2024 CVEs (page 87)
Page 87 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11707 | Medium | 6.1 | 2024-12-03 | The My auctions allegro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 3.6… |
CVE-2024-11461 | Medium | 6.1 | 2024-12-03 | The Form Data Collector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2… |
CVE-2024-11453 | Medium | 6.4 | 2024-12-03 | The WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t… |
CVE-2024-9058 | Medium | 6.4 | 2024-12-03 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2024-49421 | Medium | 4.3 | 2024-12-03 | Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adjacent attackers to… |
CVE-2024-49420 | High | 7.5 | 2024-12-03 | Improper handling of responses in GamingHub prior to version 6.1.04.6 in Korea, 7.1.03.7 in Global allows remote attackers to launch arbitrary activity. |
CVE-2024-49419 | Medium | 4.3 | 2024-12-03 | Insufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7.1.02.4 in Global allows remote attackers to load an arbitrary… |
CVE-2024-49418 | Medium | 6.5 | 2024-12-03 | Insufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7.1.02.4 in Global allows remote attackers to enable JavaScript… |
CVE-2024-49417 | Low | 2.0 | 2024-12-03 | Use of implicit intent for sensitive communication in Smart Touch Call prior to 1.0.0.8 allows local attackers to launch privileged activities. User interactio… |
CVE-2024-49416 | Medium | 4.0 | 2024-12-03 | Use of implicit intent for sensitive communication in SmartThings prior to version 1.8.21 allows local attackers to get sensitive information. |
CVE-2024-49415 | High | 8.1 | 2024-12-03 | Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code. |
CVE-2024-49414 | Low | 2.4 | 2024-12-03 | Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list. |
CVE-2024-49413 | High | 7.1 | 2024-12-03 | Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications. |
CVE-2024-49412 | Medium | 5.5 | 2024-12-03 | Improper input validation in Settings prior to SMR Dec-2024 Release 1 allows local attackers to broadcast signal for discovering Bluetooth on Galaxy Watch. |
CVE-2024-49411 | Medium | 4.3 | 2024-12-03 | Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege. |
CVE-2024-49410 | Medium | 5.9 | 2024-12-03 | Out-of-bounds write in libswmfextractor.so prior to SMR Dec-2024 Release 1 allows local attackers to execute arbitrary code. |
CVE-2024-10893 | Medium | 4.8 | 2024-12-03 | The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-10484 | Medium | 6.4 | 2024-12-03 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to… |
CVE-2024-9694 | Medium | 6.4 | 2024-12-03 | The CMSMasters Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.1… |
CVE-2024-45068 | High | 7.1 | 2024-12-03 | Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA. This issue affects Hitachi Ops Center C… |
CVE-2024-9200 | High | 7.2 | 2024-12-03 | A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15(… |
CVE-2024-9197 | Medium | 4.9 | 2024-12-03 | A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5.50(ABPM.9.2… |
CVE-2024-8748 | High | 7.5 | 2024-12-03 | A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in Zyxel VMG8825-T50K firmware versions through V5.50(ABOM.8.4)C0 c… |
CVE-2024-53937 | High | 8.8 | 2024-12-02 | An issue was discovered on Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The TELNET service is enabled by default with ad… |
CVE-2024-53988 | Medium | 6.1 | 2024-12-02 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of R… |
CVE-2024-53987 | Medium | 6.1 | 2024-12-02 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of R… |
CVE-2024-53986 | Medium | 6.1 | 2024-12-02 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of R… |
CVE-2024-53985 | Medium | 6.1 | 2024-12-02 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of R… |
CVE-2024-53941 | High | 8.8 | 2024-12-02 | An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. A remote attacker (in proximity to a Wi-Fi netwo… |
CVE-2024-53940 | High | 8.8 | 2024-12-02 | An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. Certain /cgi-bin/luci/admin endpoints are vulner… |
CVE-2024-53939 | High | 8.8 | 2024-12-02 | An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The /cgi-bin/luci/admin/opsw/Dual_freq_un_apple… |
CVE-2024-53938 | High | 8.8 | 2024-12-02 | An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The TELNET service is enabled by default and exp… |
CVE-2024-53375 | High | 8.0 | 2024-12-02 | An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. A vulnerability exists in the "tmp_get_sites" function of… |
CVE-2024-53989 | Medium | 6.1 | 2024-12-02 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of R… |
CVE-2024-53477 | Critical | 9.8 | 2024-12-02 | JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java |
CVE-2024-49581 | Medium | 6.5 | 2024-12-02 | Restricted Views backed objects (OSV1) could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have per… |
CVE-2024-39890 | High | 8.1 | 2024-12-02 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480… |
CVE-2024-53900 | Critical | 9.1 | 2024-12-02 | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. |
CVE-2024-39343 | High | 7.0 | 2024-12-02 | An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, Modem 5123, and Modem 5300. T… |
CVE-2024-5890 | Medium | 4.3 | 2024-12-02 | ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticate… |
CVE-2024-53617 | Medium | 4.8 | 2024-12-02 | A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file on behalf of the ad… |
CVE-2024-53484 | High | 8.8 | 2024-12-02 | Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key. |
CVE-2024-52724 | Critical | 9.8 | 2024-12-02 | ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php. |
CVE-2024-53990 | | 2024-12-02 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP requ… | |
CVE-2024-53566 | Medium | 5.5 | 2024-12-02 | An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal. |
CVE-2024-53564 | Low | 2.2 | 2024-12-02 | A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrat… |
CVE-2024-53992 | | 2024-12-02 | unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through… | |
CVE-2024-53364 | Medium | 5.4 | 2024-12-02 | A SQL injection vulnerability was found in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/view-detail.php. This vulnerability affects the viewid… |
CVE-2024-53259 | Medium | 6.5 | 2024-12-02 | quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used… |
CVE-2024-52806 | High | 8.3 | 2024-12-02 | SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's poss… |
CVE-2024-52596 | | 2024-12-02 | SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible… | |
CVE-2024-50381 | | 2024-12-02 | A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices. The attacker only… | |
CVE-2024-50380 | | 2024-12-02 | Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested. An attacker can impersonate other devices by supplying enumera… | |
CVE-2024-49763 | | 2024-12-02 | PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper by getti… | |
CVE-2024-53984 | Medium | 4.3 | 2024-12-02 | Nanopb is a small code-size Protocol Buffers implementation. When the compile time option PB_ENABLE_MALLOC is enabled, the message contains at least one field… |
CVE-2024-53981 | High | 7.5 | 2024-12-02 | python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first… |
CVE-2024-53862 | High | 7.5 | 2024-12-02 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using `--auth-mode=client`, Archived Work… |
CVE-2024-53459 | Medium | 5.4 | 2024-12-02 | Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting (XSS) via the /scgi?sid parameter. |
CVE-2024-8785 | Critical | 9.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in… |
CVE-2024-52732 | Critical | 9.1 | 2024-12-02 | Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused. |
CVE-2024-46909 | Critical | 9.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the se… |
CVE-2024-46908 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46907 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46906 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46905 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated lower-privileged user (at least Network Manager permis… |
CVE-2024-38827 | Medium | 4.8 | 2024-12-02 | The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not workin… |
CVE-2024-31669 | High | 7.5 | 2024-12-02 | rizin before Release v0.6.3 is vulnerable to Uncontrolled Resource Consumption via bin_pe_parse_imports, Pe_r_bin_pe_parse_var, and estimate_slide. |
CVE-2024-29645 | High | 7.8 | 2024-12-02 | Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function. |
CVE-2024-10905 | Critical | 10.0 | 2024-12-02 | IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior t… |
CVE-2024-53793 | High | 8.2 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in jerodmoore eDoc Easy Tables edoc-easy-tables allows Blind SQL Injection.This issue affects eDoc Easy Tables… |
CVE-2024-53792 | High | 8.5 | 2024-12-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affect… |
CVE-2024-53789 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Ritesh Sanap Advanced What should we write next about advanced-what-should-we-write-about-next allows Stored… |
CVE-2024-53784 | Medium | 4.3 | 2024-12-02 | Missing Authorization vulnerability in E-goi Smart Marketing SMS and Newsletters Forms smart-marketing-for-wp allows Exploiting Incorrectly Configured Access C… |
CVE-2024-53782 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in cmsaccount Photo Video Store photo-video-store allows Cross-Site Scripting (XSS).This issue affects Photo Vi… |
CVE-2024-53781 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle-search allows Stored XSS.This issue affects Spatia… |
CVE-2024-53780 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in rajeevglocify Load More Posts load-more-posts allows Stored XSS.This issue affects Load More Posts: from n/a… |
CVE-2024-53779 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Stored XSS.This issue affects Yahoo! WebPlayer: from n/a… |
CVE-2024-53777 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Alberto Reineri Simple Header and Footer simple-header-and-footer allows Stored XSS.This issue affects Simpl… |
CVE-2024-53776 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in raphaelheide Donate Me donate-me allows Stored XSS.This issue affects Donate Me: from n/a through <= 1.2.5. |
CVE-2024-53775 | Medium | 4.3 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in benmoreassynt DancePress (TRWA) dancepress-trwa allows Cross Site Request Forgery.This issue affects DancePr… |
CVE-2024-53770 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in pbmacintyre RingCentral Communications rccp-free allows Stored XSS.This issue affects RingCentral Communicat… |
CVE-2024-53769 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in lriaudel Custom Post Type to Map Store cpt-to-map-store allows Stored XSS.This issue affects Custom Post Typ… |
CVE-2024-53765 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Think201 Mins To Read mins-to-read allows Stored XSS.This issue affects Mins To Read: from n/a through <= 1… |
CVE-2024-53762 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Stored XSS.This i… |
CVE-2024-53761 | Medium | 5.4 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in P Roy WP Revisions Manager wp-revisions-manager allows Cross Site Request Forgery.This issue affects WP Revi… |
CVE-2024-53759 | High | 7.1 | 2024-12-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Planet Studio ArCa Payment Gateway arca-payment-gateway a… |
CVE-2024-53755 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Andrea Pernici Third Party Cookie Eraser third-party-cookie-eraser allows Stored XSS.This issue affects Thir… |
CVE-2024-53754 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Irish_Cathal Out Of Stock Badge out-of-stock-badge allows Cross Site Request Forgery.This issue affects Out… |
CVE-2024-53753 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in CultBooking CultBooking Hotel Booking Engine cultbooking-booking-engine allows Stored XSS.This issue affects… |
CVE-2024-53751 | Medium | 5.4 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App… |
CVE-2024-53741 | Medium | 6.5 | 2024-12-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Popup simple-popup-plugin allows DOM… |
CVE-2024-53740 | High | 7.1 | 2024-12-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultim… |
CVE-2024-53730 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in springthistle April's Call Posts aprils-call-posts allows Stored XSS.This issue affects April's Call Posts… |
CVE-2024-53729 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in plumwd Blizzard Quotes blizzard-quotes allows Stored XSS.This issue affects Blizzard Quotes: from n/a throug… |
CVE-2024-53728 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Oliver Lindner Protect Your Content protect-your-content allows Stored XSS.This issue affects Protect Your C… |
CVE-2024-53727 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in Lars Koudal LinkLaunder SEO linklaunder-seo-plugin allows Stored XSS.This issue affects LinkLaunder SEO: fro… |
CVE-2024-53726 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in RealtyCandy.com RealtyCandy IDX Broker Extended realtycandy-idx-broker-extended allows Stored XSS.This issue… |
CVE-2024-53725 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in aMiT Post Hits Counter hits-counter allows Reflected XSS.This issue affects Post Hits Counter: from n/a thro… |
CVE-2024-53724 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in ronnybull IceStats icestats allows Stored XSS.This issue affects IceStats: from n/a through <= 1.3. |
CVE-2024-53723 | High | 7.1 | 2024-12-02 | Cross-Site Request Forgery (CSRF) vulnerability in acbaltaci Google Plus Share and +1 Button google-plus-share-and-plusone-button allows Stored XSS.This issue… |