2024 CVEs (page 98)
Page 98 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51366 | Critical | 9.8 | 2024-11-21 | An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploading a crafted .con… |
CVE-2024-51364 | High | 8.8 | 2024-11-21 | An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file. |
CVE-2024-49588 | Medium | 6.8 | 2024-11-21 | Multiple endpoints in `oracle-sidecar` in versions 0.347.0 to 0.543.0 were found to be vulnerable to SQL injections. |
CVE-2024-53095 | Critical | 9.8 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free of network namespace. Recently, we got a customer report… |
CVE-2024-53094 | Critical | 9.8 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES While running ISER over SIW… |
CVE-2024-53093 | High | 7.5 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: defer partition scanning We need to suppress the partition scan from occu… |
CVE-2024-53092 | High | 8.4 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: virtio_pci: Fix admin vq cleanup by using correct info pointer vp_modern_avq_cleanup() an… |
CVE-2024-53091 | High | 7.8 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx As the introduction of the… |
CVE-2024-53090 | High | 7.5 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afs_wake_up_async_call() can incur lock recursion. The problem i… |
CVE-2024-53089 | Medium | 5.5 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Mark hrtimer to expire in hard interrupt context Like commit 2c0d278f3293… |
CVE-2024-51337 | Low | 3.5 | 2024-11-21 | Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email par… |
CVE-2024-53432 | High | 7.5 | 2024-11-21 | While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::out_of_range exception in PCLPointCloud2::at. This issue could po… |
CVE-2024-53335 | High | 7.8 | 2024-11-21 | TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi. |
CVE-2024-53334 | High | 8.8 | 2024-11-21 | TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in infostat.cgi. |
CVE-2024-53333 | Medium | 6.3 | 2024-11-21 | TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allows an attacker to… |
CVE-2024-52309 | | 2024-11-21 | SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerful feature of SFTPGo… | |
CVE-2024-52307 | Medium | 5.6 | 2024-11-21 | authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force t… |
CVE-2024-52289 | Critical | 9.8 | 2024-11-21 | authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are con… |
CVE-2024-52287 | High | 7.2 | 2024-11-21 | authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token fr… |
CVE-2024-48288 | High | 8.0 | 2024-11-21 | TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend. |
CVE-2024-48286 | High | 8.0 | 2024-11-21 | Linksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function. |
CVE-2024-52803 | High | 7.5 | 2024-11-21 | LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory train… |
CVE-2024-52799 | High | 8.2 | 2024-11-21 | Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the w… |
CVE-2024-49529 | Medium | 5.5 | 2024-11-21 | InDesign Desktop versions 19.0, 20.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An atta… |
CVE-2024-45517 | Medium | 5.4 | 2024-11-21 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h/rest endpoint of the Zimbra webmail an… |
CVE-2024-45513 | Medium | 4.8 | 2024-11-21 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/contacts/print endp… |
CVE-2024-45194 | Medium | 4.8 | 2024-11-21 | In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads. An attacke… |
CVE-2024-8526 | | 2024-11-21 | A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously crafted URL, which when visited by an authenticated WebCTRL user… | |
CVE-2024-8525 | | 2024-11-21 | An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a… | |
CVE-2024-45514 | Medium | 5.4 | 2024-11-21 | An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmai… |
CVE-2024-45512 | Medium | 5.4 | 2024-11-21 | An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. An attacker can exploit this vulnerability by creating a folder in the Briefcase… |
CVE-2024-53429 | High | 7.5 | 2024-11-21 | Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash. |
CVE-2024-48747 | Medium | 6.8 | 2024-11-21 | An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file. |
CVE-2024-29224 | Critical | 9.8 | 2024-11-21 | An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An… |
CVE-2024-28892 | Critical | 9.8 | 2024-11-21 | An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. A… |
CVE-2024-28027 | High | 7.2 | 2024-11-21 | Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially craft… |
CVE-2024-28026 | High | 7.2 | 2024-11-21 | Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially craft… |
CVE-2024-28025 | High | 7.2 | 2024-11-21 | Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially craft… |
CVE-2024-21855 | Critical | 9.8 | 2024-11-21 | A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command exe… |
CVE-2024-21786 | High | 7.2 | 2024-11-21 | An OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies MC LR Router 2.10.5. A specially crafte… |
CVE-2024-11592 | High | 7.3 | 2024-11-21 | A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-7130 | Medium | 5.5 | 2024-11-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kion Computer KION Exchange Programs Software allo… |
CVE-2024-7026 | High | 7.5 | 2024-11-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknogis Informatics Closed Circuit Vehicle Tracking Soft… |
CVE-2024-53426 | Medium | 6.2 | 2024-11-21 | A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function. |
CVE-2024-53425 | Medium | 6.2 | 2024-11-21 | A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed… |
CVE-2024-11591 | High | 7.3 | 2024-11-21 | A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /a… |
CVE-2024-11089 | Medium | 5.3 | 2024-11-21 | The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordP… |
CVE-2024-11088 | Medium | 5.3 | 2024-11-21 | The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core s… |
CVE-2024-7016 | Medium | 4.8 | 2024-11-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Smarttek Informatics Smart Doctor's allows Stored… |
CVE-2024-11590 | High | 7.3 | 2024-11-21 | A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown func… |
CVE-2024-11589 | Medium | 6.3 | 2024-11-21 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-11588 | Low | 3.5 | 2024-11-21 | A vulnerability was found in AVL-DiTEST-DiagDev libdoip 1.0.0. It has been rated as problematic. This issue affects the function DoIPConnection::reactOnReceive… |
CVE-2024-11587 | Low | 3.5 | 2024-11-21 | A vulnerability was found in idcCMS 1.60. It has been classified as problematic. This affects the function GetCityOptionJs of the file /inc/classProvCity.php… |
CVE-2024-9851 | Medium | 6.4 | 2024-11-21 | The LSX Tour Operator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.9 due to… |
CVE-2024-9828 | Medium | 4.1 | 2024-11-21 | The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high priv… |
CVE-2024-9768 | Medium | 4.8 | 2024-11-21 | The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-9600 | Medium | 4.8 | 2024-11-21 | The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform S… |
CVE-2024-9542 | Medium | 4.3 | 2024-11-21 | The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the render fu… |
CVE-2024-9442 | Medium | 6.4 | 2024-11-21 | The F4 Improvements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.9.0 due to i… |
CVE-2024-9371 | Medium | 6.1 | 2024-11-21 | The Branda – White Label & Branding, Custom Login Page Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove… |
CVE-2024-9111 | Medium | 6.4 | 2024-11-21 | The Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.36 due to… |
CVE-2024-8157 | Medium | 4.3 | 2024-11-21 | The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-7517 | High | 7.8 | 2024-11-21 | A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated atta… |
CVE-2024-5029 | Medium | 4.8 | 2024-11-21 | The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, w… |
CVE-2024-52797 | Medium | 6.5 | 2024-11-21 | Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and 14, Opencast's Elasticsearch integrati… |
CVE-2024-52067 | Medium | 4.9 | 2024-11-21 | Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization proc… |
CVE-2024-45663 | Medium | 6.5 | 2024-11-21 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, 11.5, and 12.1 is vulnerable to a denial of service as the server may crash under certa… |
CVE-2024-30896 | Critical | 9.1 | 2024-11-21 | InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the a… |
CVE-2024-11596 | High | 7.8 | 2024-11-21 | ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file |
CVE-2024-11595 | High | 7.8 | 2024-11-21 | FiveCo RAP dissector infinite loop in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file |
CVE-2024-11456 | Medium | 6.1 | 2024-11-21 | The Run Contests, Raffles, and Giveaways with ContestsWP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg w… |
CVE-2024-11455 | Medium | 6.4 | 2024-11-21 | The Include Mastodon Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'include-mastodon-feed' shortcode in all versions… |
CVE-2024-11447 | Medium | 6.1 | 2024-11-21 | The Community by PeepSo – Download from PeepSo.com plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filter’ parameter in all versi… |
CVE-2024-11440 | Medium | 6.4 | 2024-11-21 | The Grey Owl Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gol_button' shortcode in all versions up to, and incl… |
CVE-2024-11438 | Medium | 6.4 | 2024-11-21 | The StreamWeasels Online Status Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sw-status-bar' shortcode in all version… |
CVE-2024-11435 | Medium | 6.1 | 2024-11-21 | The salavat counter Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including… |
CVE-2024-11432 | Medium | 6.4 | 2024-11-21 | The SuevaFree Essential Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'counter' shortcode in all versions up to, and i… |
CVE-2024-11428 | Medium | 6.4 | 2024-11-21 | The Lazy load videos and sticky control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lazy-load-videos-and-sticky-control… |
CVE-2024-11424 | Medium | 6.4 | 2024-11-21 | The Slick Sitemap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slick-sitemap' shortcode in all versions up to, and inclu… |
CVE-2024-11416 | Medium | 6.1 | 2024-11-21 | The WIP Incoming Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or i… |
CVE-2024-11414 | Medium | 6.4 | 2024-11-21 | The RecipePress Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipe Ingredients in all versions up to, and including, 2.12.0… |
CVE-2024-11412 | Medium | 6.4 | 2024-11-21 | The Shine PDF Embeder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shinepdf' shortcode in all versions up to, and includ… |
CVE-2024-11409 | High | 7.2 | 2024-11-21 | The Grid View Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted inp… |
CVE-2024-11388 | Medium | 6.4 | 2024-11-21 | The Dino Game – Embed Google Chrome Dinosaur Game in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dino-game' s… |
CVE-2024-11385 | Medium | 6.4 | 2024-11-21 | The Pure CSS Circle Progress bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'circle_progress' shortcode in all versions… |
CVE-2024-11371 | Medium | 6.1 | 2024-11-21 | The Theater for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on… |
CVE-2024-11370 | Medium | 6.1 | 2024-11-21 | The Subaccounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapi… |
CVE-2024-11365 | Medium | 6.1 | 2024-11-21 | The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_a… |
CVE-2024-11360 | Medium | 6.1 | 2024-11-21 | The Page Parts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL… |
CVE-2024-11354 | Medium | 4.3 | 2024-11-21 | The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-11334 | Medium | 4.3 | 2024-11-21 | The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportar_registros() function i… |
CVE-2024-11320 | Critical | 9.8 | 2024-11-21 | Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS… |
CVE-2024-11197 | Medium | 4.2 | 2024-11-21 | The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application… |
CVE-2024-10898 | High | 8.8 | 2024-11-21 | The Contact Form 7 Email Add on plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the cf7_email_add_on_a… |
CVE-2024-10890 | Medium | 6.1 | 2024-11-21 | The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg with… |
CVE-2024-10796 | Medium | 4.3 | 2024-11-21 | The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifs… |
CVE-2024-10792 | Medium | 6.1 | 2024-11-21 | The Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' para… |
CVE-2024-10788 | High | 7.2 | 2024-11-21 | The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up… |
CVE-2024-10785 | Medium | 6.4 | 2024-11-21 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget… |
CVE-2024-10782 | Medium | 4.3 | 2024-11-21 | The Theme Builder For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the 'elementor-templ… |