2024 CVEs (page 87)
Page 87 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53375 | High | 8.0 | 2024-12-02 | An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. A vulnerability exists in the "tmp_get_sites" function of… |
CVE-2024-53989 | Medium | 6.1 | 2024-12-02 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of R… |
CVE-2024-53477 | Critical | 9.8 | 2024-12-02 | JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java |
CVE-2024-49581 | Medium | 6.5 | 2024-12-02 | Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have per… |
CVE-2024-39890 | High | 8.1 | 2024-12-02 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480… |
CVE-2024-53900 | Critical | 9.1 | 2024-12-02 | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. |
CVE-2024-39343 | High | 7.0 | 2024-12-02 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, Modem 5123, and Modem 5300. T… |
CVE-2024-5890 | Medium | 4.3 | 2024-12-02 | ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticate… |
CVE-2024-53617 | Medium | 4.8 | 2024-12-02 | A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file on behalf of the ad… |
CVE-2024-53484 | High | 8.8 | 2024-12-02 | Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key. |
CVE-2024-52724 | Critical | 9.8 | 2024-12-02 | ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php. |
CVE-2024-53990 | | 2024-12-02 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP requ… | |
CVE-2024-53566 | Medium | 5.5 | 2024-12-02 | An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal. |
CVE-2024-53564 | Low | 2.2 | 2024-12-02 | A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrat… |
CVE-2024-53992 | | 2024-12-02 | unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through… | |
CVE-2024-53364 | Medium | 5.4 | 2024-12-02 | A SQL injection vulnerability was found in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/view-detail.php. This vulnerability affects the viewid… |
CVE-2024-53259 | Medium | 6.5 | 2024-12-02 | quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used… |
CVE-2024-52806 | High | 8.3 | 2024-12-02 | SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's poss… |
CVE-2024-52596 | | 2024-12-02 | SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible… | |
CVE-2024-50381 | | 2024-12-02 | A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices. The attacker only… | |
CVE-2024-50380 | | 2024-12-02 | Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested. An attacker can impersonate other devices by supplying enumera… | |
CVE-2024-49763 | | 2024-12-02 | PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper by getti… | |
CVE-2024-53984 | Medium | 4.3 | 2024-12-02 | Nanopb is a small code-size Protocol Buffers implementation. When the compile time option PB_ENABLE_MALLOC is enabled, the message contains at least one field… |
CVE-2024-53981 | High | 7.5 | 2024-12-02 | python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first… |
CVE-2024-53862 | High | 7.5 | 2024-12-02 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using `--auth-mode=client`, Archived Work… |
CVE-2024-53459 | Medium | 5.4 | 2024-12-02 | Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting (XSS) via the /scgi?sid parameter. |
CVE-2024-8785 | Critical | 9.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in… |
CVE-2024-52732 | Critical | 9.1 | 2024-12-02 | Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused. |
CVE-2024-46909 | Critical | 9.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the se… |
CVE-2024-46908 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46907 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46906 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46905 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated lower-privileged user (at least Network Manager permis… |
CVE-2024-38827 | Medium | 4.8 | 2024-12-02 | The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not workin… |
CVE-2024-31669 | High | 7.5 | 2024-12-02 | rizin before Release v0.6.3 is vulnerable to Uncontrolled Resource Consumption via bin_pe_parse_imports, Pe_r_bin_pe_parse_var, and estimate_slide. |
CVE-2024-29645 | High | 7.8 | 2024-12-02 | Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function. |
CVE-2024-10905 | Critical | 10.0 | 2024-12-02 | IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior t… |
CVE-2024-53793 | High | 8.2 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in jerodmoore eDoc Easy Tables edoc-easy-tables allows Blind SQL Injection.This issue affects eDoc Easy Tables… |
CVE-2024-53792 | High | 8.5 | 2024-12-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affect… |
CVE-2024-53789 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Ritesh Sanap Advanced What should we write next about advanced-what-should-we-write-about-next allows Stored… |
CVE-2024-53784 | Medium | 4.3 | 2024-12-02 | Missing Authorization vulnerability in E-goi Smart Marketing SMS and Newsletters Forms smart-marketing-for-wp allows Exploiting Incorrectly Configured Access C… |
CVE-2024-53782 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in cmsaccount Photo Video Store photo-video-store allows Cross-Site Scripting (XSS).This issue affects Photo Vi… |
CVE-2024-53781 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle-search allows Stored XSS.This issue affects Spatia… |
CVE-2024-53780 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in rajeevglocify Load More Posts load-more-posts allows Stored XSS.This issue affects Load More Posts: from n/a… |
CVE-2024-53779 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Stored XSS.This issue affects Yahoo! WebPlayer: from n/a… |
CVE-2024-53777 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Alberto Reineri Simple Header and Footer simple-header-and-footer allows Stored XSS.This issue affects Simpl… |
CVE-2024-53776 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in raphaelheide Donate Me donate-me allows Stored XSS.This issue affects Donate Me: from n/a through <= 1.2.5. |
CVE-2024-53775 | Medium | 4.3 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in benmoreassynt DancePress (TRWA) dancepress-trwa allows Cross Site Request Forgery.This issue affects DancePr… |
CVE-2024-53770 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in pbmacintyre RingCentral Communications rccp-free allows Stored XSS.This issue affects RingCentral Communicat… |
CVE-2024-53769 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in lriaudel Custom Post Type to Map Store cpt-to-map-store allows Stored XSS.This issue affects Custom Post Typ… |
CVE-2024-53765 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Think201 Mins To Read mins-to-read allows Stored XSS.This issue affects Mins To Read: from n/a through <= 1… |
CVE-2024-53762 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Stored XSS.This i… |
CVE-2024-53761 | Medium | 5.4 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in P Roy WP Revisions Manager wp-revisions-manager allows Cross Site Request Forgery.This issue affects WP Revi… |
CVE-2024-53759 | High | 7.1 | 2024-12-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Planet Studio ArCa Payment Gateway arca-payment-gateway a… |
CVE-2024-53755 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Andrea Pernici Third Party Cookie Eraser third-party-cookie-eraser allows Stored XSS.This issue affects Thir… |
CVE-2024-53754 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Irish_Cathal Out Of Stock Badge out-of-stock-badge allows Cross Site Request Forgery.This issue affects Out… |
CVE-2024-53753 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in CultBooking CultBooking Hotel Booking Engine cultbooking-booking-engine allows Stored XSS.This issue affects… |
CVE-2024-53751 | Medium | 5.4 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App… |
CVE-2024-53741 | Medium | 6.5 | 2024-12-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Popup simple-popup-plugin allows DOM… |
CVE-2024-53740 | High | 7.1 | 2024-12-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultim… |
CVE-2024-53730 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in springthistle April's Call Posts aprils-call-posts allows Stored XSS.This issue affects April's Call Posts… |
CVE-2024-53729 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in plumwd Blizzard Quotes blizzard-quotes allows Stored XSS.This issue affects Blizzard Quotes: from n/a throug… |
CVE-2024-53728 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Oliver Lindner Protect Your Content protect-your-content allows Stored XSS.This issue affects Protect Your C… |
CVE-2024-53727 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Lars Koudal LinkLaunder SEO linklaunder-seo-plugin allows Stored XSS.This issue affects LinkLaunder SEO: fro… |
CVE-2024-53726 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in RealtyCandy.com RealtyCandy IDX Broker Extended realtycandy-idx-broker-extended allows Stored XSS.This issue… |
CVE-2024-53725 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in aMiT Post Hits Counter hits-counter allows Reflected XSS.This issue affects Post Hits Counter: from n/a thro… |
CVE-2024-53724 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in ronnybull IceStats icestats allows Stored XSS.This issue affects IceStats: from n/a through <= 1.3. |
CVE-2024-53723 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in acbaltaci Google Plus Share and +1 Button google-plus-share-and-plusone-button allows Stored XSS.This issue… |
CVE-2024-53722 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in rockemmusic Favicon My Blog favicon-my-blog allows Stored XSS.This issue affects Favicon My Blog: from n/a t… |
CVE-2024-53721 | Medium | 6.5 | 2024-12-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stachethemes Advanced Event Manager advanced-event-manage… |
CVE-2024-53720 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in ole1986 WP-ISPConfig 3 wp-ispconfig3 allows Stored XSS.This issue affects WP-ISPConfig 3: from n/a through <… |
CVE-2024-53719 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in onigetoc Zajax – Ajax Navigation zajax-ajax-navigation allows Stored XSS.This issue affects Zajax – Ajax Nav… |
CVE-2024-53718 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Eric Teubert Multi Feed Reader multi-feed-reader allows Stored XSS.This issue affects Multi Feed Reader: fro… |
CVE-2024-53717 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in yonisink yPHPlista yphplista allows Stored XSS.This issue affects yPHPlista: from n/a through <= 1.1.1. |
CVE-2024-53716 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in overtrue wp auto top wp-auto-top allows Stored XSS.This issue affects wp auto top: from n/a through <= 2.9.3. |
CVE-2024-53715 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Thomas Hoefter Simple Travel Map simple-travel-map allows Stored XSS.This issue affects Simple Travel Map: f… |
CVE-2024-53714 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Irish_Cathal Continue Shopping From Cart continue-shopping-from-cart-page allows Stored XSS.This issue affec… |
CVE-2024-53713 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in rickota Silverlight Video Player smooth-streaming-player allows Stored XSS.This issue affects Silverlight Vi… |
CVE-2024-53712 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in kevmimcc Kevin's kevins-plugin allows Stored XSS.This issue affects Kevin's: from n/a through <= 2.0.0. |
CVE-2024-53711 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in tranchesdunet Hotlink2Watermark hotlink2watermark allows Stored XSS.This issue affects Hotlink2Watermark: fr… |
CVE-2024-53710 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in ITERAS ITERAS iteras allows Stored XSS.This issue affects ITERAS: from n/a through <= 1.8.0. |
CVE-2024-53709 | Medium | 6.5 | 2024-12-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-element… |
CVE-2024-53708 | Medium | 5.3 | 2024-12-02 | Missing Authorization vulnerability in kekotron AI Quiz ai-quiz allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AI Quiz: fro… |
CVE-2024-53707 | Medium | 4.3 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in ahmeti Ahmeti Wp Güzel Sözler ahmeti-wp-guzel-sozler allows Cross Site Request Forgery.This issue affects Ah… |
CVE-2024-53124 | High | 7.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc Syzkaller reported this warning: -------… |
CVE-2024-53123 | Medium | 5.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: mptcp: error out earlier on disconnect Eric reported a division by zero splat in the MPTC… |
CVE-2024-53122 | High | 7.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust Additional active subflows… |
CVE-2024-53121 | High | 7.8 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, lock FTE when checking if active The referenced commits introduced a two-st… |
CVE-2024-53120 | High | 7.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: CT: Fix null-ptr-deref in add rule err flow In error flow of mlx5_tc_ct_entry_… |
CVE-2024-53119 | Medium | 5.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Fix accept_queue memory leak As the final stages of socket destruction may… |
CVE-2024-53118 | Medium | 5.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: vsock: Fix sk_error_queue memory leak Kernel queues MSG_ZEROCOPY completion notifications… |
CVE-2024-53117 | Medium | 5.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Improve MSG_ZEROCOPY error handling Add a missing kfree_skb() to prevent me… |
CVE-2024-53116 | Medium | 5.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix handling of partial GPU mapping of BOs This commit fixes the bug in the… |
CVE-2024-53115 | Medium | 5.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle The 'vmw_user_o… |
CVE-2024-53114 | Medium | 5.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client A number of Zen4 client SoCs… |
CVE-2024-53113 | Medium | 5.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof We triggered a NULL pointer d… |
CVE-2024-53112 | Medium | 5.5 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: uncache inode which has failed entering the group Syzbot has reported the followin… |
CVE-2024-53111 | High | 7.1 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix address wraparound in move_page_tables() On 32-bit platforms, it is possib… |
CVE-2024-53110 | High | 7.3 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: vp_vdpa: fix id_table array not null terminated error Allocate one extra virtio_device_id… |
CVE-2024-53109 | High | 7.8 | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: nommu: pass NULL argument to vma_iter_prealloc() When deleting a vma entry from a maple t… |