2024 CVEs (page 89)
Page 89 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53787 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Random Banner random-banner allows Store… |
CVE-2024-53783 | High | 7.6 | 2024-11-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-c… |
CVE-2024-53768 | Medium | 5.3 | 2024-11-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ideinteractive Content Audit Exporter content-audit-exporter allows… |
CVE-2024-53739 | High | 8.1 | 2024-11-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cool Plugins Cryptocurrency Widgets Fo… |
CVE-2024-53738 | Medium | 4.4 | 2024-11-30 | Server-Side Request Forgery (SSRF) vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issu… |
CVE-2024-12002 | Medium | 4.3 | 2024-11-30 | A vulnerability classified as problematic was found in Tenda FH451, FH1201, FH1202 and FH1206 up to 20241129. Affected by this vulnerability is the function we… |
CVE-2024-12001 | Low | 3.5 | 2024-11-30 | A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Affected is an unknown function of the file /controllers/updateset… |
CVE-2024-12000 | Low | 3.5 | 2024-11-30 | A vulnerability was found in code-projects Blood Bank System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /con… |
CVE-2024-11998 | Medium | 6.3 | 2024-11-30 | A vulnerability was found in code-projects Farmacia 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /visualizer-forn… |
CVE-2024-11997 | Low | 3.5 | 2024-11-30 | A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file /vendas.php. The manip… |
CVE-2024-11996 | Low | 3.5 | 2024-11-30 | A vulnerability was found in code-projects Farmacia 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /editar… |
CVE-2024-11252 | Medium | 6.1 | 2024-11-30 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in… |
CVE-2024-43703 | High | 8.1 | 2024-11-30 | Software installed and run as a non-privileged user may conduct improper GPU system calls to achieve unauthorised reads and writes of physical memory from the… |
CVE-2024-43702 | High | 8.1 | 2024-11-30 | Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page. |
CVE-2024-53623 | High | 7.5 | 2024-11-29 | Incorrect access control in the component l_0_0.xml of TP-Link ARCHER-C7 v5 allows attackers to access sensitive information. |
CVE-2024-54159 | Medium | 4.1 | 2024-11-29 | stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack. |
CVE-2024-11995 | Low | 3.5 | 2024-11-29 | A vulnerability has been found in code-projects Farmacia 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2024-53507 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. |
CVE-2024-53506 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. |
CVE-2024-53505 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. |
CVE-2024-53504 | Critical | 9.8 | 2024-11-29 | A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. |
CVE-2024-36612 | High | 7.5 | 2024-11-29 | Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. |
CVE-2024-35371 | High | 7.5 | 2024-11-29 | Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mech… |
CVE-2024-35368 | Critical | 9.8 | 2024-11-29 | FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c. |
CVE-2024-35367 | Critical | 9.1 | 2024-11-29 | FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer |
CVE-2024-35366 | Critical | 9.1 | 2024-11-29 | FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain optio… |
CVE-2024-53983 | Medium | 5.4 | 2024-11-29 | The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder templ… |
CVE-2024-53980 | High | 7.5 | 2024-11-29 | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A m… |
CVE-2024-53979 | High | 8.2 | 2024-11-29 | ibm.ibm_zhmc is an Ansible collection for the IBM Z HMC. The Ansible collection "ibm.ibm_zhmc" writes password-like properties in clear text into its log file… |
CVE-2024-53865 | High | 8.2 | 2024-11-29 | zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like proper… |
CVE-2024-53864 | | 2024-11-29 | Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is used to build Content names from one o… | |
CVE-2024-53861 | Low | 2.2 | 2024-11-29 | pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`… |
CVE-2024-53848 | High | 7.1 | 2024-11-29 | check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of… |
CVE-2024-52810 | | 2024-11-29 | @intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the en… | |
CVE-2024-52809 | | 2024-11-29 | vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale m… | |
CVE-2024-52801 | | 2024-11-29 | sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implem… | |
CVE-2024-52800 | | 2024-11-29 | veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may th… | |
CVE-2024-52003 | Medium | 6.1 | 2024-11-29 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-… |
CVE-2024-36616 | Medium | 6.5 | 2024-11-29 | An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafte… |
CVE-2024-36615 | Medium | 5.9 | 2024-11-29 | FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side… |
CVE-2024-36611 | High | 7.5 | 2024-11-29 | In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the usernam… |
CVE-2024-49360 | Critical | 9.2 | 2024-11-29 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges… |
CVE-2024-36624 | Medium | 5.4 | 2024-11-29 | Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js. |
CVE-2024-36623 | High | 8.1 | 2024-11-29 | moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations result… |
CVE-2024-36622 | Critical | 9.8 | 2024-11-29 | In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitizati… |
CVE-2024-36621 | Medium | 6.5 | 2024-11-29 | moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds t… |
CVE-2024-36620 | Medium | 6.5 | 2024-11-29 | moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. |
CVE-2024-36618 | Medium | 6.2 | 2024-11-29 | FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-serv… |
CVE-2024-36617 | Medium | 6.2 | 2024-11-29 | FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. |
CVE-2024-49806 | Critical | 9.4 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2024-49805 | Critical | 9.4 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2024-49804 | High | 7.8 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a locally authenticated non-administrative user to escalate their privileges due to un… |
CVE-2024-49803 | Critical | 9.8 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a… |
CVE-2024-47193 | Medium | 5.5 | 2024-11-29 | WithSecure Elements Agent for Mac before 24.3, MDR before 24.3, and Elements Client Security for Mac before 16.10 allow a remote Denial of Service. |
CVE-2024-36626 | Medium | 5.3 | 2024-11-29 | In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php. |
CVE-2024-36625 | Medium | 5.4 | 2024-11-29 | Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts. |
CVE-2024-36619 | Medium | 5.3 | 2024-11-29 | FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leadi… |
CVE-2024-35369 | Medium | 5.5 | 2024-11-29 | In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certai… |
CVE-2024-52782 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstati… |
CVE-2024-52781 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/system/tool/tr… |
CVE-2024-52780 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/system/basic/m… |
CVE-2024-52779 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstati… |
CVE-2024-52778 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstati… |
CVE-2024-52777 | Critical | 9.8 | 2024-11-29 | DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L, <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/system/basic/… |
CVE-2024-48406 | Critical | 9.8 | 2024-11-29 | Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arbitrary code via the power(uct_int_t x, u… |
CVE-2024-36671 | Critical | 9.8 | 2024-11-29 | nodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the getnum function at /modules/struct.c. |
CVE-2024-11992 | Critical | 9.1 | 2024-11-29 | Absolute path traversal vulnerability in Quick.CMS, version 6.7, the exploitation of which could allow remote users to bypass the intended restrictions and dow… |
CVE-2024-11990 | Medium | 4.6 | 2024-11-29 | A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate payload injected in… |
CVE-2024-50357 | Critical | 9.8 | 2024-11-29 | FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configurat… |
CVE-2024-47094 | Medium | 5.5 | 2024-11-29 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets to be writ… |
CVE-2024-9044 | | 2024-11-29 | A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Li… | |
CVE-2024-11983 | High | 7.2 | 2024-11-29 | Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject ar… |
CVE-2024-11982 | High | 7.2 | 2024-11-29 | Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access… |
CVE-2024-11482 | Critical | 9.8 | 2024-11-29 | A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, execu… |
CVE-2024-11481 | High | 8.2 | 2024-11-29 | A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwa… |
CVE-2024-11014 | Medium | 4.3 | 2024-11-29 | Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to V… |
CVE-2024-11013 | High | 7.2 | 2024-11-29 | Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVE… |
CVE-2024-11981 | High | 7.5 | 2024-11-29 | Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary… |
CVE-2024-53701 | Low | 3.1 | 2024-11-29 | Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to be displayed, etc. … |
CVE-2024-39162 | Medium | 6.1 | 2024-11-29 | pyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainer |
CVE-2024-11980 | High | 8.6 | 2024-11-29 | Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the sp… |
CVE-2024-10980 | Medium | 5.4 | 2024-11-29 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 does not validate… |
CVE-2024-10704 | Medium | 4.8 | 2024-11-29 | The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-48651 | High | 7.5 | 2024-11-29 | In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_… |
CVE-2024-45495 | Medium | 4.3 | 2024-11-29 | MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking. |
CVE-2024-35451 | Medium | 4.8 | 2024-11-29 | LinkStack 2.7.9 through 4.7.7 allows resources\views\components\favicon.blade.php link SSRF. |
CVE-2024-54124 | High | 8.8 | 2024-11-29 | In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen. |
CVE-2024-54123 | Medium | 6.1 | 2024-11-29 | Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format. |
CVE-2024-11979 | Critical | 9.8 | 2024-11-29 | DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to… |
CVE-2024-11978 | High | 7.5 | 2024-11-29 | DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system… |
CVE-2024-9852 | High | 7.8 | 2024-11-28 | Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3… |
CVE-2024-8300 | High | 7.0 | 2024-11-28 | Dead Code vulnerability in Mitsubishi Electric GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric Iconics Digital Solutions… |
CVE-2024-8299 | High | 7.8 | 2024-11-28 | Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3… |
CVE-2024-11971 | Low | 3.5 | 2024-11-28 | A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-11970 | High | 7.3 | 2024-11-28 | A vulnerability classified as critical has been found in code-projects Concert Ticket Ordering System 1.0. Affected is an unknown function of the file /tour(co… |
CVE-2024-11968 | Medium | 6.3 | 2024-11-28 | A vulnerability was found in code-projects Farmacia up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-11967 | High | 7.3 | 2024-11-28 | A vulnerability was found in PHPGurukul Complaint Management system 1.0. It has been classified as critical. Affected is an unknown function of the file /admin… |
CVE-2024-11966 | High | 7.3 | 2024-11-28 | A vulnerability was found in PHPGurukul Complaint Management system 1.0 and classified as critical. This issue affects some unknown processing of the file /adm… |
CVE-2024-52338 | Critical | 9.8 | 2024-11-28 | Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An ap… |
CVE-2024-11965 | High | 7.3 | 2024-11-28 | A vulnerability has been found in PHPGurukul Complaint Management system 1.0 and classified as critical. This vulnerability affects unknown code of the file /u… |