2024 CVEs (page 84)
Page 84 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11823 | Medium | 6.1 | 2024-12-06 | The Folder Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'foldergallery' shortcode in all versions up to, and incl… |
CVE-2024-11687 | Medium | 6.1 | 2024-12-06 | The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up t… |
CVE-2024-11450 | Medium | 6.4 | 2024-12-06 | The ONLYOFFICE Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode in all versions up to, and includ… |
CVE-2024-11444 | Medium | 4.3 | 2024-12-06 | The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.13.2. This is due… |
CVE-2024-11368 | Medium | 6.1 | 2024-12-06 | The Splash Sync plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in… |
CVE-2024-11352 | Medium | 6.4 | 2024-12-06 | The TwentyTwenty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'twentytwenty' shortcode in all versions up to, and includi… |
CVE-2024-11339 | Medium | 6.4 | 2024-12-06 | The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and i… |
CVE-2024-11336 | Medium | 6.1 | 2024-12-06 | The Clickbank WordPress Plugin (Storefront) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is… |
CVE-2024-11323 | High | 8.8 | 2024-12-06 | The AI Quiz | Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capabil… |
CVE-2024-11292 | Medium | 5.3 | 2024-12-06 | The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress… |
CVE-2024-11276 | Medium | 6.1 | 2024-12-06 | The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' par… |
CVE-2024-11204 | Medium | 6.1 | 2024-12-06 | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all versions up to, and… |
CVE-2024-10879 | Medium | 6.1 | 2024-12-06 | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg… |
CVE-2024-10849 | Medium | 6.4 | 2024-12-06 | The NewsMash theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 1.0.71 due to… |
CVE-2024-10692 | Medium | 4.3 | 2024-12-06 | The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Information Exposure in all versions up to, and i… |
CVE-2024-10689 | Medium | 4.3 | 2024-12-06 | The XLTab – Accordions and Tabs for Elementor Page Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4… |
CVE-2024-10320 | Medium | 6.4 | 2024-12-06 | The Cookielay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookielay shortcode in all versions up to, and including, 1.2… |
CVE-2024-11178 | High | 8.1 | 2024-12-06 | The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating to… |
CVE-2024-11585 | High | 7.5 | 2024-12-06 | The WP Hide & Security Enhancer plugin for WordPress is vulnerable to arbitrary file contents deletion due to a missing authorization and insufficient file pat… |
CVE-2024-11201 | Medium | 6.4 | 2024-12-06 | The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credi… |
CVE-2024-10578 | High | 8.8 | 2024-12-06 | The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnews_importer_plugin_ac… |
CVE-2024-10551 | Medium | 4.8 | 2024-12-06 | The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-10480 | Medium | 4.3 | 2024-12-06 | The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admi… |
CVE-2024-11379 | Medium | 6.1 | 2024-12-06 | The Broadcast plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'do_check' parameter in all versions up to, and including, 51.01 due… |
CVE-2024-9769 | Medium | 4.4 | 2024-12-06 | The Video Gallery – Best WordPress YouTube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to… |
CVE-2024-10836 | Medium | 6.1 | 2024-12-06 | The Flixita theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.0.82 due to insu… |
CVE-2024-10247 | High | 7.2 | 2024-12-06 | The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versi… |
CVE-2024-49041 | Medium | 4.3 | 2024-12-06 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-11149 | High | 7.9 | 2024-12-06 | In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs. |
CVE-2024-6219 | Low | 3.8 | 2024-12-06 | Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honour… |
CVE-2024-6156 | Low | 3.8 | 2024-12-06 | Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store. |
CVE-2024-52798 | | 2024-12-05 | path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause… | |
CVE-2024-38920 | Critical | 9.1 | 2024-12-05 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38910 | High | 7.5 | 2024-12-05 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a use-after-free in the nav2_amcl process. This vulnerability… |
CVE-2024-37863 | Critical | 9.8 | 2024-12-05 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process. This vulnerabi… |
CVE-2024-37862 | High | 7.3 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotic Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker to execute… |
CVE-2024-37861 | Critical | 9.8 | 2024-12-05 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process. This vulnerabi… |
CVE-2024-37860 | High | 7.3 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker to execute arbitrar… |
CVE-2024-30964 | High | 7.8 | 2024-12-05 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker… |
CVE-2024-30963 | High | 7.8 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to ex… |
CVE-2024-30962 | High | 7.8 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to ex… |
CVE-2024-30961 | High | 7.8 | 2024-12-05 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker… |
CVE-2024-54140 | | 2024-12-05 | sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundl… | |
CVE-2024-53457 | Medium | 5.4 | 2024-12-05 | A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scri… |
CVE-2024-53523 | High | 7.5 | 2024-12-05 | JSFinder commit d70ab9bc5221e016c08cffaf0d9ac79646c90645 is vulnerable to Directory Traversal in the find_by_file function. |
CVE-2024-53589 | High | 8.4 | 2024-12-05 | GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files. |
CVE-2024-53442 | Critical | 9.8 | 2024-12-05 | whapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component. |
CVE-2024-41579 | Critical | 9.8 | 2024-12-05 | DTStack Taier 1.4.0 allows remote attackers to specify the jobName parameter in the console listNames function to cause a SQL injection vulnerability |
CVE-2024-11148 | High | 7.5 | 2024-12-05 | In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request. |
CVE-2024-10933 | Medium | 5.0 | 2024-12-05 | In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untru… |
CVE-2024-12235 | Medium | 6.3 | 2024-12-05 | A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected by this vulnerabil… |
CVE-2024-12130 | High | 7.8 | 2024-12-05 | An “out of bounds read” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force t… |
CVE-2024-11158 | Medium | 6.7 | 2024-12-05 | An “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and f… |
CVE-2024-11156 | High | 7.8 | 2024-12-05 | An “out of bounds write” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundari… |
CVE-2024-11155 | High | 7.8 | 2024-12-05 | A “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the sof… |
CVE-2024-54128 | Medium | 5.7 | 2024-12-05 | Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding rest… |
CVE-2024-53846 | Medium | 5.5 | 2024-12-05 | OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of desig… |
CVE-2024-53490 | High | 7.5 | 2024-12-05 | Favorites-web 1.3.0 favorites-web has a directory traversal vulnerability in SecurityFilter.java. |
CVE-2024-12234 | High | 7.3 | 2024-12-05 | A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been classified as critical. Affected is an unknown function of the fil… |
CVE-2024-12233 | High | 7.3 | 2024-12-05 | A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processing of the file /re… |
CVE-2024-54130 | | 2024-12-05 | The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A segmentation fault occurs with ION-DTN BP… | |
CVE-2024-54129 | | 2024-12-05 | The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A vulnerability exists in the version ION-D… | |
CVE-2024-54001 | Medium | 5.5 | 2024-12-05 | Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fiel… |
CVE-2024-53857 | High | 7.5 | 2024-12-05 | rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing craft… |
CVE-2024-53856 | High | 7.5 | 2024-12-05 | rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability i… |
CVE-2024-53472 | High | 8.8 | 2024-12-05 | WeGIA v3.2.0 was discovered to contain a Cross-Site Request Forgery (CSRF). |
CVE-2024-53471 | Medium | 6.1 | 2024-12-05 | Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/meio_pagamento.php of WeGIA v3.2.0 allows attackers to execute arbitr… |
CVE-2024-53470 | Medium | 6.1 | 2024-12-05 | Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/gateway_pagamento.php of WeGIA v3.2.0 allows attackers to execute arb… |
CVE-2024-12247 | Medium | 4.6 | 2024-12-05 | Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a… |
CVE-2024-12232 | Low | 3.5 | 2024-12-05 | A vulnerability has been found in code-projects Simple CRUD Functionality 1.0 and classified as problematic. This vulnerability affects unknown code of the fil… |
CVE-2024-12231 | High | 7.3 | 2024-12-05 | A vulnerability, which was classified as critical, was found in CodeZips Project Management System 1.0. This affects an unknown part of the file /index.php. Th… |
CVE-2024-10716 | Medium | 5.9 | 2024-12-05 | Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search. |
CVE-2024-12230 | High | 7.3 | 2024-12-05 | A vulnerability, which was classified as critical, has been found in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functio… |
CVE-2024-12229 | High | 7.3 | 2024-12-05 | A vulnerability classified as critical was found in PHPGurukul Complaint Management System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-11942 | Medium | 5.9 | 2024-12-05 | A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10. |
CVE-2024-11941 | High | 7.5 | 2024-12-05 | A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8. |
CVE-2024-54679 | Medium | 4.3 | 2024-12-05 | CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. |
CVE-2024-53703 | High | 8.1 | 2024-12-05 | A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote at… |
CVE-2024-53702 | Medium | 5.3 | 2024-12-05 | Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases… |
CVE-2024-52271 | | 2024-12-05 | User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flat… | |
CVE-2024-45319 | Medium | 6.3 | 2024-12-05 | A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certifi… |
CVE-2024-45318 | High | 8.1 | 2024-12-05 | A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potentially lead to co… |
CVE-2024-40763 | High | 7.5 | 2024-12-05 | Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-base… |
CVE-2024-12228 | High | 7.3 | 2024-12-05 | A vulnerability classified as critical has been found in PHPGurukul Complaint Management System 1.0. Affected is an unknown function of the file /admin/user-se… |
CVE-2024-12227 | Medium | 5.5 | 2024-12-05 | A vulnerability, which was classified as problematic, was found in MSI Dragon Center up to 2.0.146.0. This affects the function MmUnMapIoSpace in the library N… |
CVE-2024-6784 | Critical | 9.9 | 2024-12-05 | Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure. Affec… |
CVE-2024-6516 | Critical | 9.0 | 2024-12-05 | Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser. Affected products: ABB AS… |
CVE-2024-6515 | Critical | 9.6 | 2024-12-05 | Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails e… |
CVE-2024-54127 | | 2024-12-05 | This vulnerability exists in the TP-Link Archer C50 due to presence of terminal access on a serial interface without proper access control. An attacker with ph… | |
CVE-2024-54126 | | 2024-12-05 | This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An a… | |
CVE-2024-51555 | Critical | 10.0 | 2024-12-05 | Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the install… |
CVE-2024-51554 | Critical | 9.1 | 2024-12-05 | Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPE… |
CVE-2024-51551 | Critical | 10.0 | 2024-12-05 | Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPE… |
CVE-2024-51550 | Critical | 10.0 | 2024-12-05 | Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device. Affected products: … |
CVE-2024-51549 | Critical | 10.0 | 2024-12-05 | Absolute File Traversal vulnerabilities allows access and modification of un-intended resources. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXU… |
CVE-2024-51548 | Critical | 9.9 | 2024-12-05 | Dangerous File Upload vulnerabilities allow upload of malicious scripts. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRI… |
CVE-2024-51546 | High | 7.5 | 2024-12-05 | Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series… |
CVE-2024-51545 | Critical | 10.0 | 2024-12-05 | Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. Affected products: ABB ASPECT - Ente… |
CVE-2024-51544 | High | 8.2 | 2024-12-05 | Service Control vulnerabilities allow access to service restart requests and vm configuration settings. Affected products: ABB ASPECT - Enterprise v3.08.02… |
CVE-2024-51543 | High | 8.2 | 2024-12-05 | Information Disclosure vulnerabilities allow access to application configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Se… |