2024 CVEs (page 92)
Page 92 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53365 | Medium | 5.4 | 2024-11-26 | A stored cross-site scripting (XSS) vulnerability was identified in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/profile.php. This vulnerabilit… |
CVE-2024-11407 | High | 7.5 | 2024-11-26 | There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX… |
CVE-2024-52337 | Medium | 5.5 | 2024-11-26 | A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequen… |
CVE-2024-52336 | High | 7.8 | 2024-11-26 | A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without a… |
CVE-2024-36463 | Medium | 6.5 | 2024-11-26 | The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects. |
CVE-2024-22117 | Low | 2.2 | 2024-11-26 | When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementu… |
CVE-2024-9929 | Medium | 4.3 | 2024-11-26 | A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps. |
CVE-2024-9928 | Medium | 5.3 | 2024-11-26 | A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause account takeover and unau… |
CVE-2024-9461 | High | 7.2 | 2024-11-26 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to… |
CVE-2024-8236 | Medium | 6.4 | 2024-11-26 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the… |
CVE-2024-53976 | Medium | 5.4 | 2024-11-26 | Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the… |
CVE-2024-53975 | Medium | 5.4 | 2024-11-26 | Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appear secure. This vul… |
CVE-2024-11708 | Medium | 6.5 | 2024-11-26 | Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox < 133 an… |
CVE-2024-11706 | Medium | 6.5 | 2024-11-26 | A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_Util` function, when handling malformed o… |
CVE-2024-11705 | Critical | 9.1 | 2024-11-26 | `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading… |
CVE-2024-11704 | Critical | 9.8 | 2024-11-26 | A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key c… |
CVE-2024-11703 | Medium | 5.7 | 2024-11-26 | On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerability affects Firefox <… |
CVE-2024-11702 | High | 7.5 | 2024-11-26 | Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history… |
CVE-2024-11701 | Medium | 4.3 | 2024-11-26 | The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible sp… |
CVE-2024-11700 | High | 8.1 | 2024-11-26 | Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of… |
CVE-2024-11699 | High | 8.8 | 2024-11-26 | Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-11698 | Critical | 9.8 | 2024-11-26 | A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened durin… |
CVE-2024-11697 | High | 8.8 | 2024-11-26 | When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have l… |
CVE-2024-11696 | Medium | 5.4 | 2024-11-26 | The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an i… |
CVE-2024-11695 | Medium | 5.4 | 2024-11-26 | A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This… |
CVE-2024-11694 | Medium | 6.1 | 2024-11-26 | Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the W… |
CVE-2024-11693 | Critical | 9.8 | 2024-11-26 | The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating systems. Other operating… |
CVE-2024-11692 | Medium | 4.3 | 2024-11-26 | An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability… |
CVE-2024-11691 | High | 8.8 | 2024-11-26 | Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver… |
CVE-2024-51569 | High | 7.5 | 2024-11-26 | Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing… |
CVE-2024-47250 | Medium | 5.0 | 2024-11-26 | Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI advertising report could lead to out-of-bound access when parsing HCI even… |
CVE-2024-47249 | Medium | 5.0 | 2024-11-26 | Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory… |
CVE-2024-47248 | Medium | 6.3 | 2024-11-26 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. Specially crafted MESH message could result in memory c… |
CVE-2024-38834 | Medium | 6.5 | 2024-11-26 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject ma… |
CVE-2024-38833 | Medium | 6.8 | 2024-11-26 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious sc… |
CVE-2024-38832 | High | 7.1 | 2024-11-26 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious scr… |
CVE-2024-38831 | High | 7.8 | 2024-11-26 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious comman… |
CVE-2024-38830 | High | 7.8 | 2024-11-26 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerabili… |
CVE-2024-8899 | Medium | 4.3 | 2024-11-26 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the render_content f… |
CVE-2024-50377 | Medium | 6.5 | 2024-11-26 | A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<… |
CVE-2024-50376 | High | 7.3 | 2024-11-26 | A CWE-79 "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" was discovered affecting the following devices manufactured by… |
CVE-2024-50375 | Critical | 9.8 | 2024-11-26 | A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EK… |
CVE-2024-50374 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50373 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50372 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50371 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50370 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50369 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50368 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50367 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50366 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50365 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50364 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50363 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50362 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50361 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50360 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50359 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50358 | High | 7.2 | 2024-11-26 | A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6… |
CVE-2024-11024 | Critical | 9.8 | 2024-11-26 | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4… |
CVE-2024-10579 | Medium | 4.3 | 2024-11-26 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability che… |
CVE-2024-10308 | Medium | 6.4 | 2024-11-26 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Countdown widget in all versions up to, and inc… |
CVE-2024-11680 | Critical | 9.8 | 2024-11-26 | ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sendin… |
CVE-2024-11032 | Medium | 6.1 | 2024-11-26 | The Parsi Date plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in… |
CVE-2024-9170 | Medium | 5.5 | 2024-11-26 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wcj_product_meta shortcode in all versions up to… |
CVE-2024-11192 | Medium | 6.4 | 2024-11-26 | The Spotify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spotifyplaybutton shortcode in all ver… |
CVE-2024-11119 | Medium | 6.4 | 2024-11-26 | The BNE Gallery Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and incl… |
CVE-2024-11091 | Medium | 6.4 | 2024-11-26 | The Support SVG – Upload svg files in wordpress without hassle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads… |
CVE-2024-9504 | High | 7.2 | 2024-11-26 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to… |
CVE-2024-8772 | Medium | 4.3 | 2024-11-26 | 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for… |
CVE-2024-8160 | Low | 3.8 | 2024-11-26 | Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a poss… |
CVE-2024-6831 | Medium | 4.4 | 2024-11-26 | Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the necessary permission due… |
CVE-2024-47257 | High | 7.5 | 2024-11-26 | Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device becoming unavailabl… |
CVE-2024-36254 | High | 7.5 | 2024-11-26 | Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-… |
CVE-2024-36251 | High | 7.5 | 2024-11-26 | The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to bill… |
CVE-2024-36249 | High | 7.4 | 2024-11-26 | Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is ex… |
CVE-2024-36248 | Critical | 9.1 | 2024-11-26 | API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the in… |
CVE-2024-35244 | Critical | 9.1 | 2024-11-26 | There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the cored… |
CVE-2024-34162 | Medium | 5.3 | 2024-11-26 | The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPL… |
CVE-2024-33616 | Medium | 5.3 | 2024-11-26 | Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states… |
CVE-2024-33610 | Critical | 9.1 | 2024-11-26 | "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information inclu… |
CVE-2024-33605 | High | 7.5 | 2024-11-26 | Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, mo… |
CVE-2024-32151 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-29978 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-29146 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-28955 | Medium | 5.9 | 2024-11-26 | Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files… |
CVE-2024-28038 | Critical | 9.0 | 2024-11-26 | The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character st… |
CVE-2024-11202 | Medium | 6.1 | 2024-11-26 | Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient inp… |
CVE-2024-6749 | Medium | 6.3 | 2024-11-26 | Seth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident report feature may expose sensitive credentials on the AXIS C… |
CVE-2024-6476 | Medium | 4.2 | 2024-11-26 | Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user to gain system privileges by redirectin… |
CVE-2024-11002 | Medium | 6.3 | 2024-11-26 | The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJAX action in all ver… |
CVE-2024-10857 | Medium | 6.5 | 2024-11-26 | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_dow… |
CVE-2024-10781 | High | 8.1 | 2024-11-26 | The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty… |
CVE-2024-10570 | High | 7.5 | 2024-11-26 | The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized SQL Injection due to an authorization bypass via reverse DNS spoofi… |
CVE-2024-10542 | Critical | 9.8 | 2024-11-26 | The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization… |
CVE-2024-10471 | Medium | 4.8 | 2024-11-26 | The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-53278 | Medium | 4.8 | 2024-11-26 | Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. If a malicious admin user customizes the admin screen with som… |
CVE-2024-49353 | High | 7.5 | 2024-11-26 | IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.0 through 5.0.2 does not properly check inputs to resources that are used concurrently, whi… |
CVE-2024-49351 | Medium | 5.5 | 2024-11-26 | IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user. |
CVE-2024-11418 | Medium | 6.1 | 2024-11-26 | The Additional Order Filters for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shipping_method_filter' parameter in… |