2024 CVEs (page 99)
Page 99 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10726 | Medium | 6.1 | 2024-11-21 | The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to… |
CVE-2024-10696 | Medium | 4.3 | 2024-11-21 | The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) plugin for WordPress… |
CVE-2024-10682 | Medium | 6.1 | 2024-11-21 | The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg and remo… |
CVE-2024-10675 | Medium | 6.1 | 2024-11-21 | The affiliate-toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 3.6.7 due to insuffi… |
CVE-2024-10671 | Medium | 4.3 | 2024-11-21 | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and incl… |
CVE-2024-10623 | Medium | 6.1 | 2024-11-21 | The ForumEngine theme for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 1.8 due to insufficient inp… |
CVE-2024-10532 | Medium | 4.3 | 2024-11-21 | The Bard Extra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bardxtra_import_xml() function… |
CVE-2024-10528 | Medium | 4.3 | 2024-11-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauth… |
CVE-2024-10522 | Medium | 6.1 | 2024-11-21 | The Co-marquage service-public.fr plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esca… |
CVE-2024-10482 | Medium | 5.4 | 2024-11-21 | The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which c… |
CVE-2024-10403 | High | 7.5 | 2024-11-21 | Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmwa… |
CVE-2024-10400 | High | 7.5 | 2024-11-21 | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insuffic… |
CVE-2024-10393 | Medium | 5.3 | 2024-11-21 | The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the… |
CVE-2024-10316 | Medium | 4.3 | 2024-11-21 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/te… |
CVE-2024-10177 | Medium | 6.4 | 2024-11-21 | The Beds24 Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's beds24-link shortcode in all versions up to, and i… |
CVE-2024-10172 | Medium | 6.4 | 2024-11-21 | The WPBakery Visual Composer WHMCS Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's void_wbwhmcse_laouts_search shor… |
CVE-2024-10164 | Medium | 6.4 | 2024-11-21 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdmpp_pay_link shortc… |
CVE-2024-9875 | High | 7.1 | 2024-11-21 | Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature… |
CVE-2024-52755 | Medium | 4.9 | 2024-11-21 | D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the host_ip parameter in the ipsec_road_asp function. |
CVE-2024-51151 | Critical | 9.8 | 2024-11-21 | D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter. |
CVE-2024-52765 | Critical | 9.8 | 2024-11-20 | H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter. |
CVE-2024-52702 | Medium | 5.4 | 2024-11-20 | A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2024-52701 | Medium | 5.4 | 2024-11-20 | A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2024-52677 | Critical | 9.8 | 2024-11-20 | HkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php. |
CVE-2024-52581 | High | 7.5 | 2024-11-20 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the ent… |
CVE-2024-49203 | | 2024-11-20 | Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the pr… | |
CVE-2024-48986 | High | 7.5 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header… |
CVE-2024-48984 | Critical | 9.8 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software dynamically determines the length of a list of reports by reading… |
CVE-2024-48982 | High | 7.5 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header… |
CVE-2024-48536 | High | 7.5 | 2024-11-20 | Incorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a crafted web request. |
CVE-2024-48535 | Medium | 5.4 | 2024-11-20 | A stored cross-site scripting (XSS) vulnerability in eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary web scripts or HTML via injecting a cra… |
CVE-2024-48534 | Medium | 5.4 | 2024-11-20 | A reflected cross-site scripting (XSS) vulnerability on the Camp Details module of eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary code in t… |
CVE-2024-48533 | Medium | 5.3 | 2024-11-20 | A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allows attackers to enum… |
CVE-2024-48531 | Medium | 5.4 | 2024-11-20 | A reflected cross-site scripting (XSS) vulnerability on the Rental Availability module of eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary co… |
CVE-2024-48530 | High | 7.5 | 2024-11-20 | An issue in the Instructor Appointment Availability module of eSoft Planner 3.24.08271-USA allows attackers to cause a Denial of Service (DoS) via a crafted PO… |
CVE-2024-52757 | Medium | 4.9 | 2024-11-20 | D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the notify parameter in the arp_sys_asp function. |
CVE-2024-52754 | Medium | 4.9 | 2024-11-20 | D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the fn parameter in the tgfile_htm function. |
CVE-2024-48985 | High | 7.5 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 byt… |
CVE-2024-48983 | High | 7.5 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 byt… |
CVE-2024-48981 | High | 7.5 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet header by looking up… |
CVE-2024-45510 | Medium | 5.4 | 2024-11-20 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scripting (XSS) attack due… |
CVE-2024-45511 | Medium | 5.4 | 2024-11-20 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the Briefcase module due to imp… |
CVE-2024-33439 | Critical | 9.1 | 2024-11-20 | An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi parameters. |
CVE-2024-52739 | High | 8.0 | 2024-11-20 | D-LINK DI-8400 v16.07.26A1 was discovered to contain multiple remote command execution (RCE) vulnerabilities in the msp_info_htm function via the flag and cmd… |
CVE-2024-29292 | Critical | 9.1 | 2024-11-20 | Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to execute arbitrary OS c… |
CVE-2024-11493 | Low | 3.5 | 2024-11-20 | A vulnerability classified as problematic was found in 115cms up to 20240807. This vulnerability affects unknown code of the file /index.php/setpage/admin/page… |
CVE-2024-11492 | Low | 3.5 | 2024-11-20 | A vulnerability classified as problematic has been found in 115cms up to 20240807. This affects an unknown part of the file /index.php/admin/web/appurladd.html… |
CVE-2024-52796 | Medium | 5.3 | 2024-11-20 | Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In versions prior to v1… |
CVE-2024-52771 | Critical | 9.1 | 2024-11-20 | DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view. |
CVE-2024-52770 | Critical | 9.8 | 2024-11-20 | An arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to execute arbitrary code via uploading a… |
CVE-2024-52769 | High | 7.2 | 2024-11-20 | An arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0 allows attackers to execute arbitrary code via uploading a cra… |
CVE-2024-52725 | Medium | 4.9 | 2024-11-20 | SemCms v4.8 was discovered to contain a SQL injection vulnerability. This allows an attacker to execute arbitrary code via the ldgid parameter in the SEMCMS_Se… |
CVE-2024-51163 | High | 7.5 | 2024-11-20 | A Local File Inclusion vulnerability in Vegam Solutions Vegam 4i versions 6.3.47.0 and earlier allows a remote attacker to obtain sensitive information through… |
CVE-2024-51162 | High | 8.8 | 2024-11-20 | An issue in Audimex EE versions 15.1.20 and earlier allowing a remote attacker to escalate privileges. Analyzing the offline client code, it was identified tha… |
CVE-2024-11491 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.p… |
CVE-2024-11490 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-11489 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807. It has been classified as problematic. Affected is an unknown function of the file /index.php/admin/web/fil… |
CVE-2024-11488 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807 and classified as problematic. This issue affects some unknown processing of the file /app/admin/view/web_us… |
CVE-2024-11487 | Medium | 6.3 | 2024-11-20 | A vulnerability has been found in Code4Berry Decoration Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /… |
CVE-2024-11486 | Medium | 4.3 | 2024-11-20 | A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0. This affects an unknown part of the file /decor… |
CVE-2024-11485 | Medium | 6.3 | 2024-11-20 | A vulnerability, which was classified as critical, has been found in Code4Berry Decoration Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2024-11484 | Medium | 6.3 | 2024-11-20 | A vulnerability classified as critical was found in Code4Berry Decoration Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-52598 | High | 7.5 | 2024-11-20 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5… |
CVE-2024-52473 | High | 7.1 | 2024-11-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandeep Verma HTML5 Lyrics Karaoke Player html5-lyrics-ka… |
CVE-2024-52472 | High | 7.1 | 2024-11-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weather Atlas Weather Atlas Widget weather-atlas allows R… |
CVE-2024-52471 | High | 7.1 | 2024-11-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor allows Ref… |
CVE-2024-52470 | High | 7.1 | 2024-11-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Refl… |
CVE-2024-51209 | Medium | 5.4 | 2024-11-20 | Cross-Site Scripting (XSS) vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary web script or HTML vi… |
CVE-2024-51208 | High | 7.2 | 2024-11-20 | File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the I… |
CVE-2024-10094 | Critical | 9.1 | 2024-11-20 | Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code |
CVE-2024-9479 | | 2024-11-20 | Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Ins… | |
CVE-2024-9478 | | 2024-11-20 | Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Ins… | |
CVE-2024-52597 | Medium | 6.1 | 2024-11-20 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cros… |
CVE-2024-11154 | Medium | 4.3 | 2024-11-20 | The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure… |
CVE-2024-10913 | High | 8.8 | 2024-11-20 | The Clone plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.6 via deserialization of untrusted input in the… |
CVE-2024-11495 | High | 7.5 | 2024-11-20 | Buffer overflow vulnerability in OllyDbg, version 1.10, which could allow a local attacker to execute arbitrary code due to lack of proper bounds checking. |
CVE-2024-52451 | High | 8.2 | 2024-11-20 | Cross-Site Request Forgery (CSRF) vulnerability in aaronrobbins Post Ideas post-ideas allows SQL Injection.This issue affects Post Ideas: from n/a through <= 2. |
CVE-2024-52450 | High | 7.5 | 2024-11-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in officialprocoders nBlocks nblocks allo… |
CVE-2024-52449 | High | 7.5 | 2024-11-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Navneil Naicer Bootscraper allows PHP Local File Inclusion.This… |
CVE-2024-52448 | High | 7.5 | 2024-11-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified… |
CVE-2024-52447 | High | 8.6 | 2024-11-20 | Path Traversal: '.../...//' vulnerability in corporatezen222 Contact Page With Google Map contact-page-with-google-map allows Path Traversal.This issue affects… |
CVE-2024-52446 | High | 8.8 | 2024-11-20 | Cross-Site Request Forgery (CSRF) vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm allows Object Injection.This issue affects Buying Bud… |
CVE-2024-52445 | High | 8.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in ModelTheme QRMenu Restaurant QR Menu Lite qrmenu-lite allows Object Injection.This issue affects QRMenu Rest… |
CVE-2024-52444 | High | 7.5 | 2024-11-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-produc… |
CVE-2024-52443 | Critical | 9.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in masikonis Geolocator geolocator allows Object Injection.This issue affects Geolocator: from n/a through <= 1… |
CVE-2024-52442 | Critical | 9.8 | 2024-11-20 | Incorrect Privilege Assignment vulnerability in userplus UserPlus userplus allows Privilege Escalation.This issue affects UserPlus: from n/a through <= 2.0. |
CVE-2024-52441 | Critical | 9.8 | 2024-11-20 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Rajesh Thanoch Quick Learn quick-learn allows Object… |
CVE-2024-52440 | Critical | 9.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in xpresslane Xpresslane Fast Checkout xpresslane-integration-for-woocommerce allows Object Injection.This issu… |
CVE-2024-52439 | Critical | 9.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a t… |
CVE-2024-52438 | High | 8.8 | 2024-11-20 | Missing Authentication for Critical Function vulnerability in deco.agency de:branding debranding allows Privilege Escalation.This issue affects de:branding: fr… |
CVE-2024-52437 | High | 8.8 | 2024-11-20 | Missing Authentication for Critical Function vulnerability in Saul Morales Pacheco Banner System banner-system allows Privilege Escalation.This issue affects B… |
CVE-2024-11406 | Medium | 6.9 | 2024-11-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Field… |
CVE-2024-11404 | Medium | 5.5 | 2024-11-20 | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Asso… |
CVE-2024-10520 | Medium | 5.3 | 2024-11-20 | The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the '… |
CVE-2024-48899 | Medium | 4.3 | 2024-11-20 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended… |
CVE-2024-45691 | Medium | 5.4 | 2024-11-20 | A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose com… |
CVE-2024-45690 | High | 7.5 | 2024-11-20 | A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts. |
CVE-2024-45689 | Medium | 6.5 | 2024-11-20 | A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not h… |
CVE-2024-10872 | Medium | 6.4 | 2024-11-20 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template-post-custom-field` block in all versions up t… |
CVE-2024-10382 | High | 7.5 | 2024-11-20 | There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitr… |