2024 CVEs (page 98)
Page 98 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45512 | Medium | 5.4 | 2024-11-21 | An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. An attacker can exploit this vulnerability by creating a folder in the Briefcase… |
CVE-2024-53429 | High | 7.5 | 2024-11-21 | Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash. |
CVE-2024-48747 | Medium | 6.8 | 2024-11-21 | An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file. |
CVE-2024-29224 | Critical | 9.8 | 2024-11-21 | An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An… |
CVE-2024-28892 | Critical | 9.8 | 2024-11-21 | An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. A… |
CVE-2024-28027 | High | 7.2 | 2024-11-21 | Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially craft… |
CVE-2024-28026 | High | 7.2 | 2024-11-21 | Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially craft… |
CVE-2024-28025 | High | 7.2 | 2024-11-21 | Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially craft… |
CVE-2024-21855 | Critical | 9.8 | 2024-11-21 | A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command exe… |
CVE-2024-21786 | High | 7.2 | 2024-11-21 | An OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies MC LR Router 2.10.5. A specially crafte… |
CVE-2024-11592 | High | 7.3 | 2024-11-21 | A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-7130 | Medium | 5.5 | 2024-11-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kion Computer KION Exchange Programs Software allo… |
CVE-2024-7026 | High | 7.5 | 2024-11-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknogis Informatics Closed Circuit Vehicle Tracking Soft… |
CVE-2024-53426 | Medium | 6.2 | 2024-11-21 | A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function. |
CVE-2024-53425 | Medium | 6.2 | 2024-11-21 | A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed… |
CVE-2024-11591 | High | 7.3 | 2024-11-21 | A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /a… |
CVE-2024-11089 | Medium | 5.3 | 2024-11-21 | The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordP… |
CVE-2024-11088 | Medium | 5.3 | 2024-11-21 | The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core s… |
CVE-2024-7016 | Medium | 4.8 | 2024-11-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Smarttek Informatics Smart Doctor's allows Stored… |
CVE-2024-11590 | High | 7.3 | 2024-11-21 | A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown func… |
CVE-2024-11589 | Medium | 6.3 | 2024-11-21 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-11588 | Low | 3.5 | 2024-11-21 | A vulnerability was found in AVL-DiTEST-DiagDev libdoip 1.0.0. It has been rated as problematic. This issue affects the function DoIPConnection::reactOnReceive… |
CVE-2024-11587 | Low | 3.5 | 2024-11-21 | A vulnerability was found in idcCMS 1.60. It has been classified as problematic. This affects the function GetCityOptionJs of the file /inc/classProvCity.php… |
CVE-2024-9851 | Medium | 6.4 | 2024-11-21 | The LSX Tour Operator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.9 due to… |
CVE-2024-9828 | Medium | 4.1 | 2024-11-21 | The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high priv… |
CVE-2024-9768 | Medium | 4.8 | 2024-11-21 | The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-9600 | Medium | 4.8 | 2024-11-21 | The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform S… |
CVE-2024-9542 | Medium | 4.3 | 2024-11-21 | The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the render fu… |
CVE-2024-9442 | Medium | 6.4 | 2024-11-21 | The F4 Improvements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.9.0 due to i… |
CVE-2024-9371 | Medium | 6.1 | 2024-11-21 | The Branda – White Label & Branding, Custom Login Page Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove… |
CVE-2024-9111 | Medium | 6.4 | 2024-11-21 | The Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.36 due to… |
CVE-2024-8157 | Medium | 4.3 | 2024-11-21 | The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-7517 | High | 7.8 | 2024-11-21 | A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated atta… |
CVE-2024-5029 | Medium | 4.8 | 2024-11-21 | The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, w… |
CVE-2024-52797 | Medium | 6.5 | 2024-11-21 | Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and 14, Opencast's Elasticsearch integrati… |
CVE-2024-52067 | Medium | 4.9 | 2024-11-21 | Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization proc… |
CVE-2024-45663 | Medium | 6.5 | 2024-11-21 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, 11.5, and 12.1 is vulnerable to a denial of service as the server may crash under certa… |
CVE-2024-30896 | Critical | 9.1 | 2024-11-21 | InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the a… |
CVE-2024-11596 | High | 7.8 | 2024-11-21 | ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file |
CVE-2024-11595 | High | 7.8 | 2024-11-21 | FiveCo RAP dissector infinite loop in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file |
CVE-2024-11456 | Medium | 6.1 | 2024-11-21 | The Run Contests, Raffles, and Giveaways with ContestsWP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg w… |
CVE-2024-11455 | Medium | 6.4 | 2024-11-21 | The Include Mastodon Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'include-mastodon-feed' shortcode in all versions… |
CVE-2024-11447 | Medium | 6.1 | 2024-11-21 | The Community by PeepSo – Download from PeepSo.com plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filter’ parameter in all versi… |
CVE-2024-11440 | Medium | 6.4 | 2024-11-21 | The Grey Owl Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gol_button' shortcode in all versions up to, and incl… |
CVE-2024-11438 | Medium | 6.4 | 2024-11-21 | The StreamWeasels Online Status Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sw-status-bar' shortcode in all version… |
CVE-2024-11435 | Medium | 6.1 | 2024-11-21 | The salavat counter Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including… |
CVE-2024-11432 | Medium | 6.4 | 2024-11-21 | The SuevaFree Essential Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'counter' shortcode in all versions up to, and i… |
CVE-2024-11428 | Medium | 6.4 | 2024-11-21 | The Lazy load videos and sticky control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lazy-load-videos-and-sticky-control… |
CVE-2024-11424 | Medium | 6.4 | 2024-11-21 | The Slick Sitemap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slick-sitemap' shortcode in all versions up to, and inclu… |
CVE-2024-11416 | Medium | 6.1 | 2024-11-21 | The WIP Incoming Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or i… |
CVE-2024-11414 | Medium | 6.4 | 2024-11-21 | The RecipePress Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipe Ingredients in all versions up to, and including, 2.12.0… |
CVE-2024-11412 | Medium | 6.4 | 2024-11-21 | The Shine PDF Embeder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shinepdf' shortcode in all versions up to, and includ… |
CVE-2024-11409 | High | 7.2 | 2024-11-21 | The Grid View Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted inp… |
CVE-2024-11388 | Medium | 6.4 | 2024-11-21 | The Dino Game – Embed Google Chrome Dinosaur Game in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dino-game' s… |
CVE-2024-11385 | Medium | 6.4 | 2024-11-21 | The Pure CSS Circle Progress bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'circle_progress' shortcode in all versions… |
CVE-2024-11371 | Medium | 6.1 | 2024-11-21 | The Theater for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on… |
CVE-2024-11370 | Medium | 6.1 | 2024-11-21 | The Subaccounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapi… |
CVE-2024-11365 | Medium | 6.1 | 2024-11-21 | The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_a… |
CVE-2024-11360 | Medium | 6.1 | 2024-11-21 | The Page Parts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL… |
CVE-2024-11354 | Medium | 4.3 | 2024-11-21 | The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-11334 | Medium | 4.3 | 2024-11-21 | The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportar_registros() function i… |
CVE-2024-11320 | Critical | 9.8 | 2024-11-21 | Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS… |
CVE-2024-11197 | Medium | 4.2 | 2024-11-21 | The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application… |
CVE-2024-10898 | High | 8.8 | 2024-11-21 | The Contact Form 7 Email Add on plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the cf7_email_add_on_a… |
CVE-2024-10890 | Medium | 6.1 | 2024-11-21 | The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg with… |
CVE-2024-10796 | Medium | 4.3 | 2024-11-21 | The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifs… |
CVE-2024-10792 | Medium | 6.1 | 2024-11-21 | The Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' para… |
CVE-2024-10788 | High | 7.2 | 2024-11-21 | The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up… |
CVE-2024-10785 | Medium | 6.4 | 2024-11-21 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget… |
CVE-2024-10782 | Medium | 4.3 | 2024-11-21 | The Theme Builder For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the 'elementor-templ… |
CVE-2024-10726 | Medium | 6.1 | 2024-11-21 | The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to… |
CVE-2024-10696 | Medium | 4.3 | 2024-11-21 | The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) plugin for WordPress… |
CVE-2024-10682 | Medium | 6.1 | 2024-11-21 | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg and remo… |
CVE-2024-10675 | Medium | 6.1 | 2024-11-21 | The affiliate-toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 3.6.7 due to insuffi… |
CVE-2024-10671 | Medium | 4.3 | 2024-11-21 | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and incl… |
CVE-2024-10623 | Medium | 6.1 | 2024-11-21 | The ForumEngine theme for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 1.8 due to insufficient inp… |
CVE-2024-10532 | Medium | 4.3 | 2024-11-21 | The Bard Extra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bardxtra_import_xml() function… |
CVE-2024-10528 | Medium | 4.3 | 2024-11-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauth… |
CVE-2024-10522 | Medium | 6.1 | 2024-11-21 | The Co-marquage service-public.fr plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esca… |
CVE-2024-10482 | Medium | 5.4 | 2024-11-21 | The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which c… |
CVE-2024-10403 | High | 7.5 | 2024-11-21 | Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmwa… |
CVE-2024-10400 | High | 7.5 | 2024-11-21 | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insuffic… |
CVE-2024-10393 | Medium | 5.3 | 2024-11-21 | The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the… |
CVE-2024-10316 | Medium | 4.3 | 2024-11-21 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/te… |
CVE-2024-10177 | Medium | 6.4 | 2024-11-21 | The Beds24 Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's beds24-link shortcode in all versions up to, and i… |
CVE-2024-10172 | Medium | 6.4 | 2024-11-21 | The WPBakery Visual Composer WHMCS Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's void_wbwhmcse_laouts_search shor… |
CVE-2024-10164 | Medium | 6.4 | 2024-11-21 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdmpp_pay_link shortc… |
CVE-2024-9875 | High | 7.1 | 2024-11-21 | Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature… |
CVE-2024-52755 | Medium | 4.9 | 2024-11-21 | D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the host_ip parameter in the ipsec_road_asp function. |
CVE-2024-51151 | Critical | 9.8 | 2024-11-21 | D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter. |
CVE-2024-52765 | Critical | 9.8 | 2024-11-20 | H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter. |
CVE-2024-52702 | Medium | 5.4 | 2024-11-20 | A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2024-52701 | Medium | 5.4 | 2024-11-20 | A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2024-52677 | Critical | 9.8 | 2024-11-20 | HkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php. |
CVE-2024-52581 | High | 7.5 | 2024-11-20 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the ent… |
CVE-2024-49203 | | 2024-11-20 | Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the pr… | |
CVE-2024-48986 | High | 7.5 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header… |
CVE-2024-48984 | Critical | 9.8 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software dynamically determines the length of a list of reports by reading… |
CVE-2024-48982 | High | 7.5 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header… |
CVE-2024-48536 | High | 7.5 | 2024-11-20 | Incorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a crafted web request. |