2024 CVEs (page 99)
Page 99 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-48535 | Medium | 5.4 | 2024-11-20 | A stored cross-site scripting (XSS) vulnerability in eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary web scripts or HTML via injecting a cra… |
CVE-2024-48534 | Medium | 5.4 | 2024-11-20 | A reflected cross-site scripting (XSS) vulnerability on the Camp Details module of eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary code in t… |
CVE-2024-48533 | Medium | 5.3 | 2024-11-20 | A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allows attackers to enum… |
CVE-2024-48531 | Medium | 5.4 | 2024-11-20 | A reflected cross-site scripting (XSS) vulnerability on the Rental Availability module of eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary co… |
CVE-2024-48530 | High | 7.5 | 2024-11-20 | An issue in the Instructor Appointment Availability module of eSoft Planner 3.24.08271-USA allows attackers to cause a Denial of Service (DoS) via a crafted PO… |
CVE-2024-52757 | Medium | 4.9 | 2024-11-20 | D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the notify parameter in the arp_sys_asp function. |
CVE-2024-52754 | Medium | 4.9 | 2024-11-20 | D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the fn parameter in the tgfile_htm function. |
CVE-2024-48985 | High | 7.5 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 byt… |
CVE-2024-48983 | High | 7.5 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 byt… |
CVE-2024-48981 | High | 7.5 | 2024-11-20 | An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet header by looking up… |
CVE-2024-45510 | Medium | 5.4 | 2024-11-20 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scripting (XSS) attack due… |
CVE-2024-45511 | Medium | 5.4 | 2024-11-20 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the Briefcase module due to imp… |
CVE-2024-33439 | Critical | 9.1 | 2024-11-20 | An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi parameters. |
CVE-2024-52739 | High | 8.0 | 2024-11-20 | D-LINK DI-8400 v16.07.26A1 was discovered to contain multiple remote command execution (RCE) vulnerabilities in the msp_info_htm function via the flag and cmd… |
CVE-2024-29292 | Critical | 9.1 | 2024-11-20 | Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to execute arbitrary OS c… |
CVE-2024-11493 | Low | 3.5 | 2024-11-20 | A vulnerability classified as problematic was found in 115cms up to 20240807. This vulnerability affects unknown code of the file /index.php/setpage/admin/page… |
CVE-2024-11492 | Low | 3.5 | 2024-11-20 | A vulnerability classified as problematic has been found in 115cms up to 20240807. This affects an unknown part of the file /index.php/admin/web/appurladd.html… |
CVE-2024-52796 | Medium | 5.3 | 2024-11-20 | Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In versions prior to v1… |
CVE-2024-52771 | Critical | 9.1 | 2024-11-20 | DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view. |
CVE-2024-52770 | Critical | 9.8 | 2024-11-20 | An arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to execute arbitrary code via uploading a… |
CVE-2024-52769 | High | 7.2 | 2024-11-20 | An arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0 allows attackers to execute arbitrary code via uploading a cra… |
CVE-2024-52725 | Medium | 4.9 | 2024-11-20 | SemCms v4.8 was discovered to contain a SQL injection vulnerability. This allows an attacker to execute arbitrary code via the ldgid parameter in the SEMCMS_Se… |
CVE-2024-51163 | High | 7.5 | 2024-11-20 | A Local File Inclusion vulnerability in Vegam Solutions Vegam 4i versions 6.3.47.0 and earlier allows a remote attacker to obtain sensitive information through… |
CVE-2024-51162 | High | 8.8 | 2024-11-20 | An issue in Audimex EE versions 15.1.20 and earlier allowing a remote attacker to escalate privileges. Analyzing the offline client code, it was identified tha… |
CVE-2024-11491 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.p… |
CVE-2024-11490 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-11489 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807. It has been classified as problematic. Affected is an unknown function of the file /index.php/admin/web/fil… |
CVE-2024-11488 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807 and classified as problematic. This issue affects some unknown processing of the file /app/admin/view/web_us… |
CVE-2024-11487 | Medium | 6.3 | 2024-11-20 | A vulnerability has been found in Code4Berry Decoration Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /… |
CVE-2024-11486 | Medium | 4.3 | 2024-11-20 | A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0. This affects an unknown part of the file /decor… |
CVE-2024-11485 | Medium | 6.3 | 2024-11-20 | A vulnerability, which was classified as critical, has been found in Code4Berry Decoration Management System 1.0. Affected by this issue is some unknown functi… |
CVE-2024-11484 | Medium | 6.3 | 2024-11-20 | A vulnerability classified as critical was found in Code4Berry Decoration Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-52598 | High | 7.5 | 2024-11-20 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5… |
CVE-2024-52473 | High | 7.1 | 2024-11-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandeep Verma HTML5 Lyrics Karaoke Player html5-lyrics-ka… |
CVE-2024-52472 | High | 7.1 | 2024-11-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weather Atlas Weather Atlas Widget weather-atlas allows R… |
CVE-2024-52471 | High | 7.1 | 2024-11-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor allows Ref… |
CVE-2024-52470 | High | 7.1 | 2024-11-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Refl… |
CVE-2024-51209 | Medium | 5.4 | 2024-11-20 | Cross-Site Scripting (XSS) vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary web script or HTML vi… |
CVE-2024-51208 | High | 7.2 | 2024-11-20 | File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the I… |
CVE-2024-10094 | Critical | 9.1 | 2024-11-20 | Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code |
CVE-2024-9479 | | 2024-11-20 | Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Ins… | |
CVE-2024-9478 | | 2024-11-20 | Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Ins… | |
CVE-2024-52597 | Medium | 6.1 | 2024-11-20 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cros… |
CVE-2024-11154 | Medium | 4.3 | 2024-11-20 | The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure… |
CVE-2024-10913 | High | 8.8 | 2024-11-20 | The Clone plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.6 via deserialization of untrusted input in the… |
CVE-2024-11495 | High | 7.5 | 2024-11-20 | Buffer overflow vulnerability in OllyDbg, version 1.10, which could allow a local attacker to execute arbitrary code due to lack of proper bounds checking. |
CVE-2024-52451 | High | 8.2 | 2024-11-20 | Cross-Site Request Forgery (CSRF) vulnerability in aaronrobbins Post Ideas post-ideas allows SQL Injection.This issue affects Post Ideas: from n/a through <= 2. |
CVE-2024-52450 | High | 7.5 | 2024-11-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in officialprocoders nBlocks nblocks allo… |
CVE-2024-52449 | High | 7.5 | 2024-11-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Navneil Naicer Bootscraper allows PHP Local File Inclusion.This… |
CVE-2024-52448 | High | 7.5 | 2024-11-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified… |
CVE-2024-52447 | High | 8.6 | 2024-11-20 | Path Traversal: '.../...//' vulnerability in corporatezen222 Contact Page With Google Map contact-page-with-google-map allows Path Traversal.This issue affects… |
CVE-2024-52446 | High | 8.8 | 2024-11-20 | Cross-Site Request Forgery (CSRF) vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm allows Object Injection.This issue affects Buying Bud… |
CVE-2024-52445 | High | 8.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in ModelTheme QRMenu Restaurant QR Menu Lite qrmenu-lite allows Object Injection.This issue affects QRMenu Rest… |
CVE-2024-52444 | High | 7.5 | 2024-11-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-produc… |
CVE-2024-52443 | Critical | 9.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in masikonis Geolocator geolocator allows Object Injection.This issue affects Geolocator: from n/a through <= 1… |
CVE-2024-52442 | Critical | 9.8 | 2024-11-20 | Incorrect Privilege Assignment vulnerability in userplus UserPlus userplus allows Privilege Escalation.This issue affects UserPlus: from n/a through <= 2.0. |
CVE-2024-52441 | Critical | 9.8 | 2024-11-20 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Rajesh Thanoch Quick Learn quick-learn allows Object… |
CVE-2024-52440 | Critical | 9.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in xpresslane Xpresslane Fast Checkout xpresslane-integration-for-woocommerce allows Object Injection.This issu… |
CVE-2024-52439 | Critical | 9.8 | 2024-11-20 | Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a t… |
CVE-2024-52438 | High | 8.8 | 2024-11-20 | Missing Authentication for Critical Function vulnerability in deco.agency de:branding debranding allows Privilege Escalation.This issue affects de:branding: fr… |
CVE-2024-52437 | High | 8.8 | 2024-11-20 | Missing Authentication for Critical Function vulnerability in Saul Morales Pacheco Banner System banner-system allows Privilege Escalation.This issue affects B… |
CVE-2024-11406 | Medium | 6.9 | 2024-11-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Field… |
CVE-2024-11404 | Medium | 5.5 | 2024-11-20 | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Asso… |
CVE-2024-10520 | Medium | 5.3 | 2024-11-20 | The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the '… |
CVE-2024-48899 | Medium | 4.3 | 2024-11-20 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended… |
CVE-2024-45691 | Medium | 5.4 | 2024-11-20 | A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose com… |
CVE-2024-45690 | High | 7.5 | 2024-11-20 | A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts. |
CVE-2024-45689 | Medium | 6.5 | 2024-11-20 | A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not h… |
CVE-2024-10872 | Medium | 6.4 | 2024-11-20 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template-post-custom-field` block in all versions up t… |
CVE-2024-10382 | High | 7.5 | 2024-11-20 | There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitr… |
CVE-2024-11494 | High | 7.5 | 2024-11-20 | **UNSUPPORTED WHEN ASSIGNED** The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP_20140331 could allow an u… |
CVE-2024-11179 | Medium | 6.5 | 2024-11-20 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versi… |
CVE-2024-10891 | Medium | 6.4 | 2024-11-20 | The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'save_as_pdf_pdfcrowd' shortcode in all v… |
CVE-2024-10665 | Medium | 5.4 | 2024-11-20 | The Yaad Sarig Payment Gateway For WC plugin for WordPress is vulnerable to unauthorized modification & access of data due to a missing capability check on the… |
CVE-2024-11176 | | 2024-11-20 | Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluat… | |
CVE-2024-10127 | Critical | 9.8 | 2024-11-20 | Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user aut… |
CVE-2024-10126 | Medium | 4.3 | 2024-11-20 | Local File Inclusion vulnerability in M-Files Server in versions before 24.11 (excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7) allows an authenticated user to read… |
CVE-2024-52033 | Medium | 5.3 | 2024-11-20 | Exposure of sensitive system information to an unauthorized control sphere issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulne… |
CVE-2024-48895 | High | 8.8 | 2024-11-20 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlie… |
CVE-2024-47865 | Medium | 5.3 | 2024-11-20 | Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited… |
CVE-2024-9239 | Medium | 6.1 | 2024-11-20 | The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without app… |
CVE-2024-8726 | Medium | 6.1 | 2024-11-20 | The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escap… |
CVE-2024-11277 | Medium | 6.1 | 2024-11-20 | The 404 Solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 2.35.19 due to insufficien… |
CVE-2024-10900 | Medium | 6.5 | 2024-11-20 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2024-10899 | High | 7.3 | 2024-11-20 | The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. This is… |
CVE-2024-10855 | High | 8.1 | 2024-11-20 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to… |
CVE-2024-10365 | Medium | 4.3 | 2024-11-20 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Informati… |
CVE-2024-9653 | Medium | 6.1 | 2024-11-20 | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter… |
CVE-2024-52614 | Medium | 4.0 | 2024-11-20 | Use of hard-coded cryptographic key issue exists in "Kura Sushi Official App Produced by EPARK" for Android versions prior to 3.8.5. If this vulnerability is e… |
CVE-2024-10515 | Low | 3.5 | 2024-11-20 | In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to implement Stored XSS on… |
CVE-2024-11278 | Medium | 6.1 | 2024-11-20 | The GD bbPress Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on… |
CVE-2024-44309 | Medium | 6.3 | 2024-11-20 | A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPad… |
CVE-2024-44308 | High | 8.8 | 2024-11-20 | The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 1… |
CVE-2024-44307 | High | 7.8 | 2024-11-20 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.6. An app may be able to execute arbitrary code wit… |
CVE-2024-44306 | High | 7.8 | 2024-11-20 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.6. An app may be able to execute arbitrary code wit… |
CVE-2024-52595 | High | 7.7 | 2024-11-19 | lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly… |
CVE-2024-52392 | Medium | 6.3 | 2024-11-19 | Cross-Site Request Forgery (CSRF) vulnerability in w3speedster W3SPEEDSTER w3speedster-wp.This issue affects W3SPEEDSTER: from n/a through <= 7.25. |
CVE-2024-51669 | Medium | 4.3 | 2024-11-19 | Cross-Site Request Forgery (CSRF) vulnerability in Kalmang Dynamic Widgets dynamic-widgets.This issue affects Dynamic Widgets: from n/a through <= 1.6.4. |
CVE-2024-30424 | Medium | 6.5 | 2024-11-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Beaver Builder Addons by WPZOOM wpzoom-addons-for-… |
CVE-2024-11400 | Medium | 6.1 | 2024-11-19 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the really_curr_tax parameter… |