | 6.5 | 2024-12-06 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service_id]' parameter of… |
CVE-2024-53142 | High | 7.8 | 2024-12-06 | In the Linux kernel, the following vulnerability has been resolved: initramfs: avoid filename buffer overrun The initramfs filename field is defined in Docum… |
CVE-2024-53141 | High | 7.8 | 2024-12-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range check in bitmap_ip_uadt When tb[IPSET_ATTR_IP_TO] is… |
CVE-2024-11728 | High | 7.5 | 2024-12-06 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the t… |
CVE-2024-11460 | High | 7.5 | 2024-12-06 | The Verowa Connect plugin for WordPress is vulnerable to SQL Injection via the 'search_string' parameter in all versions up to, and including, 3.0.1 due to ins… |
CVE-2024-11289 | High | 8.1 | 2024-12-06 | The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.5.9 via several functions like penci_archive_more… |
CVE-2024-10909 | Medium | 6.3 | 2024-12-06 | The The Pojo Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via form_preview_shortcode AJAX action in all versions up to, and includ… |
CVE-2024-10681 | Medium | 6.3 | 2024-12-06 | The The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to arbitrary shortcode… |
CVE-2024-9872 | Medium | 5.4 | 2024-12-06 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2024-9866 | Medium | 5.4 | 2024-12-06 | The Event Tickets with Ticket Scanner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameters in all versions up to, and in… |
CVE-2024-9706 | Medium | 5.3 | 2024-12-06 | The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ucsm_ac… |
CVE-2024-9705 | Medium | 4.3 | 2024-12-06 | The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ucsm_u… |
CVE-2024-12155 | Critical | 9.8 | 2024-12-06 | The SV100 Companion plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability c… |
CVE-2024-12110 | Medium | 4.3 | 2024-12-06 | The Gold Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate() and d… |
CVE-2024-12060 | Medium | 6.1 | 2024-12-06 | The WP Media Optimizer (.webp) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpmowebp-css-resources’ and 'wpmowebp-js-resources… |
CVE-2024-12028 | Medium | 5.3 | 2024-12-06 | The Friends plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several REST API endpoints in all versions up to, an… |
CVE-2024-12027 | Medium | 4.3 | 2024-12-06 | The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFi… |
CVE-2024-12003 | Medium | 6.1 | 2024-12-06 | The WP System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect… |