2024 CVEs (page 90)
Page 90 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50357 | Critical | 9.8 | 2024-11-29 | FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configurat… |
CVE-2024-47094 | Medium | 5.5 | 2024-11-29 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets to be writ… |
CVE-2024-9044 | | 2024-11-29 | A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Li… | |
CVE-2024-11983 | High | 7.2 | 2024-11-29 | Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject ar… |
CVE-2024-11982 | High | 7.2 | 2024-11-29 | Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access… |
CVE-2024-11482 | Critical | 9.8 | 2024-11-29 | A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, execu… |
CVE-2024-11481 | High | 8.2 | 2024-11-29 | A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwa… |
CVE-2024-11014 | Medium | 4.3 | 2024-11-29 | Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to V… |
CVE-2024-11013 | High | 7.2 | 2024-11-29 | Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVE… |
CVE-2024-11981 | High | 7.5 | 2024-11-29 | Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary… |
CVE-2024-53701 | Low | 3.1 | 2024-11-29 | Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to be displayed, etc. … |
CVE-2024-39162 | Medium | 6.1 | 2024-11-29 | pyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainer |
CVE-2024-11980 | High | 8.6 | 2024-11-29 | Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the sp… |
CVE-2024-10980 | Medium | 5.4 | 2024-11-29 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 does not validate… |
CVE-2024-10704 | Medium | 4.8 | 2024-11-29 | The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-48651 | High | 7.5 | 2024-11-29 | In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_… |
CVE-2024-45495 | Medium | 4.3 | 2024-11-29 | MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking. |
CVE-2024-35451 | Medium | 4.8 | 2024-11-29 | LinkStack 2.7.9 through 4.7.7 allows resources\views\components\favicon.blade.php link SSRF. |
CVE-2024-54124 | High | 8.8 | 2024-11-29 | In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen. |
CVE-2024-54123 | Medium | 6.1 | 2024-11-29 | Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format. |
CVE-2024-11979 | Critical | 9.8 | 2024-11-29 | DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to… |
CVE-2024-11978 | High | 7.5 | 2024-11-29 | DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system… |
CVE-2024-9852 | High | 7.8 | 2024-11-28 | Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3… |
CVE-2024-8300 | High | 7.0 | 2024-11-28 | Dead Code vulnerability in Mitsubishi Electric GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric Iconics Digital Solutions… |
CVE-2024-8299 | High | 7.8 | 2024-11-28 | Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3… |
CVE-2024-11971 | Low | 3.5 | 2024-11-28 | A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-11970 | High | 7.3 | 2024-11-28 | A vulnerability classified as critical has been found in code-projects Concert Ticket Ordering System 1.0. Affected is an unknown function of the file /tour(co… |
CVE-2024-11968 | Medium | 6.3 | 2024-11-28 | A vulnerability was found in code-projects Farmacia up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-11967 | High | 7.3 | 2024-11-28 | A vulnerability was found in PHPGurukul Complaint Management system 1.0. It has been classified as critical. Affected is an unknown function of the file /admin… |
CVE-2024-11966 | High | 7.3 | 2024-11-28 | A vulnerability was found in PHPGurukul Complaint Management system 1.0 and classified as critical. This issue affects some unknown processing of the file /adm… |
CVE-2024-52338 | Critical | 9.8 | 2024-11-28 | Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An ap… |
CVE-2024-11965 | High | 7.3 | 2024-11-28 | A vulnerability has been found in PHPGurukul Complaint Management system 1.0 and classified as critical. This vulnerability affects unknown code of the file /u… |
CVE-2024-11964 | High | 7.3 | 2024-11-28 | A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management system 1.0. This affects an unknown part of the file /user/inde… |
CVE-2024-11969 | High | 8.8 | 2024-11-28 | The NetCloud Exchange client for Windows, version 1.110.50, contains an insecure file and folder permissions vulnerability. A normal (non-admin) user could exp… |
CVE-2024-11963 | Medium | 6.3 | 2024-11-28 | A vulnerability, which was classified as critical, has been found in code-projects Responsive Hotel Site 1.0. Affected by this issue is some unknown functional… |
CVE-2024-11962 | High | 7.3 | 2024-11-28 | A vulnerability classified as critical was found in code-projects Simple Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-11961 | Medium | 5.3 | 2024-11-28 | A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. It has been rated as problematic. This issue affects the function preHandle of… |
CVE-2024-11960 | High | 8.8 | 2024-11-28 | A vulnerability was found in D-Link DIR-605L 2.13B01. It has been declared as critical. This vulnerability affects the function formSetPortTr of the file /gofo… |
CVE-2024-11959 | High | 8.8 | 2024-11-28 | A vulnerability was found in D-Link DIR-605L 2.13B01. It has been classified as critical. This affects the function formResetStatistic of the file /goform/form… |
CVE-2024-7747 | Medium | 6.5 | 2024-11-28 | The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This i… |
CVE-2024-53731 | Medium | 6.5 | 2024-11-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fintelligence Fintelligence Calculator fintelligence-calc… |
CVE-2024-8308 | Medium | 6.5 | 2024-11-28 | A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltra… |
CVE-2024-53737 | Medium | 6.5 | 2024-11-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Stored XSS.This… |
CVE-2024-53736 | High | 7.1 | 2024-11-28 | Cross-Site Request Forgery (CSRF) vulnerability in Jason Grim Custom Shortcode Sidebars custom-shortcode-sidebars allows Stored XSS.This issue affects Custom S… |
CVE-2024-53734 | High | 7.1 | 2024-11-28 | Cross-Site Request Forgery (CSRF) vulnerability in Jamie O Idealien Category Enhancements idealien-category-enhancements allows Stored XSS.This issue affects I… |
CVE-2024-53733 | High | 7.1 | 2024-11-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harshtohit111 Fence URL fence-url allows Stored XSS.This… |
CVE-2024-53732 | High | 7.1 | 2024-11-28 | Cross-Site Request Forgery (CSRF) vulnerability in wpwox Footer Flyout Widget footer-flyout-widget allows Stored XSS.This issue affects Footer Flyout Widget: f… |
CVE-2024-52501 | High | 7.5 | 2024-11-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebbyTemplate Office Locator office-lo… |
CVE-2024-52499 | High | 7.5 | 2024-11-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ibrahim Pricing table addon for elemen… |
CVE-2024-52498 | High | 7.5 | 2024-11-28 | Path Traversal: '.../...//' vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows PHP Local File Inclusion.This issue affects SP Blog Des… |
CVE-2024-52497 | High | 7.5 | 2024-11-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in quomodosoft Shopready shopready-elemen… |
CVE-2024-52496 | High | 7.5 | 2024-11-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AbsolutePlugins Absolute Addons For El… |
CVE-2024-52495 | High | 8.5 | 2024-11-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Distance Based Shipping Calculator dist… |
CVE-2024-52490 | Critical | 10.0 | 2024-11-28 | Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2024-52481 | High | 7.5 | 2024-11-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Astoundify Jobify jobify allows Relative Path Traversal.This is… |
CVE-2024-52475 | Critical | 9.8 | 2024-11-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Information Technology Wawp automation-web-platform allows Authentication Bypass.This… |
CVE-2024-52474 | Critical | 9.3 | 2024-11-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Сервис “Экспресс Платежи” Express Payments Module express… |
CVE-2024-11620 | High | 7.2 | 2024-11-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Code Injection.This issue affect… |
CVE-2024-11402 | High | 7.1 | 2024-11-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kubiq Block Editor Bootstrap Blocks block-editor-bootstra… |
CVE-2024-8672 | Critical | 9.9 | 2024-11-28 | The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and incl… |
CVE-2024-52283 | Medium | 5.7 | 2024-11-28 | Missing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain project |
CVE-2024-49503 | Low | 3.5 | 2024-11-28 | A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascr… |
CVE-2024-49502 | Low | 3.5 | 2024-11-28 | A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy credentials pane in… |
CVE-2024-22038 | High | 7.3 | 2024-11-28 | Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service. |
CVE-2024-22037 | Medium | 5.5 | 2024-11-28 | The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the e… |
CVE-2024-11599 | High | 8.2 | 2024-11-28 | Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthentic… |
CVE-2024-11103 | Critical | 9.8 | 2024-11-28 | The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24.0.7. This is due t… |
CVE-2024-11082 | Critical | 9.9 | 2024-11-28 | The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() funct… |
CVE-2024-10798 | Medium | 4.3 | 2024-11-28 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr… |
CVE-2024-10780 | Medium | 4.3 | 2024-11-28 | The Restaurant & Cafe Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.9 via the 'nares… |
CVE-2024-10670 | Medium | 4.3 | 2024-11-28 | The Primary Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.2 via the [prim_elementor_… |
CVE-2024-9669 | High | 7.2 | 2024-11-28 | The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fm_l… |
CVE-2024-8066 | High | 7.5 | 2024-11-28 | The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all ver… |
CVE-2024-11788 | Medium | 6.4 | 2024-11-28 | The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sw-youtube-embed' shortcode in all ve… |
CVE-2024-11786 | Medium | 6.4 | 2024-11-28 | The Login with Vipps and MobilePay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'continue-with-vipps' shortcode in all ve… |
CVE-2024-11761 | Medium | 6.4 | 2024-11-28 | The LegalWeb Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'legalweb-popup' shortcode in all versions up to, and inc… |
CVE-2024-11685 | Medium | 6.1 | 2024-11-28 | The `Kudos Donations – Easy donations and payments with Mollie` plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of `add_que… |
CVE-2024-11684 | Medium | 6.1 | 2024-11-28 | The Kudos Donations – Easy donations and payments with Mollie plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all… |
CVE-2024-11458 | Medium | 6.1 | 2024-11-28 | The FAQ Builder AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ays_faq_tab' parameter in all versions up to, and including… |
CVE-2024-11431 | Medium | 6.4 | 2024-11-28 | The Ragic Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ragic' shortcode in all versions up to, and including… |
CVE-2024-11366 | Medium | 6.1 | 2024-11-28 | The SEO Landing Page Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapin… |
CVE-2024-11333 | Medium | 6.4 | 2024-11-28 | The HLS Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hls_player' shortcode in all versions up to, and including… |
CVE-2024-11203 | Medium | 6.4 | 2024-11-28 | The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin fo… |
CVE-2024-36466 | High | 8.8 | 2024-11-28 | A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions. |
CVE-2024-11925 | Critical | 9.8 | 2024-11-28 | The JobSearch WP Job Board plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.6.7. This is due to the plugin no… |
CVE-2024-11918 | Medium | 4.3 | 2024-11-28 | The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iat_add_alt_txt_action and… |
CVE-2024-10896 | Medium | 5.4 | 2024-11-28 | The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such a… |
CVE-2024-10510 | Medium | 4.8 | 2024-11-28 | The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high pr… |
CVE-2024-10493 | Medium | 5.4 | 2024-11-28 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 does not validate an… |
CVE-2024-10473 | Medium | 5.4 | 2024-11-28 | The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortc… |
CVE-2024-46939 | | 2024-11-28 | The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path traversal attacks, wh… | |
CVE-2024-53008 | Medium | 5.3 | 2024-11-28 | Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacke… |
CVE-2024-38658 | High | 7.8 | 2024-11-28 | There is an Out-of-bounds read vulnerability in V-Server (v4.0.19.0 and earlier) and V-Server Lite (v4.0.19.0 and earlier). If a user opens a specially crafted… |
CVE-2024-38389 | High | 7.8 | 2024-11-28 | There is an Out-of-bounds read vulnerability in TELLUS (v4.0.19.0 and earlier) and TELLUS Lite (v4.0.19.0 and earlier). If a user opens a specially crafted fil… |
CVE-2024-38309 | High | 7.8 | 2024-11-28 | There are multiple stack-based buffer overflow vulnerabilities in V-SFT (v6.2.2.0 and earlier), TELLUS (v4.0.19.0 and earlier), and TELLUS Lite (v4.0.19.0 and… |
CVE-2024-11933 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT X1 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exe… |
CVE-2024-11803 | High | 7.8 | 2024-11-28 | Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-11802 | High | 7.8 | 2024-11-28 | Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attac… |
CVE-2024-11801 | High | 7.8 | 2024-11-28 | Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-11800 | High | 7.8 | 2024-11-28 | Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attac… |