2024 CVEs (page 90)
Page 90 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11964 | High | 7.3 | 2024-11-28 | A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management system 1.0. This affects an unknown part of the file /user/inde… |
CVE-2024-11969 | High | 8.8 | 2024-11-28 | The NetCloud Exchange client for Windows, version 1.110.50, contains an insecure file and folder permissions vulnerability. A normal (non-admin) user could exp… |
CVE-2024-11963 | Medium | 6.3 | 2024-11-28 | A vulnerability, which was classified as critical, has been found in code-projects Responsive Hotel Site 1.0. Affected by this issue is some unknown functional… |
CVE-2024-11962 | High | 7.3 | 2024-11-28 | A vulnerability classified as critical was found in code-projects Simple Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-11961 | Medium | 5.3 | 2024-11-28 | A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. It has been rated as problematic. This issue affects the function preHandle of… |
CVE-2024-11960 | High | 8.8 | 2024-11-28 | A vulnerability was found in D-Link DIR-605L 2.13B01. It has been declared as critical. This vulnerability affects the function formSetPortTr of the file /gofo… |
CVE-2024-11959 | High | 8.8 | 2024-11-28 | A vulnerability was found in D-Link DIR-605L 2.13B01. It has been classified as critical. This affects the function formResetStatistic of the file /goform/form… |
CVE-2024-7747 | Medium | 6.5 | 2024-11-28 | The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This i… |
CVE-2024-53731 | Medium | 6.5 | 2024-11-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fintelligence Fintelligence Calculator fintelligence-calc… |
CVE-2024-8308 | Medium | 6.5 | 2024-11-28 | A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltra… |
CVE-2024-53737 | Medium | 6.5 | 2024-11-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Stored XSS.This… |
CVE-2024-53736 | High | 7.1 | 2024-11-28 | Cross-Site Request Forgery (CSRF) vulnerability in Jason Grim Custom Shortcode Sidebars custom-shortcode-sidebars allows Stored XSS.This issue affects Custom S… |
CVE-2024-53734 | High | 7.1 | 2024-11-28 | Cross-Site Request Forgery (CSRF) vulnerability in Jamie O Idealien Category Enhancements idealien-category-enhancements allows Stored XSS.This issue affects I… |
CVE-2024-53733 | High | 7.1 | 2024-11-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harshtohit111 Fence URL fence-url allows Stored XSS.This… |
CVE-2024-53732 | High | 7.1 | 2024-11-28 | Cross-Site Request Forgery (CSRF) vulnerability in wpwox Footer Flyout Widget footer-flyout-widget allows Stored XSS.This issue affects Footer Flyout Widget: f… |
CVE-2024-52501 | High | 7.5 | 2024-11-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebbyTemplate Office Locator office-lo… |
CVE-2024-52499 | High | 7.5 | 2024-11-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ibrahim Pricing table addon for elemen… |
CVE-2024-52498 | High | 7.5 | 2024-11-28 | Path Traversal: '.../...//' vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows PHP Local File Inclusion.This issue affects SP Blog Des… |
CVE-2024-52497 | High | 7.5 | 2024-11-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in quomodosoft Shopready shopready-elemen… |
CVE-2024-52496 | High | 7.5 | 2024-11-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AbsolutePlugins Absolute Addons For El… |
CVE-2024-52495 | High | 8.5 | 2024-11-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Distance Based Shipping Calculator dist… |
CVE-2024-52490 | Critical | 10.0 | 2024-11-28 | Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2024-52481 | High | 7.5 | 2024-11-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Astoundify Jobify jobify allows Relative Path Traversal.This is… |
CVE-2024-52475 | Critical | 9.8 | 2024-11-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Information Technology Wawp automation-web-platform allows Authentication Bypass.This… |
CVE-2024-52474 | Critical | 9.3 | 2024-11-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Сервис “Экспресс Платежи” Express Payments Module express… |
CVE-2024-11620 | High | 7.2 | 2024-11-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Code Injection.This issue affect… |
CVE-2024-11402 | High | 7.1 | 2024-11-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kubiq Block Editor Bootstrap Blocks block-editor-bootstra… |
CVE-2024-8672 | Critical | 9.9 | 2024-11-28 | The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and incl… |
CVE-2024-52283 | Medium | 5.7 | 2024-11-28 | Missing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain project |
CVE-2024-49503 | Low | 3.5 | 2024-11-28 | A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascr… |
CVE-2024-49502 | Low | 3.5 | 2024-11-28 | A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy credentials pane in… |
CVE-2024-22038 | High | 7.3 | 2024-11-28 | Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service. |
CVE-2024-22037 | Medium | 5.5 | 2024-11-28 | The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the e… |
CVE-2024-11599 | High | 8.2 | 2024-11-28 | Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthentic… |
CVE-2024-11103 | Critical | 9.8 | 2024-11-28 | The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24.0.7. This is due t… |
CVE-2024-11082 | Critical | 9.9 | 2024-11-28 | The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() funct… |
CVE-2024-10798 | Medium | 4.3 | 2024-11-28 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr… |
CVE-2024-10780 | Medium | 4.3 | 2024-11-28 | The Restaurant & Cafe Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.9 via the 'nares… |
CVE-2024-10670 | Medium | 4.3 | 2024-11-28 | The Primary Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.2 via the [prim_elementor_… |
CVE-2024-9669 | High | 7.2 | 2024-11-28 | The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fm_l… |
CVE-2024-8066 | High | 7.5 | 2024-11-28 | The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all ver… |
CVE-2024-11788 | Medium | 6.4 | 2024-11-28 | The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sw-youtube-embed' shortcode in all ve… |
CVE-2024-11786 | Medium | 6.4 | 2024-11-28 | The Login with Vipps and MobilePay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'continue-with-vipps' shortcode in all ve… |
CVE-2024-11761 | Medium | 6.4 | 2024-11-28 | The LegalWeb Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'legalweb-popup' shortcode in all versions up to, and inc… |
CVE-2024-11685 | Medium | 6.1 | 2024-11-28 | The `Kudos Donations – Easy donations and payments with Mollie` plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of `add_que… |
CVE-2024-11684 | Medium | 6.1 | 2024-11-28 | The Kudos Donations – Easy donations and payments with Mollie plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all… |
CVE-2024-11458 | Medium | 6.1 | 2024-11-28 | The FAQ Builder AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ays_faq_tab' parameter in all versions up to, and including… |
CVE-2024-11431 | Medium | 6.4 | 2024-11-28 | The Ragic Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ragic' shortcode in all versions up to, and including… |
CVE-2024-11366 | Medium | 6.1 | 2024-11-28 | The SEO Landing Page Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapin… |
CVE-2024-11333 | Medium | 6.4 | 2024-11-28 | The HLS Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hls_player' shortcode in all versions up to, and including… |
CVE-2024-11203 | Medium | 6.4 | 2024-11-28 | The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin fo… |
CVE-2024-36466 | High | 8.8 | 2024-11-28 | A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions. |
CVE-2024-11925 | Critical | 9.8 | 2024-11-28 | The JobSearch WP Job Board plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.6.7. This is due to the plugin no… |
CVE-2024-11918 | Medium | 4.3 | 2024-11-28 | The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iat_add_alt_txt_action and… |
CVE-2024-10896 | Medium | 5.4 | 2024-11-28 | The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such a… |
CVE-2024-10510 | Medium | 4.8 | 2024-11-28 | The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high pr… |
CVE-2024-10493 | Medium | 5.4 | 2024-11-28 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 does not validate an… |
CVE-2024-10473 | Medium | 5.4 | 2024-11-28 | The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortc… |
CVE-2024-46939 | | 2024-11-28 | The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path traversal attacks, wh… | |
CVE-2024-53008 | Medium | 5.3 | 2024-11-28 | Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacke… |
CVE-2024-38658 | High | 7.8 | 2024-11-28 | There is an Out-of-bounds read vulnerability in V-Server (v4.0.19.0 and earlier) and V-Server Lite (v4.0.19.0 and earlier). If a user opens a specially crafted… |
CVE-2024-38389 | High | 7.8 | 2024-11-28 | There is an Out-of-bounds read vulnerability in TELLUS (v4.0.19.0 and earlier) and TELLUS Lite (v4.0.19.0 and earlier). If a user opens a specially crafted fil… |
CVE-2024-38309 | High | 7.8 | 2024-11-28 | There are multiple stack-based buffer overflow vulnerabilities in V-SFT (v6.2.2.0 and earlier), TELLUS (v4.0.19.0 and earlier), and TELLUS Lite (v4.0.19.0 and… |
CVE-2024-11933 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT X1 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exe… |
CVE-2024-11803 | High | 7.8 | 2024-11-28 | Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-11802 | High | 7.8 | 2024-11-28 | Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attac… |
CVE-2024-11801 | High | 7.8 | 2024-11-28 | Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-11800 | High | 7.8 | 2024-11-28 | Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attac… |
CVE-2024-11799 | High | 7.8 | 2024-11-28 | Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attac… |
CVE-2024-11798 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT X1 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2024-11797 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2024-11796 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2024-11795 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex… |
CVE-2024-11794 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V10 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2024-11793 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2024-11792 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex… |
CVE-2024-11791 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V8C File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e… |
CVE-2024-11790 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e… |
CVE-2024-11789 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e… |
CVE-2024-11787 | High | 7.8 | 2024-11-28 | Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e… |
CVE-2024-53860 | High | 8.6 | 2024-11-27 | sp-php-email-handler is a PHP package for handling contact form submissions. Messages sent using this script are vulnerable to abuse, as the script allows anyb… |
CVE-2024-53859 | Medium | 6.5 | 2024-11-27 | go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` th… |
CVE-2024-53858 | Medium | 6.5 | 2024-11-27 | The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cl… |
CVE-2024-53260 | Medium | 6.8 | 2024-11-27 | Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to include a valid exce… |
CVE-2024-53855 | Low | 1.9 | 2024-11-27 | Centurion ERP (Enterprise Rescource Planning) is a simple application developed to provide open source IT management with a large emphasis on the IT Service Ma… |
CVE-2024-53264 | | 2024-11-27 | bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attacker… | |
CVE-2024-47181 | High | 7.5 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can be triggered in the two RPL implementations of th… |
CVE-2024-41126 | High | 8.3 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a devi… |
CVE-2024-41125 | High | 8.3 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a devi… |
CVE-2024-9369 | Critical | 9.6 | 2024-11-27 | Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an o… |
CVE-2024-7025 | High | 8.8 | 2024-11-27 | Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2024-54004 | Medium | 4.3 | 2024-11-27 | Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with… |
CVE-2024-54003 | High | 8.0 | 2024-11-27 | Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by atta… |
CVE-2024-51228 | Medium | 6.8 | 2024-11-27 | An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX… |
CVE-2024-37816 | Medium | 4.2 | 2024-11-27 | Quectel EC25-EUX EC25EUXGAR08A05M1G was discovered to contain a stack overflow. |
CVE-2024-31976 | High | 8.0 | 2024-11-27 | EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remote attacker to execute arbitrary OS commands via the Controller connectivity parameter. |
CVE-2024-21703 | Medium | 6.4 | 2024-11-27 | This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. … |
CVE-2024-11860 | Medium | 6.5 | 2024-11-27 | A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects an unknown part of the file /rent… |
CVE-2024-53920 | High | 7.8 | 2024-11-27 | In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can… |
CVE-2024-52951 | High | 8.0 | 2024-11-27 | Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to execute arbitrary co… |